What is a ransomware?
A ransomware is malware that encrypts all your files and shows a ransom request, which tells you to pay a set amount, usually in bitcoins (BTC), in a set time to decrypt your files, or he will delete your files.
How it works?
First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.
How to use?
Install the requiriments typing:
pip install -r requirements.txtand
python3 -m pip install PyQt5
Generate the keys, upload the public key to pastebin, copy the raw link, and change the site on the line 7 in deathransom.py
Transform time_script.py and main.py(Located at Ransom Request) into exe.
Transform the time_script into exe using pyinstaller in python2 version typing
pyinstaller --onefile --windowed <FILE>
To transform the main of ransom request we will use the pyinstaller in the python3 version
pyinstaller --onefile --windowed main.py
Then uploads the scripts to any file hosting service and change the links on the line 28 and 31 in deathransom.py
So just transform deathransom.py into exe using pyinstaller in python2 version and be happy :D
- Sandbox in Process
How to edit the Ransom Request
To edit, you need install the PySide2. Open the main.ui file, and edit what you want.
Video de demonstração PT-BR