Ransomware Encryption Analyzer
Guides an agent through analyzing ransomware encryption to judge whether files can be decrypted.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, this skill tells the agent how to examine a ransomware sample and its encrypted files: identify the encryption algorithm (such as AES, RSA, or ChaCha20), look at how keys are generated and stored, and check for implementation mistakes that could allow recovery without paying the attacker. It also includes a Python helper that computes file hashes, measures entropy, and searches for cryptographic constants in a binary.
Great for
- Incident responders and malware analysts assessing whether a ransomware-encrypted system can be recovered
- Security students learning how ransomware cryptography is reverse engineered
- Teams checking whether a known free decryptor from NoMoreRansom.org could apply to their case
Skip it if
- Routine data restoration: the skill itself warns to verify any decryption method on test copies first, since a wrong attempt can permanently damage files
- People without malware-analysis skills who would be running ghidra or decompiled code on live infected machines, which can spread the infection
- Anyone looking to build a working ransomware or to break encryption on systems they do not own or have authority to test
Try asking
- “Analyze this ransomware sample and tell me which encryption scheme it uses and whether files can be decrypted.”
- “Check these encrypted files and a known plaintext pair for signs of key reuse or a weak IV.”
- “Scan this binary for crypto API imports and known cipher constants.”
- “Assess decryption feasibility for a LockBit-style infection and check NoMoreRansom for existing decryptors.”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-ransomware-encryption-mechanisms.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-ransomware-encryption-mechanisms.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-ransomware-encryption-mechanisms.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Always work on copies of encrypted files and a isolated analysis machine, never on the production originals.
- Provide a known plaintext and encrypted pair if you have one; it makes feasibility checks much more reliable.
- Check NoMoreRansom.org first, since a free decryptor may already exist for the family.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.