Dark Angels Exposed

This report analyzes Dark Angels’ file-encryption techniques: a Windows RTM/Babuk-derived variant that uses per-file Curve25519 keys + ECDH and ChaCha20 with public keys appended to file extensions (no footer), and a RagnarLocker-based Linux/ESXi variant that uses a per-system secp256k1 key, ECDH (libsecp256k1 custom hash) and AES-256-CBC with a 177-byte footer containing decryption parameters and configurable block-skip modes; the document describes encryption flows, footer structure, optimization for large files, and a Windows implementation flaw that can prevent recovery of partially encrypted files.