---
title: "Data Keeper: RaaS new offering"
description: A new ecosystem of ransomware delivery and profit-making is coming into being. It’s no longer one individual who is solely responsible for manufacturing, distribution and profiting from a ransomware. It’s now an open business for anyone and everyone who is willing to be a part of this illicit money-making scheme.
canonical_url: https://www.acronis.com/en/blog/posts/data-keeper/
locale: en
last_updated: 2026-10-27
---

[Acronis Blog](https://www.acronis.com/en/blog/)
# Data Keeper: RaaS new offering

A new ecosystem of ransomware delivery and profit-making is coming into being.

[Try Now](https://www.acronis.com/en/products/true-image/trial/)

[![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team")

[Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/)

13 min read

Last updated 17 August 2018

A new ecosystem of ransomware delivery and profit-making is coming into being. It’s no longer one individual who is solely responsible for manufacturing, distribution and profiting from a ransomware. It’s now an open business for anyone and everyone who is willing to be a part of this illicit money-making scheme.

**_Written by Ravikant Tiwari_**

Within a very short span, we have seen an explosion of the number of Ransomware as a Service (RaaS) offerings made on dark web. Data Keeper is the latest addition, joining recently offered RaaS strains like GandCrab and Saturn. If you’re willing to distribute Data Keeper, it’s offered for free by the members of this service. The ransom demanded from victims is currently a minimum of 0.03 BTC.

Data Keeper spread quickly, reportedly being seen in the wild just two days after the service was live in the underground market. Infections from Data Keeper were reported from many different parts of the world, generating plenty of media attention.

## Data Keeper’s RaaS Model

The Data Keeper RaaS is available on the dark web and requires one-time registration to become a member of the service. Each member is assigned a globally unique identifier, or GUID, which is used to recognize members for each [ransomware infection](https://www.acronis.com/en-us/ransomware-protection/) and to award them accordingly.

Half of the overall profit made by all ransomware infections generated by a particular GUID is awarded to the owner of that GUID.

## Member Panel

The Member Panel has options to manage passwords, generate GUID-specific ransomware binaries, customize binary functionalities, specify the payment amounts for victims, and show the current statistics on the total number of infection and total number of payments made.

![Image 3: Member's panel - Instructions page](https://staticfiles.acronis.com/images/content/f7819bdf07586a265940808a14b6397f.png)

Member's panel - Instructions page

Figure 1: Member's panel - Instructions page

On the Compile page, users can specify the list of extensions that the ransomware will encrypt, enable or disable network share encryption, choose to enable or disable run-as-administrator options, and control the ability to encrypt remote shares.

![Image 4: Compile page](https://staticfiles.acronis.com/images/content/34bf59344e79a013a10bb57963d49606.png)

Compile page

Figure 2: Compile page

Once the user hits the Compile button, a task is created and the process of generating a member-specific ransomware binary begins. As soon as the ransomware-building process finishes, a hyperlink to download the binary is created on the same page. Users can build multiple binaries for distribution, and all builds will be listed with the last compile time as its label.

![Image 5: Link to download ransomware encryptor](https://staticfiles.acronis.com/images/content/584bf9763bce0ebed20f68ef6b0190ef.png)

Link to download ransomware encryptor

Figure 3: Link to download ransomware encryptor

The ransomware decrypter is also available to download in the Member Area section of this panel.

![Image 6: Ransomware decryptor download page](https://staticfiles.acronis.com/images/content/acda327109c2e20487a7611eda83d9b1.png)

Ransomware decryptor download page

Figure 4: Ransomware decryptor download page

## Technical Analysis

In this article we will take a look at a Data Keeper sample with MD5 0x75DD2CDF1A2D2CAFCD90F34214F5F037, which was found in the wild. The file has following version information and was first submitted to Virustotal on 2018-03-01 13:33:10.

![Image 7: image005_11.png](https://staticfiles.acronis.com/images/content/36da68c00acc741f79b95240754786c2.png)

image005_11.png

Figure 5: File Version Info

## Installation

Data Keeper ransomware is built in dotnet and has multiple layers of executables compressed and stored in the resource section, which has _.resx_ format. Each layer is also obscured using ConfuserEx. The subsequent first two layers are executables and the next two are DLLs.

![Image 8: Flow diagram of Data Keeper executables](https://staticfiles.acronis.com/images/content/1d9f6782e385daf38a1fd82930c9f775.png)

Flow diagram of Data Keeper executables

Figure 6: Flow diagram of Data Keeper executables

The main executable decompresses the next layer of the dotnet executable, copies it with a random name and .bin extension to the _%LocalAPPDATA%/_ directory, and executes it. The main executable then terminates and the newly created binary takes over. The new executable also decompresses and loads a DLL named _Flavorer.dll_ in memory from its resource section. _Flavorer.dll_ similarly loads the actual ransomware DLL named _Sepialike.dll_ which has functionalities for encryption and lateral movement. At no point are these two DLLs are written onto the disk.

![Image 9: Executable with random name copied in APPDATA/Local](https://staticfiles.acronis.com/images/content/721a2025db9e4fe92e09ad437126557f.png)

Executable with random name copied in APPDATA/Local

Figure 7: Executable with random name copied in APPDATA/Local

No entry for persistence is found for this ransomware, and there are also no checks implemented to prevent reinfection of the same machine, which means it can infect the same user’s machine multiple times. For every encryption, a new link is added to the ransomware’s “Help” file. If there are multiple infections, the victim needs to pay for each infection separately.

Data Keeper don’t use any named mutex. Instead it scans all of the processes running on the system and if a process with a similar name as of the current ransomware process is found, it terminates itself.

## Key Generation

Data Keeper uses an AES symmetric cipher to encrypt user files. For AES encryption, it uses the non-FIPS compliant _RijndaelManaged_ class of dotnet framework instead of the standard _AesCryptoServiceProvider_ class generally preferred by other ransomware authors.

The AES algorithm is used with the following configuration.

 Key size 

 256 bits 

 Block Size 

 128 bits 

 Mode 

 CBC Mode 

 Padding 

 None 

The AES key and Initialization Vector (IV) are generated by calling on the _GenerateKey()_ and _GenerateIV()_ functions. For each key, a unique Key ID is also generated using _Guid.NewGuid()_ method.

![Image 10: Key Generation](https://staticfiles.acronis.com/images/content/f463ccff3e5c61936540e1c381d7750f.png)

Key Generation

Figure 8: Key Generation

Next it decompresses and decodes the hardcoded master public key stored in the resource .resx file, and imports it to encrypt the AES key, IV and other encryption related contents mentioned below.

![Image 11: Master RSA public key and extensions list in resource.](https://staticfiles.acronis.com/images/content/1e41697addb3861f49665cacb714d15c.png)

Master RSA public key and extensions list in resource.

Figure 9: Master RSA public key and extensions list in resource.

![Image 12: Decompressed and decoded Master RSA public key](https://staticfiles.acronis.com/images/content/bd4e4cff9ec6026d44c29c83423b928b.png)

Decompressed and decoded Master RSA public key

Figure 10: Decompressed and decoded Master RSA public key

The encrypted key, IV, and length of encryption is then converted to base64 before writing it to the user data URL in the ransom note, along with **key ID** and **token** (the identifier of the ransomware distributor). This URL redirects to a personalized decrypter service page where victims can make payment and receive a decrypter.

![Image 13: Setting user data URL](https://staticfiles.acronis.com/images/content/46d58c9586ba3208b69706e064b8917d.png)

Setting user data URL

Figure 11: Setting user data URL

The Key Data structure has the following format:

1.   First 20 bytes is key
2.   Next 10 bytes of IV
3.   Followed by four bytes of a constant value from resource and
4.   12 bytes of randomly generated length for encryption (encryptDataLength) which is in multiple of 256-bit block size.

![Image 14: Key Data Structure](https://staticfiles.acronis.com/images/content/82464c277e4ce258d9673c4cffaddef1.png)

Key Data Structure

Figure 12: Key Data Structure

The user URL included in the ransom note appears as seen in below image. Different components of the URL are marked with different color.

![Image 15: User data URL example](https://staticfiles.acronis.com/images/content/872e681087f36e93b2641929ddb66b89.png)

User data URL example

Figure 13: User data URL example

## Encryption Process

Data Keeper only encrypts files on fixed drives. However, it can itemize all connected network shares and use PsExec to launch itself and encrypt files on these devices. It maintains a list of names that can be used to launch a dictionary attack to gain access to shared network devices.

It excludes the files inside the “Program files” folder from encryption.

![Image 16: Drive Enumeration](https://staticfiles.acronis.com/images/content/93ebd1c7a5a69ef19336815db22a9476.png)

Drive Enumeration

Figure 14: Drive Enumeration

![Image 17: Excludes program files](https://staticfiles.acronis.com/images/content/07ac06d2738bc0f862451aa8602ead49.png)

Excludes program files

Figure 15: Excludes program files

It begins the file and directory enumeration and encryption process in a multi-threaded mode. The maximum number of threads are decided based on the number of processors on the machine. Before encryption, it reads the last 36 bytes and matches it with regex to find a string like GUID in order to verify whether the file was already encrypted. If the file was previously encrypted, the file will not be encrypted again.

![Image 18: Checking the last 36 byte](https://staticfiles.acronis.com/images/content/079952e0be50a7fb6da46556b4e984c3.png)

Checking the last 36 byte

Figure 16: Checking the last 36 byte

To encrypt user files, Data Keeper begins by saving the last write time of the file. It then compares the file size against a value “n” (where “n” is length of encryption), which is randomly decided by ransomware for the current session. It then tries to read “n” number of bytes in memory from the file on disk. If the file size is smaller than “n”, then the file size is divided by the square of the maximum block size possible in RijndaelManaged class (that is 322 bytes), and the resulted number of bytes are only read into the memory from the file for encryption.

A crypto stream is then created using a crypto transform object instantiated by the _CreateEncryptor()_ function and the session’s AES configuration. The memory array is then written to this crypto stream to encrypt the content. The encrypted content is then written back at the “offset 0” of the file, replacing a number of original bytes that is equal to the length of the encrypted data. The file is reopened in the append mode and the current key GUID is added to the end. Finally, the newly encrypted file is restored to original last write time, which was there before encryption.

![Image 19: Writing encrypted content and key ID to file](https://staticfiles.acronis.com/images/content/30434476af772560a0b8115253cfcfa1.png)

Writing encrypted content and key ID to file

Figure 17: Writing encrypted content and key ID to file

![Image 20: Restore last file write time](https://staticfiles.acronis.com/images/content/be02e7ffeec9a4c0273f88172252770b.png)

Restore last file write time

Figure 18: Restore last file write time

![Image 21: Extension names that data keeper sample found in wild encrypts](https://staticfiles.acronis.com/images/content/eff405573789a472e0b55a5028d28ad3.png)

Extension names that data keeper sample found in wild encrypts

Figure 19: Extension names that data keeper sample found in wild encrypts

![Image 22: File structure after encryption](https://staticfiles.acronis.com/images/content/0ff40a1b32be72e5e6862e54990e831a.png)

File structure after encryption

Figure 20: File structure after encryption

## Network Enumeration and Encryption

Data Keeper uses the same multi-threaded routine to enumerate and encrypt files on network share. To enumerate network shares, it implements its own NetShares class which uses the _NetShareEnum_ API from _Netapi32.dll_ of the Windows operating system.

![Image 23: NetShare class implementation](https://staticfiles.acronis.com/images/content/58bb4cf906a9bb40225b2f596b86b62f.png)

NetShare class implementation

Figure 21: NetShare class implementation

The code snippet below shows Data Keeper calling _method\_48()_ in thread functions.

![Image 24: Calling method_48() in multi-threading](https://staticfiles.acronis.com/images/content/65decb297858a880712df5643f85aea5.png)

Calling method_48() in multi-threading

Figure 22: Calling method_48() in multi-threading

The called method_48 implements the NetShares class to enumerate all network resources and creates a list of files that will be then passed to the encryption routine.

![Image 25: Snippet of method_48()](https://staticfiles.acronis.com/images/content/4b1cffc4467486dfae56beed08b123a9.png)

Snippet of method_48()

Figure 23: Snippet of method_48()

## Ransom Notes

Data Keeper creates a ransom note as an HTML file with name **_“!!! ##### === ReadMe === ##### !!!.htm”_** in the parent directory of the encrypted files directory. The ransom note contains instruction on how to download a TOR browser and links to the site for downloading the decrypter.

![Image 26: Ransom Note](https://staticfiles.acronis.com/images/content/ee440c533ac2d285284bb65da98eb3e2.png)

Ransom Note

Figure 24: Ransom Note

## Decryption

No free decryption tool is available for this ransomware yet. To decrypt their files, users must visit the link in the ransom note, which will redirect them to Data Keeper’s decrypter service page. It instructs victim to pay 0.03 bitcoin to the attacker’s wallet address. Once the payment is successfully validated, the decrypter can be downloaded from a link on the same page.

![Image 27: raas](https://staticfiles.acronis.com/images/content/34a86d16040cb93e946f330caa2c9bfd.png)

raas

## Conclusion

With rise of the Ransomware as a Service model, it has become very easy for any attacker to acquire a binary for free, spread it, and get paid for their successful infections. The promise of “free money” will lure many people to become attackers, which is why a steep rise in ransomware activity is expected.

To protect against complicated ransomware attacks like Data Keeper, users need next gen cybersecurity solutions based on machine learning and behavioral heuristic. Products with [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/) enabled, like [Acronis True Image 2020](https://www.acronis.com/en-us/personal/computer-backup/), include these next gen technologies and are able to protect users against sophisticated ransomware attacks like Data Keeper.

![Image 28: Acronis detects Data Keeper ransomware](https://staticfiles.acronis.com/images/content/af5023d801cab63e65b6aad0b42c69c7.png)

Acronis detects Data Keeper ransomware

Figure 25: Acronis detects Data Keeper ransomware

![Image 29: Acronis blocks Data Keeper](https://staticfiles.acronis.com/images/content/a87e7940255839f53f9fcf0215a0e87e.png)

Acronis blocks Data Keeper

Figure 26: Acronis blocks Data Keeper

![Image 30: Acronis recovers affected files by Data Keeper](https://staticfiles.acronis.com/images/content/98c004153428cc8a8e37cdaeb2a85cb8.png)

Acronis recovers affected files by Data Keeper

Figure 27: Acronis recovers affected files by Data Keeper

[Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/)  
[Data protection](https://www.acronis.com/en/blog/tags/data-protection/)  
[Cyber protection for businesses](https://www.acronis.com/en/blog/tags/cyber-protection-for-business/)  
[Security software for business](https://www.acronis.com/en/blog/tags/security-software-for-business/)  
[Cloud backup](https://www.acronis.com/en/blog/tags/cloud-backup/)  
[Disaster recovery](https://www.acronis.com/en/blog/tags/disaster-recovery/)  
[Data loss prevention](https://www.acronis.com/en/blog/tags/data-loss-prevention/)

## Written by

![Image 31: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)

Acronis Editorial Team

Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments.

[Previous post](https://www.acronis.com/en/blog/posts/gandcrab/)  
[Evolution of GandCrab Ransomware](https://www.acronis.com/en/blog/posts/gandcrab/)

[Next post](https://www.acronis.com/en/blog/posts/cloud-backup-for-photographers/)  
[Cloud Backup for Photographers](https://www.acronis.com/en/blog/posts/cloud-backup-for-photographers/)

About Acronis

Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.

[Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com)

## Related stories

Want to learn more? Read the latest stories featuring this solution on our blog.

[Acronis Blog](https://www.acronis.com/en/blog/)

![Image 32: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png)

[stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/)

We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain.

**October 26, 2026**3 min read

![Image 33: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png)

[Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/)

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

**October 13, 2026**6 min read

![Image 34: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png)

[Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/)

Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform.

**October 05, 2026**4 min read