AVL Code
All cases
#016 · Sample Analysis

Analysis of a CryptoLocker Ransomware Variant (Rapid/Djvu)

To thoroughly analyze a ransomware threat, analysts drove AVL Code with a single natural-language instruction, closing the loop from malicious sample to a complete analysis report.

Built with AVL Code + the Landi model

RansomwareCryptoLockerRapid/DjvuWindows SecurityYARA

Overview

Facing a 116KB Win32 executable — an unpacked, Visual C++–compiled CryptoLocker ransomware variant of the Rapid/Djvu family — analysts drove AVL Code with one natural-language instruction to reverse-engineer its PE structure and behavior in depth: reconstructing its RSA-2048 offline encryption scheme (embedded public key, keys stored in the registry, encrypted files given a .cryptolocker extension) and identifying file-tree encryption, shadow-copy deletion, system-recovery disabling, termination of 20+ database/office processes, one-by-one removal of mainstream AV services, and dual persistence via a registry Run key plus scheduled tasks — producing a report with a complete IOC list, YARA rules and an incident-response plan, classified as Critical.

Key results

  • Fully reverse-engineered the 116KB unpacked Win32 sample, reconstructing the RSA-2048 offline encryption scheme (embedded public key, keys stored in the registry, .cryptolocker extension on encrypted files)
  • Identified 6 core malicious behaviors: file-tree encryption, shadow-copy deletion, system-recovery disabling, termination of 20+ database/office processes, one-by-one removal of mainstream AV services, and dual persistence (registry Run key + scheduled tasks)
  • Extracted a complete IOC list (4 file hashes, 2 ransom emails, registry key-storage and autostart entries, 20+ terminated processes/services) and generated deployment-ready YARA detection rules
  • Attributed the sample to the Rapid/Djvu ransomware family and produced a report with an incident-response plan, classified as a Critical-severity threat

Technical highlights

RSA-2048 encryption-scheme reconstructionPE structure and import-table analysisRegistry + scheduled-task persistence detectionAnti-security-software behavior identificationShadow-copy deletion and recovery-disabling detectionAutomated IOC extraction and YARA rule generation

Practical value

Helps security operations rapidly identify and respond to ransomware threats, provides end-to-end guidance from detection to incident response, strengthens ransomware detection and handling, and effectively protects enterprise data assets from encryption extortion.

Artifacts

View session Download session import into your workspace for full detail View report

Session replays & reports are original records in Simplified Chinese · Built with AVL Code + the Landi model