FunkSec Ransomware and Rust Reverse Analysis
Summary From the checkpoint research, the FunkSec ransomware group first emerged publicly in late 2024 and rapidly gained prominence by publishing over 85 claimed victims—more than any other ransomware group in the month of December. I did research with a shared sample. Technical Analysis FunkSec Ransomware is named by the binary inside strings “funksec.pdb,” its extension “.funksec,” and ransom note, written in the Rust computer language and run on Windows and compiled in the environment of “C:\\Users\\Abdellah\\.cargo\\...,” with the time date stamp “2024-12-31 20:26:29,” AMD64 Architecture, without a packer. And "This program requires administrator privileges." Figure1-Binary Information Figure2-Ransomware Note Snippet Like the other ransom group, it generated a special readme file as a ransom note to tell the victim about “stop” and “what happened,” including what the bitcoin wallet address is, how to buy bitcoin, how much bitcoin to pay, and the contac...