I've seen a few mentions of something along the lines of "The malware then checks for files with a file extension as listed in the appendix and encrypts these using 2048-bit RSA encryption."

I'm not super well versed in crypto, but is this possible? I assume they use symmetric encryption and then RSA encrypt the symmetric keys?