Reverse Engineering Vitya Ransomware | Debugging a Broken XOR Decryption Routine

This analysis of a suspicious .NET MSI file reveals a ransomware stealer communicating via Telegram, but its implementation is flawed due to an invalid decryption key and weak, predictable encryption that allows for potential reversal.

Key Takeaways:
• The file is an unsigned .NET MSI with a 23/70 VirusTotal detection rate, utilizing AES encryption and Telegram for C2 2:15
• Static analysis reveals hardcoded strings for crypto streams, Telegram tokens, and persistence mechanisms in the registry 2:30
• The malware gathers victim IP addresses and sends them to a Telegram bot, attempting to establish persistence 1:50
• Dynamic analysis shows the malware generates a GUI for ransom notes and encrypts files using a key derived from the username 6:55
• The analyst discovers the Telegram decryption key is invalid, indicating the malware is likely in a testing or development phase 17:40
• The encryption scheme is critically weak because the IV is statically generated and the key is predictable, enabling potential brute-force recovery 20:05

The analysis concludes that while the malware functions as a ransomware stealer, its poor implementation and invalid keys render it ineffective against determined defenders.

Sources:

• 0:33 VirusTotal scan results showing 23/70 detection.
• 2:15 Identification of .NET structure and AES encryption.
• 2:30 Discovery of hardcoded crypto strings and Telegram tokens.
• 6:55 Analysis of ransom note generat