When You Pay the Ransom - Taking Apart an Interlock ESXi Decryptor
Recently, I received a freshly compiled set of decryption tools obtained through direct negotiations with the Interlock ransomware threat group. As you may know, ransomware decryptors rarely reach public analysis. Victims who pay do not usually share the tools. These tools are useful artifacts that can help clarify how a particular ransomware's crypto works. That might be why public reporting on Interlock still disagrees with itself about something as basic as which cipher it uses.
As you might expect, the decryption tools (with one exception) are heavily obfuscated - the Windows tool is nearly 10 MiB, full of thousands of junk words and functions. The x64 and ARM versions of the Linux tool were similarly padded. Surprisingly, the ESXi tool was only compiled and then stripped of symbols. This made the analysis fairly straightforward.