When You Pay the Ransom - Taking Apart an Interlock ESXi Decryptor | Maldbg

The blog analyzes a recently obtained Interlock ESXi ransomware decryptor, revealing insights into its encryption method and tool behavior. The decryptor uses AES-256-GCM, but discards the authentication tag, effectively operating like CTR mode, and encrypts about 8.7% of large files in a progressive, front-loaded pattern. Unlike typical ransomware tools, this decryptor embeds the victim's RSA private key in plaintext, lacks networking or process execution capabilities, and overwrites files directly without safe backups. The analysis, aided by identifying linked LibTomCrypt functions, clarifies previously conflicting public reports about Interlock's cryptography.