GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → ReddyyZ → Deathransom

ReddyyZ / Deathransom

Licence: gpl-3.0
A ransomware developed in python, with bypass technics, for educational purposes.

Programming Languages

python
139335 projects - #7 most used programming language

Labels

malwarersaransomware

Projects that are alternatives of or similar to Deathransom

Gonnacry
A Linux Ransomware
Stars: ✭ 341 (+170.63%)
Mutual labels:  malware, ransomware
Ultimate.hosts.blacklist
The Ultimate Unified Hosts file for protecting your network, computer, smartphones and Wi-Fi devices against millions of bad web sites. Protect your children and family from gaining access to bad web sites and protect your devices and pc from being infected with Malware or Ransomware.
Stars: ✭ 606 (+380.95%)
Mutual labels:  malware, ransomware
Engine
Droidefense: Advance Android Malware Analysis Framework
Stars: ✭ 386 (+206.35%)
Mutual labels:  malware, ransomware
Crypter
Crypter - Python3 based builder and ransomware compiled to Windows executable using PyInstaller
Stars: ✭ 268 (+112.7%)
Mutual labels:  malware, ransomware
Malware Samples
A collection of malware samples caught by several honeypots i manage
Stars: ✭ 863 (+584.92%)
Mutual labels:  malware, ransomware
Cryptsky
A simple, fully python ransomware PoC
Stars: ✭ 304 (+141.27%)
Mutual labels:  malware, ransomware
Ransomware
A POC Windows crypto-ransomware (Academic)
Stars: ✭ 504 (+300%)
Mutual labels:  malware, ransomware
The-MALWARE-Repo
A repository full of malware samples.
Stars: ✭ 380 (+201.59%)
Mutual labels:  malware, ransomware
Block
Let's make an annoyance free, better open internet, altogether!
Stars: ✭ 1,849 (+1367.46%)
Mutual labels:  malware, ransomware
Hblock
Improve your security and privacy by blocking ads, tracking and malware domains.
Stars: ✭ 724 (+474.6%)
Mutual labels:  malware, ransomware
Ransomware
Crypto Ransomware made with: - Go for encryption and decryption - PHP/MySQL for saving and retrieving keys.
Stars: ✭ 19 (-84.92%)
Mutual labels:  malware, ransomware
Python Ransomware
Python Ransomware Tutorial - YouTube tutorial explaining code + showcasing the ransomware with victim/target roles
Stars: ✭ 96 (-23.81%)
Mutual labels:  malware, ransomware
MalwareDatabase
One of the few malware collection
Stars: ✭ 37 (-70.63%)
Mutual labels:  malware, ransomware
Hosts
🔒 Consolidating and extending hosts files from several well-curated sources. Optionally pick extensions for porn, social media, and other categories.
Stars: ✭ 19,363 (+15267.46%)
Mutual labels:  malware, ransomware
JavaRansomware
Simple Ransomware Tool in Pure Java
Stars: ✭ 99 (-21.43%)
Mutual labels:  malware, ransomware
Xeexe Topantivirusevasion
Undetectable & Xor encrypting with custom KEY (FUD Metasploit Rat) bypass Top Antivirus like BitDefender,Malwarebytes,Avast,ESET-NOD32,AVG,... & Automatically Add ICON and MANIFEST to excitable
Stars: ✭ 387 (+207.14%)
Mutual labels:  malware, ransomware
Owlyshield
Owlyshield is an EDR framework designed to safeguard vulnerable applications from potential exploitation (C&C, exfiltration and impact))..
Stars: ✭ 281 (+123.02%)
Mutual labels:  malware, ransomware
file-less-ransomware-demo
Demonstrate about file-less malware approach using JavaScript
Stars: ✭ 46 (-63.49%)
Mutual labels:  malware, ransomware
Lime Rat
LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT)
Stars: ✭ 663 (+426.19%)
Mutual labels:  malware, ransomware
Blocklistsaggregator
A Python tool that downloads IP block lists from various sources and builds configurations for network equipments and firewalls.
Stars: ✭ 20 (-84.13%)
Mutual labels:  malware, ransomware
View All Similar Projects ➔

DeathRansom

IT'S ONLY FOR STUDY. I'M NOT RESPONSIBLE FOR YOUR ACTIONS.

If you have any questions, enter in this discord group: https://discord.gg/v5d3PZ9

What is a ransomware?

A ransomware is malware that encrypts all your files and shows a ransom request, which tells you to pay a set amount, usually in bitcoins (BTC), in a set time to decrypt your files, or he will delete your files.

How it works?

First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.

How to use?

Install the requiriments typing: pip install -r requirements.txt and python3 -m pip install PyQt5
Generate the keys, upload the public key to pastebin, copy the raw link, and change the site on the line 7 in deathransom.py python generate_key.py
Transform time_script.py and main.py(Located at Ransom Request) into exe.
Transform the time_script into exe using pyinstaller in python2 version typing pyinstaller --onefile --windowed <FILE>
To transform the main of ransom request we will use the pyinstaller in the python3 version pyinstaller --onefile --windowed main.py
Then uploads the scripts to any file hosting service and change the links on the line 28 and 31 in deathransom.py
So just transform deathransom.py into exe using pyinstaller in python2 version and be happy :D

Bypass Technics

  • Anti-Disassembly

Creates several variables to try to make disassembly difficult.

  • Anti-Debugger

Checks if a debugger is active using the ctypes function: windll.kernel32.IsDebuggerPresent()

  • Anti-Vm

Checks if the machine's mac is the same as the standard vms mac.

  • Anti-Sandbox

  • Sleep-Acceleration

Some sandboxes speed up sleep, this function checks if nothing out of the ordinary has occurred.

  • Sandbox in Process

Checks if have any sandbox in running processes

  • Display-Prompt

Shows a message, if the user interact with the pop up, the malware will be executed.

  • Idle-Time

Sleeps for a while and proceed. Some sandboxes wait for a while and stop running, that tries to bypass this.

  • Check-Click

If the user does not click the number of times necessary the malware not will be executed.

  • Check-Cursor-Pos

If the user not move the mouse in a seted time the malware not be executed.

How to edit the Ransom Request

To edit, you need install the PySide2. Open the main.ui file, and edit what you want.

Demonstration Video

Demonstration Video

Click on the image

Video de demonstração PT-BR

Video de demonstração PT-BR

Clique na imagem

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].