re-ransomware

What it does: - Identifies when files have been encrypted by ransomware by looking at file name changes, corrupted file headers, and ransom notes - Finds out what encryption method was used and where the decryption keys are stored - Traces how the ransomware talks to its command servers to get keys - Suggests ways to recover files, such as extracting keys, using decryption tools, or restoring from backups When to use it: - Your files got encrypted and you see ransom notes asking for money - You need to figure out if files can be recovered and how - You are analyzing a ransomware sample to understand how it works - You need to identify the encryption type and find the keys