├── files ├── rfc768.pdf ├── rfc783.pdf ├── rfc791.pdf ├── rfc792.pdf ├── rfc793.pdf ├── rfc826.pdf ├── rfc854.pdf ├── rfc855.pdf ├── rfc862.pdf ├── rfc863.pdf ├── rfc864.pdf ├── rfc868.pdf └── rfc903.pdf ├── README.md ├── LICENSE └── mosnar.ps1 /files/rfc768.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc768.pdf -------------------------------------------------------------------------------- /files/rfc783.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc783.pdf -------------------------------------------------------------------------------- /files/rfc791.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc791.pdf -------------------------------------------------------------------------------- /files/rfc792.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc792.pdf -------------------------------------------------------------------------------- /files/rfc793.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc793.pdf -------------------------------------------------------------------------------- /files/rfc826.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc826.pdf -------------------------------------------------------------------------------- /files/rfc854.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc854.pdf -------------------------------------------------------------------------------- /files/rfc855.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc855.pdf -------------------------------------------------------------------------------- /files/rfc862.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc862.pdf -------------------------------------------------------------------------------- /files/rfc863.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc863.pdf -------------------------------------------------------------------------------- /files/rfc864.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc864.pdf -------------------------------------------------------------------------------- /files/rfc868.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc868.pdf -------------------------------------------------------------------------------- /files/rfc903.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/fportantier/mosnar/HEAD/files/rfc903.pdf -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # MOSNAR (RANSOM spelled in reverse) 2 | 3 | Ransomware Detection Test PowerShell Script 4 | 5 | This small script process the files inside the "files" directory and 6 | XOR each one with the key 0x13. 7 | 8 | Adds the extension ".enc" to each file. 9 | 10 | If detects that the file already has the extension ".enc", it removes 11 | the extension. 12 | 13 | So, if you run the script two times, all the changes of the first run 14 | are reverted to the original state (is the magic of XOR). 15 | 16 | The purpouse of this script is to test anti-ransomware solutions, to 17 | check if can detect the behaviour. 18 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2017 Fabian Martinez Portantier 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /mosnar.ps1: -------------------------------------------------------------------------------- 1 | <# .SYNOPSIS 2 | MOSNAR - Ransomware detection test program 3 | .DESCRIPTION 4 | This script encrypts with XOR (key: 0x13) all the files inside 5 | the directory ".\files", and changes the extensions to ".enc". 6 | The purpouse is to check the if the ransomware detection tools 7 | of the system works. If you run it again, it will back files 8 | to original state. 9 | .NOTES 10 | File Name : mosnar.ps1 11 | Author : Fabian Martinez Portantier 12 | Requires : PowerShell V1 13 | .LINK 14 | https://github.com/portantier/mosnar 15 | #> 16 | 17 | Get-ChildItem "./files" | 18 | Foreach-Object { 19 | $file = $_ 20 | $filename = $file.FullName; 21 | write-host $filename; 22 | 23 | if ($file -is [System.IO.DirectoryInfo]) { return } 24 | 25 | $data = [System.IO.File]::ReadAllBytes("$filename") 26 | 27 | $len = $data.Count 28 | $xored = New-Object Byte[] $len 29 | 30 | for($i=0; $i -lt $len ; $i++) 31 | { 32 | $xored[$i] = $data[$i] -bxor 0x13 33 | } 34 | 35 | if ($filename -match '.*\.pdf$') 36 | { 37 | $new_filename = "$($filename).enc" 38 | } else { 39 | $new_filename = $filename.Replace(".enc", "") 40 | } 41 | 42 | [System.IO.File]::WriteAllBytes("$new_filename", $xored) 43 | 44 | $file.Delete() 45 | } 46 | --------------------------------------------------------------------------------