Navigation X
ALERT
Click here to register with a few steps and explore all our cool stuff we have to offer!



 12691

DeathRansom - A ransomware developed in python, with bypass technics

by MiNdFuCkErY_1337skid - 06 May, 2020 - 06:11 PM
This post is by a banned member (super_hockey) - Unhide
115
Posts
0
Threads
(06 May, 2020 - 06:11 PM)MiNdFuCkErY_1337skid Wrote: Show More
First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.

[Image: 68747470733a2f2f696d672e796f75747562652e...742e6a7067]

sfdsdfsdfsdfsfsdsfdsdfsdf
This post is by a banned member (vimour22) - Unhide
This post is by a banned member (asdqwdqwd1) - Unhide
7
Posts
0
Threads
(06 May, 2020 - 06:11 PM)MiNdFuCkErY_1337skid Wrote: Show More
First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.

[Image: 68747470733a2f2f696d672e796f75747562652e...742e6a7067]
x1x1x1x1wdc13wxc
This post is by a banned member (Fe4r11222) - Unhide
Fe4r11222  
Registered
658
Posts
0
Threads
1 Year of service
(06 May, 2020 - 06:11 PM)MiNdFuCkErY_1337skid Wrote: Show More
First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.

[Image: 68747470733a2f2f696d672e796f75747562652e...742e6a7067]

ezzzzzzzzzzzzzzzzzzzsz
This post is by a banned member (Davitest) - Unhide
Davitest  
Registered
3
Posts
0
Threads
(06 May, 2020 - 06:11 PM)MiNdFuCkErY_1337skid Wrote: Show More
First, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.
It then encrypts all files starting with the defined directory on the line 60 in deathransom.py.
Then, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.

[Image: 68747470733a2f2f696d672e796f75747562652e...742e6a7067]

thanks
This post is by a banned member (Nexa84) - Unhide
Nexa84  
Infinity
38
Posts
19
Threads
I will adjust it to my preferences, thank you

Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
or
Sign in
Already have an account? Sign in here.


Forum Jump:


Users browsing this thread: 1 Guest(s)