GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → NullArray → Cypher

NullArray / Cypher

Licence: gpl-3.0
Pythonic ransomware proof of concept.

Programming Languages

python
139335 projects - #7 most used programming language

Labels

encryptionmalwareransomwarevirus

Projects that are alternatives of or similar to Cypher

Crypter
Crypter - Python3 based builder and ransomware compiled to Windows executable using PyInstaller
Stars: ✭ 268 (+50.56%)
Mutual labels:  encryption, malware, ransomware, virus
The-MALWARE-Repo
A repository full of malware samples.
Stars: ✭ 380 (+113.48%)
Mutual labels:  virus, malware, ransomware
Malware
Rootkits | Backdoors | Sniffers | Virus | Ransomware | Steganography | Cryptography | Shellcodes | Webshells | Keylogger | Botnets | Worms | Other Network Tools
Stars: ✭ 156 (-12.36%)
Mutual labels:  malware, ransomware, virus
JavaRansomware
Simple Ransomware Tool in Pure Java
Stars: ✭ 99 (-44.38%)
Mutual labels:  virus, malware, ransomware
Gonnacry
A Linux Ransomware
Stars: ✭ 341 (+91.57%)
Mutual labels:  encryption, malware, ransomware
Ultimate.hosts.blacklist
The Ultimate Unified Hosts file for protecting your network, computer, smartphones and Wi-Fi devices against millions of bad web sites. Protect your children and family from gaining access to bad web sites and protect your devices and pc from being infected with Malware or Ransomware.
Stars: ✭ 606 (+240.45%)
Mutual labels:  malware, ransomware
Lime Rat
LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT)
Stars: ✭ 663 (+272.47%)
Mutual labels:  malware, ransomware
Malware Samples
A collection of malware samples caught by several honeypots i manage
Stars: ✭ 863 (+384.83%)
Mutual labels:  malware, ransomware
Python Ransomware
Python Ransomware Tutorial - YouTube tutorial explaining code + showcasing the ransomware with victim/target roles
Stars: ✭ 96 (-46.07%)
Mutual labels:  malware, ransomware
Xeexe Topantivirusevasion
Undetectable & Xor encrypting with custom KEY (FUD Metasploit Rat) bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,... & Automatically Add ICON and MANIFEST to excitable
Stars: ✭ 387 (+117.42%)
Mutual labels:  malware, ransomware
Blocklistsaggregator
A Python tool that downloads IP block lists from various sources and builds configurations for network equipments and firewalls.
Stars: ✭ 20 (-88.76%)
Mutual labels:  malware, ransomware
Ransom0
Ransom0 is a open source ransomware made with Python, designed to find and encrypt user data.
Stars: ✭ 105 (-41.01%)
Mutual labels:  ransomware, virus
Ransomware
A POC Windows crypto-ransomware (Academic)
Stars: ✭ 504 (+183.15%)
Mutual labels:  malware, ransomware
Gobot2
Second Version of The GoBot Botnet, But more advanced.
Stars: ✭ 431 (+142.13%)
Mutual labels:  malware, virus
Hblock
Improve your security and privacy by blocking ads, tracking and malware domains.
Stars: ✭ 724 (+306.74%)
Mutual labels:  malware, ransomware
Trojancockroach
A Stealthy Trojan Spyware
Stars: ✭ 424 (+138.2%)
Mutual labels:  malware, virus
Zeus
NOT MY CODE! Zeus trojan horse - leaked in 2011, I am not the author. This repository is for study purposes only, do not message me about your lame hacking attempts.
Stars: ✭ 1,043 (+485.96%)
Mutual labels:  malware, virus
Ratel
RAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus software.
Stars: ✭ 121 (-32.02%)
Mutual labels:  malware, virus
Block
Let's make an annoyance free, better open internet, altogether!
Stars: ✭ 1,849 (+938.76%)
Mutual labels:  malware, ransomware
The Big List Of Hacked Malware Web Sites
This repository contains a list of all web sites I come across that are either hacked with or purposefully hosting malware, ransomware, viruses or trojans.
Stars: ✭ 125 (-29.78%)
Mutual labels:  malware, ransomware
View All Similar Projects ➔

Cypher

Cypher is a proof of concept ransomware which implements the PyCrypto module and uses gmail(Currently) as a simple command and control server. It is a work in progress as of yet and i will be releasing updates periodically depending on a couple of factors

Operation

Cypher operates by generating a unique client ID for each box that has been infected. The client ID and encryption key will be sent via email to a gmail adress by leveraging python's SMTP lib. The new version of Cypher will give the operator the choice to pick between gmail and the C&C infrastructure that comes with the finished project, namely a web application to generate and store key pairs together with client IDs. If the operator chooses to employ the Cypher web app the ransomware will contact via HTTP by leveraging the Mechanize lib.

After Cypher has enumerated the files we wish to encrypt the multiprocessing and PyCrypto libs are employed to do the actual encrypting. I opted to use the multiprocessing lib to speed up the encryption process.

Finally Cypher will write out a README note and the client ID which would have to be relayed to the operator in order to retrieve the proper decrypting binary and key respectively.

Update

I have added some logic to have the ransomware log in to the web app with the Mechanize lib. As of yet functionality to retrieve a key from the web app and to post the client ID have not been implemented. SMTP is still available and in the near future optional depending on the preference of the operator.

I am setting up a web application as an alternative C&C mechanism, in keeping with the Python theme of this project i am employing the Django framework for the web app. Commits will be pushed to the repo in due time.

The latest version of the encryption module adds bootlocker functionality by attempting to overwrite the MBR with a custom bootloader. Shoutout to NO-OP for his contribution in this regard. I've added the source code together with boot.bin for illustrative purposes.

To do

  • Extensive and multi-platform testing.

  • Write decrypting module.

  • Functionality to restore MBR

  • Designing and developing a more secure C&C mechanism.

    • Possibly HTTP in favor of SMTP and;
    • Web App to dynamically provide encryption keys in favor of local generation

Want to contribute?

I'd be more than willing to collaborate on this and if you wish to contribute feel free to open an issue or a pull request and we may discuss the details and/or ideas we could work on and you might want to suggest.

alt tag

Note

Development of C&C web application has been postponed for the time being. If you want to get creative i would recommend this fork or this original web application written in PHP with Laravel by my friend Filtration. It is compatible with Cypher with a little tinkering.

Furthermore, someone seems to have uploaded the stub for the main Cypher file to Virus Total. You can check it out by clicking here. For testing purposes i'd be interested to see detection rates for the Windows variant once it's encoded with someting like peCloakCapstone or PeCloak. That is of course after the main Python file has been compiled to exe with Py2Exe or Pyinstaller.

Also, if you have any pull requests to submit please feel free to do so. Open Source collaboration on this Ransomware remains to be of import to me.

Thanks.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].