itsMe Posted April 28, 2020 Share Posted April 28, 2020 This is the hidden content, please Sign In or Sign Up DeathRansom - A Ransomware Developed In Python, With Bypass Technics, For Educational Purposes What is a ransomware? A ransomware is malware that encrypts all your files and shows a ransom request, which tells you to pay a set amount, usually in bitcoins (BTC), in a set time to decrypt your files, or he will delete your files. How it works? First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it. It then encrypts all files starting with the defined directory on the line 60 in deathransom.py. Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files. Bypass Technics Anti-Disassembly Creates several variables to try to make disassembly difficult. Anti-Debugger Checks if a debugger is active using the ctypes function: windll.kernel32.IsDebuggerPresent() Anti-Vm Checks if the machine's mac is the same as the standard vms mac. Anti-Sandbox Sleep-Acceleration Some sandboxes speed up sleep, this function checks if nothing out of the ordinary has occurred. Sandbox in Process Checks if have any sandbox in running processes Display-Prompt Shows a message, if the user interact with the pop up, the malware will be executed. Idle-Time Sleeps for a while and proceed. Some sandboxes wait for a while and stop running, that tries to bypass this. Check-Click If the user does not click the number of times necessary the malware not will be executed. Check-Cursor-Pos If the user not move the mouse in a seted time the malware not be executed. This is the hidden content, please Sign In or Sign Up Link to comment Share on other sites More sharing options...
Recommended Posts