ransomware - A POC Windows crypto-ransomware (Academic). Now Ra

项目说明

Ransomware

![Build Status]()

> Note 1: This project is purely academic, use at your own risk. I do not encourage in any way the use of this software illegally or to attack targets without their previous authorization.

> Note 2: Unfortunatelly now some anti (including Windows Defender) detects the unlocker as a virus. Disable any antivirus to play with the project.

Remember, security is always a double-edged sword

Demo video (Old , without Tor support):

![DEMO]()

What is Ransomware?

Ransomware is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files unless a ransom is paid. More modern ransomware families, collectively categorized as crypto-ransomware, encrypt certain file types on infected systems and forces users to pay the ransom through certain online payment methods to get a decrypt key.

Project Summary

This project was de for the Computer Security course at my academic degree. Basically, it will encrypt your files in background using AES-256-CTR, a strong encryption algorithm, using RSA-4096 to secure the exchange with the server, optionally using the Tor SOCKS5 Proxy. The base functionality is what you see in the famous ransomware Cryptolocker.

The project is composed by three parts, the server, the malware and the unlocker.

The ser the 's identification key along with the encryption key used by the malware.

The malware encrypt with a RSA-4096 (RSA-OAEP-4096 + SHA256) public key any payload before send then to the server. This approach with the optional Tor Proxy and a .onion domain allow you to hide almost completely your server.

Features

Building the binaries

> DON'T RUN ransomware.exe IN YOUR PERSONAL MACHINE, EXECUTE ONLY IN A TEST EN! I'm not resposible if you acidentally encrypt all of your disks!

First of all download the project outside your $GOPATH:

> If you ha skip to the next section.

You need Go at least 1.11.2 with the $GOPATH/bin in your $PATH and $GOROOT pointing to your Go installation folder. For me:

Build the project require a lot of steps, like the RSA key generation, build three binaries, embed manifest files, so, let's leave make do your job:

You can build the server for windows with make -e GOOS=windows.

#### Docker

#### Config Parameters

You can change some of the configs during compilation. Instead of run only make, you can use the following :

Example:

make -e USE_TOR=true SER=mydomain.com SER=80 GOOS=darwin

The SERVER_ above only apply to the malware. The server has a flag --port that you can use to change the port that it will listen on.

> DON'T RUN ransomware.exe IN YOUR PERSONAL MACHINE, EXECUTE ONLY IN A TEST EN! I'm not resposible if you acidentally encrypt all of your disks!

Step by Step Demo and How it Works

For this demo I'll use two machines, my personal linux machine and a windows 10 VM.

For the sake of simplicity, I have a folder mapped to the VM, so I can compile from my linux and copy to the vm.

In this demo we will use the Ngrok tool, this will allow us to expose our ser a domain, but you can use your own domain or ip address if you want. We are also going to enable the Tor transport, so .onion domains will work without problems.

First of all lets start our external domain:

This command will give us a url like . Keep this command running otherwise the malware won't reach our server.

Let's compile the binaries (remember to replace the domain):

The SER needs to be 80 in this case, since ngrok redirects 2af7161c.ngrok.io:80 to your local server port 8080.

After build, a binary called ransomware.exe, and unlocker.exe along with a folder called server will be generated in the bin folder. The execution of ransomware.exe and unlocker.exe (even if you use a diferent GOOS during compilation) is locked to windows machines only.

Enter the ser from another terminal and start it:

To make sure that all is working correctly, make a http request to :

If you see a OK and some logs in the ser you are ready to go.

Now move the ransomware.exe and unlocker.exe to the with some dummy files to test the malware. You can take a look at cmd/common.go to see some configuration options like file extensions to match, directories to scan, skipped folders, max size to match a file among others.

Then simply run the ransomware.exe and see the magic happens :smile:.

The window that you see can be hidden using the HIDDEN option described in the compilation section.

After download, extract and start the Tor proxy, the malware waits until the tor bootstrapping is done and then proceed with the key exchange with the server. The client/ser takes place and the client payload, encrypted with an RSA-4096 public key must be correctly decrypted on the server. The identification and encryption keys are stored in a Golang embedded database called BoltDB (it also persists on disk). When completed we get into the find, match and encrypt phase, up to N-cores workers start to encrypt files matched by the patterns defined. This proccess is really quick and in seconds all of your files will be gone.

The encryption key exchanged with the server was used to encrypt all of your files. Each file has a random primiti IV, generated indi and saved as the first 16 bytes of the encrypted content. The algorithm used is AES-256-CTR, a good AES cypher with streaming mode of operation such that the file size is left intact.

The only two sources of information a about what just happen are the READ_TO_DECRYPT.html and FILES_ENCRYPTED.html in the Desktop.

In theory, to decrypt your files you need to send an amount of BTC to the attacker's wallet, followed by a contact sending your ID(located on the file created on desktop). If the attacker can confirm your payment it will possibly(or maybe not) return your encryption key and the unlocker.exe and you can use then to recover your files. This exchange can be accomplished in several ways and WILL NOT be implemented in this project for obvious reasons.

Let's suppose you get your encryption key back. To recover the correct key point to the following url:

Where :id is your identification stored in the file on desktop. After, run the unlocker.exe by double click and follow the instructions.

That's it, got your files back :smile:

The server has only two endpoints:

POST api/keys/add - Used by the malware to persist new keys. Some are made, like the of the RSA autenticity. Returns 204 (empty content) in case of success or a json error.

GET api/keys/:id - Id is a 32 characters parameter, representing an Id already persisted. Returns a json containing the encryption key or a json error

The end

As you can see, building a functional ransomware, with some of the best existing algorithms is not dificult, anyone with some programming skills can build that in any programming language.

项目信息

开发语言：Go

Star 数：971

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A POC Windows crypto-ransomware (Academic). Now Ransom:Win32/MauriCrypt.MK!MTB展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。