Cypher - Pythonic ransomware proof of concept.

项目说明

Cypher

Cypher is a proof of concept ransomware which implements the PyCrypto module and uses gmail(Currently) as a simple command and control server.
It is a work in progress as of yet and i will be releasing updates periodically depending on a couple of factors

Operation

Cypher operates by generating a unique client ID for each box that has been infected. The client ID and encryption key will be sent to a gmail adress by le python's SMTP lib. The new of Cypher will give the operator the choice to pick between gmail and the C&C infrastructure that comes with the finished project, namely a web application to generate and store key pairs together with client IDs. If the operator chooses to employ the Cypher web app the ransomware will contact via HTTP by le the Mechanize lib.

After Cypher has enumerated the files we wish to encrypt the multiprocessing and PyCrypto libs are employed to do the actual encrypting. I opted to use the multiprocessing lib to speed up the encryption process.

Finally Cypher will write out a README note and the client ID which would have to be relayed to the operator
in order to retrieve the proper decrypting binary and key respectively.

Update

I ha some logic to have the ransomware log in to the web app with the Mechanize lib. As of yet functionality to retrieve a key from the web app and to post the client ID have not been implemented. SMTP is still a and in the near future optional depending on the preference of the operator.

I am setting up a web application as an alternative C&C mechanism, in keeping with the Python theme of this project i am employing the Django framework for the web app. Commits will be pushed to the repo in due time.

The latest of the encryption module adds bootlocker functionality by attempting to o the MBR with a custom bootloader.
Shoutout to NO-OP for his contribution in this regard. I' the source code together with boot.bin for illustrati.

To do

* Extensive and multi-platform testing.

* ~~Write decrypting module.~~

* Functionality to restore MBR

* Designing and de a more secure C&C mechanism.
* ~~Possibly HTTP in favor of SMTP~~ and;
* Web App to dynamically provide encryption keys in favor of local generation

Want to contribute?

I'd be more than willing to collaborate on this and if you wish to contribute feel free to open an issue or a pull request and we may discuss the details and/or ideas we could work on and you might want to suggest.

!alt tag

Note

De of C&C web application has been postponed for the time being. If you want to get creative i would recommend this fork or this original web application written in PHP with Laravel by my friend Filtration. It is compatible with Cypher with a little tinkering.

Furthermore, someone seems to ha the stub for the main Cypher file to Virus Total. You can check it out by clicking here. For testing purposes i'd be interested to see detection rates for the Windows once it's encoded with someting like peCloakCapstone or PeCloak. That is of course after the main Python file has been compiled to exe with Py2Exe or Pyinstaller.

Also, if you have any pull requests to submit please feel free to do so. Open Source collaboration on this Ransomware remains to be of import to me.

Thanks.

项目信息

开发语言：Python

Star 数：219

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Pythonic ransomware proof of concept.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。