In this section we will take the techniques that we learned during the analysis section and apply them 1
to a real life ransomware case the malware we will be looking at is simplocker. 2
This is a standard ransomware sample that prompts the victim with a warning screen telling them to pay 3
a ransom to restore the device. 4
In the background Simplocker encrypts the files on the device storage by reverse engineering the malware 5
sample. 6
We hope to obtain a good understanding of how the files are being encrypted. 7
This will allow us to create a decryption tool that decrypt the encrypted files. 8
The goal here is to use the knowledge gained in the previous sections and apply them to a real life 9
use case. 10
We will start off by showing a report generated during the automated analysis of the malware sample 11
then we will run the malware sample on our emulator in order to observe the behavior. 12
Next we will apply a static analysis techniques to the sample in order to obtain the necessary information 13
that could lead to decryption and finally we will create a decryption tool that will restore the encrypted 14
files on our device.