Abstract
The latest trend in ransomware development includes file encryption, exfiltration of encrypted data, and public disclosures about it. This complex attack pattern complicates analysis and poses challenges for security companies and researchers. In this work, we introduce a framework for analyzing double-extortion ransomware using static malware analysis without running a malware binary. The framework relies on 45 correlated static indicators that were obtained from publicly available technical studies of ransomware families. Indicators are categorized according to functional classes and tied to various stages of ransomware behavior. We use the proposed framework for identifying the core behavioral functions of double-extortion ransomware families and the indicators of families that make them different from each other. The framework was applied to three ransomware families: LockBit, Conti, and REvil. The evaluation of the framework shows that ransomware families have a common core of behavioral functions but possess different family-specific behavioral indicators. It allows concluding that the proposed framework can serve as a good foundation for analysis and comparison of double-extortion ransomware families. The risk of malware execution was mitigated in this paper. Besides being able to conduct comparative analysis across ransomware families, the framework provides an interpretable and scalable approach which can be used in places where dynamic analysis is impossible due to high costs.