RAASnet es un proyecto escrito en Python que se creó para demostrar lo fácil que es desarrollar ransomware y estudiar o analizar su funcionamiento. El script se encuentra disponible para Microsoft Windows, GNU/Linux y MacOS. En Microsoft Windows se recomienda compilar payload.py en formato EXE para hacerlo más portátil.
Principales características
- Generar una carga útil de ransomware
- Con o sin carga útil GUI
- Funciona en Microsoft Windows, GNU/Linux y MacOS
- Encriptación súper rápida con PyCrypto
- Compilación a EXE, APP o ejecutable Unix/Linux
- Icono personalizado para su carga útil EXE
- Recibe las claves de las víctimas
- Desencriptar archivos
- Modo de demostración (la carga útil no encripta nada)
- Modo de pantalla completa (la advertencia ocupa toda la pantalla)
- Mensaje de advertencia personalizado para su víctima
- Imagen personalizada en su carga útil
- Modo fantasma (cambia el nombre añadiendo la extensión .DEMON en lugar de cifrar los archivos)
- Múltiples métodos de encriptación
- Seleccione las extensiones de los archivos a los que va dirigido
- Decida si el payload debe autodestruirse (sólo en modo consola)
- Decidir la unidad de destino para el cifrado (directorio de trabajo)
- Acceso al servidor verificado a través del reenvío de puertos VPN
- Codificar la carga útil como código Morse
Instalación
Primero, descargamos e instalamos la última versión de Python 3. Posteriormente, procedemos con la ejecución de los siguientes comandos:
git clone https://github.com/leonv024/RAASNet.git
pip3 install -r requirements.txt
python3 RAASNet.py
Cabe mencionar que, como anotación importante, en GNU/Linux podríamos necesitar instalar python3-tk, python3-pil, python3-pil.imagetk, libgeoip1, libgeoip-dev y geoip-bin.
Registro
El primer paso, evidentemente, es registrarnos en la plataforma de RaaS (Ransomware-As-A-Service), en este caso contra la URL https://zeznzo.nl/req.py en el cloud de Google, por lo cual es prudente utilizar información totalmente falsa ingresando datos que no se relacionen de ninguna manera con nuestra persona:
También podemos atacar directamente al servicio onion (TOR) del operador: https://hplqdv5fo3vw3fjyamyer7yuc7xtvtop2j3fipc7psf3pxvhoqjoqkid.onion
Si todo marcha bien, ingresaremos nuestras credenciales y nos encontraremos con el panel de control del afiliado:
Generando el payload
El siguiente paso es generar el payload que debe ser ejecutado en el equipo de la victíma. Si hacemos clic en el menú GENERATE PAYLOAD abriremos otro menú con algunas opciones interesantes:
Como, por ejemplo, entre otras opciones podemos cambiar el mensaje de extorsión o ransom:
O también el método de cifrado, que en la presente demostración mantendremos como PyCrypto. Si pulsamos el botón GENERATE la salida serán dos scripts en Python: el payload y el decryptor correspondiente.
Si echamos un vistazo al código comprobaremos qué fácil resulta el proceso de cifrado y descifrado seleccionados:
Cifrado con payload.py:
Descifrado con decryptor.py:
Como podemos observar, se trata de un cifrado en bloque (CBC) con AES. El mensaje debe tener un tamaño o longitud de 16 bits, por lo cual se rellena con ceros hasta completarlo. No obstante, además de la clave, AES también necesita un vector de inicialización (Initialization Vector). Este vector de inicialización se genera con cada cifrado, y su propósito es producir diferentes datos cifrados para que un atacante no pueda hacer un criptoanálisis para inferir la clave o los datos en claro de los mensajes.
Ahora que tenemos el payload y el decryptor, si nuestra víctima utiliza Microsoft Windows nos interesará compilar el script a EXE para hacerlo portable:
Sin embargo, debemos recordar que ambos payloads, el script en Python y el EXE, son detectados por Windows Defender:
De esta forma, si queremos que se ejecute en la máquina de la víctima tendremos que cambiar el encoder (por defecto morse) u ofuscarlo previamente mediante pyarmor u otra herramienta.
Tampoco olvidemos levantar el servidor que recibirá las claves en cuanto el ransomware la genere para cifrar los archivos:
Si todo sigue bien, el ransomware generará el típico mensaje de aviso/extorsión:
Todos los ficheros en la ruta especificada habrán sido cifrados y renombrados añadiendo la extensión .DEMON:
Por otra parte, como podremos apreciar, en el código del payload.py la clave se enviará al recolector de claves:
Y, del mismo modo, al servidor del operador del RaaS:
De esta manera, el susodicho podrá verlo sin problemas en el panel de control al momento de acceder a su cuenta:
Una vez que se negocie la extorsión correspondiente y la víctima obtenga la clave, podrá descifrar sus archivos fácilmente con el decryptor.
Lo primero que tendrá que hacer es seleccionar el tipo de cifrado oportuno:
Introducir la clave:
Y seleccionar la ruta donde los archivos fueron cifrados:
Algo importante que debemos tener en cuenta es que si se introduce una clave incorrecta los archivos a recuperar podrían corromperse y perderse:
Pero si todo marcha correctamente, la victima recuperará sus archivos:
Repositorio del proyecto en Github: RaasNet
I appreciate, cause I found just what I was looking for. You’ve ended my 4 day long hunt! God Bless you man. Have a great day. Bye
O Pix My Dollar é um aplicativo de microtarefas: você realiza atividades simples no celular e acumula recompensas, que podem ser convertidas em dinheiro.
This really answered my problem, thank you!
O Pix My Dollar é um aplicativo de microtarefas: você realiza atividades simples no celular e acumula recompensas, que podem ser convertidas em dinheiro.
O Pix My Dollar é um aplicativo de microtarefas: você realiza atividades simples no celular e acumula recompensas, que podem ser convertidas em dinheiro.
I will immediately snatch your rss feed as I can’t in finding your e-mail subscription hyperlink or newsletter service. Do you have any? Kindly permit me recognize in order that I may subscribe. Thanks.
I am glad to be one of the visitors on this outstanding web site (:, regards for putting up.
You are a very bright person!
I really enjoy looking through on this web site, it contains great articles. «The living is a species of the dead and not a very attractive one.» by Friedrich Wilhelm Nietzsche.
I got what you mean , regards for posting.Woh I am delighted to find this website through google. «You must pray that the way be long, full of adventures and experiences.» by Constantine Peter Cavafy.
I love it when people come together and share opinions, great blog, keep it up.
Superb blog! Do you have any hints for aspiring writers? I’m hoping to start my own site soon but I’m a little lost on everything. Would you propose starting with a free platform like WordPress or go for a paid option? There are so many options out there that I’m totally confused .. Any suggestions? Kudos!
It?¦s actually a nice and helpful piece of information. I am satisfied that you simply shared this useful information with us. Please keep us up to date like this. Thank you for sharing.
Absolutely composed content, appreciate it for information. «Life is God’s novel. Let him write it.» by Isaac Bashevis Singer.
F*ckin’ awesome things here. I am very glad to see your article. Thanks a lot and i’m looking forward to contact you. Will you kindly drop me a mail?
Enjoyed reading through this, very good stuff, thanks. «All things are difficult before they are easy.» by John Norley.
I too believe therefore, perfectly pent post! .
I am often to blogging and i really appreciate your content. The article has really peaks my interest. I am going to bookmark your site and keep checking for new information.
I am incessantly thought about this, thanks for posting.
you have a great blog here! would you like to make some invite posts on my blog?
I do enjoy the way you have presented this issue and it does indeed provide us a lot of fodder for consideration. On the other hand, because of what I have experienced, I basically hope when the actual comments pile on that men and women stay on point and not start on a tirade of the news du jour. Yet, thank you for this excellent piece and although I can not necessarily go along with the idea in totality, I respect your standpoint.
I truly appreciate this post. I?¦ve been looking everywhere for this! Thank goodness I found it on Bing. You have made my day! Thanks again
Outstanding post, I believe blog owners should larn a lot from this weblog its real user friendly.
Definitely, what a great website and revealing posts, I definitely will bookmark your blog.Have an awsome day!
Very interesting information!Perfect just what I was looking for!
good post.Ne’er knew this, regards for letting me know.
Hi, i read your blog occasionally and i own a similar one and i was just wondering if you get a lot of spam comments? If so how do you protect against it, any plugin or anything you can recommend? I get so much lately it’s driving me insane so any assistance is very much appreciated.
Oh my goodness! an amazing article dude. Thank you Nevertheless I am experiencing issue with ur rss . Don’t know why Unable to subscribe to it. Is there anybody getting identical rss problem? Anyone who knows kindly respond. Thnkx
I like meeting utile information , this post has got me even more info! .
wonderful post.Never knew this, thanks for letting me know.
This really answered my problem, thank you!
I have been checking out many of your posts and i can claim pretty clever stuff. I will definitely bookmark your website.
Rattling good info can be found on blog. «Education is what most receive, many pass on, and few possess.» by Karl Kraus.
I’ve read some good stuff here. Certainly worth bookmarking for revisiting. I wonder how much effort you put to create such a fantastic informative website.
I dugg some of you post as I cogitated they were very beneficial handy
Hello.This article was really motivating, particularly because I was searching for thoughts on this topic last Tuesday.
Awsome website! I am loving it!! Will come back again. I am bookmarking your feeds also.
Enjoyed looking at this, very good stuff, regards.
I’m typically to blogging and i actually admire your content. The article has really peaks my interest. I’m going to bookmark your site and preserve checking for brand new information.
We are a group of volunteers and starting a new scheme in our community. Your site provided us with valuable information to work on. You have done a formidable job and our whole community will be grateful to you.
Real nice style and good subject matter, nothing at all else we need : D.
Oh my goodness! a tremendous article dude. Thanks Nonetheless I’m experiencing difficulty with ur rss . Don’t know why Unable to subscribe to it. Is there anybody getting an identical rss drawback? Anyone who is aware of kindly respond. Thnkx
Some truly excellent articles on this web site, thanks for contribution. «The key to everything is patience. You get the chicken by hatching the egg, not by smashing it.» by Arnold Glasgow.
Thankyou for helping out, great information.
Good day! Would you mind if I share your blog with my twitter group? There’s a lot of folks that I think would really enjoy your content. Please let me know. Many thanks
I likewise conceive hence, perfectly pent post! .
Great blog here! Also your web site loads up fast! What web host are you using? Can I am getting your associate link for your host? I want my site loaded up as quickly as yours lol
Just what I was searching for, appreciate it for posting.
I have not checked in here for a while because I thought it was getting boring, but the last few posts are great quality so I guess I will add you back to my everyday bloglist. You deserve it my friend 🙂
Rattling excellent visual appeal on this site, I’d rate it 10 10.
I’d incessantly want to be update on new articles on this web site, saved to bookmarks! .
Yeah bookmaking this wasn’t a speculative conclusion great post! .
Great wordpress blog here.. It’s hard to find quality writing like yours these days. I really appreciate people like you! take care
You are my intake, I have few blogs and occasionally run out from post :). «Fiat justitia et pereat mundus.Let justice be done, though the world perish.» by Ferdinand I.
Glad to be one of many visitors on this awe inspiring internet site : D.
I’m still learning from you, as I’m trying to reach my goals. I certainly enjoy reading everything that is written on your blog.Keep the tips coming. I liked it!
he blog was how do i say it… relevant, finally something that helped me. Thanks
Write more, thats all I have to say. Literally, it seems as though you relied on the video to make your point. You obviously know what youre talking about, why throw away your intelligence on just posting videos to your site when you could be giving us something informative to read?
I likewise conceive hence, perfectly pent post! .
Simply a smiling visitant here to share the love (:, btw great style. «Treat the other man’s faith gently it is all he has to believe with.» by Athenus.
Enjoyed looking at this, very good stuff, thanks. «Whenever you want to marry someone, go have lunch with his ex-wife.» by Francis William Bourdillon.
You have mentioned very interesting points! ps nice site. «There’s always one who loves and one who lets himself be loved.» by W. Somerset Maugham.
I couldn’t resist commenting
Would love to perpetually get updated great blog! .
I’m still learning from you, but I’m trying to reach my goals. I definitely liked reading all that is posted on your website.Keep the aarticles coming. I enjoyed it!
You are my breathing in, I own few blogs and sometimes run out from post :). «Fiat justitia et pereat mundus.Let justice be done, though the world perish.» by Ferdinand I.
After all, what a great site and informative posts, I will upload inbound link – bookmark this web site? Regards, Reader.
Enjoyed studying this, very good stuff, thankyou.
Hello, i read your blog occasionally and i own a similar one and i was just curious if you get a lot of spam remarks? If so how do you reduce it, any plugin or anything you can recommend? I get so much lately it’s driving me mad so any help is very much appreciated.
I think this is among the most important information for me. And i’m glad reading your article. But wanna remark on few general things, The site style is wonderful, the articles is really nice : D. Good job, cheers
I’m not that much of a internet reader to be honest but your blogs really nice, keep it up! I’ll go ahead and bookmark your website to come back later. Many thanks
you’ve got an awesome weblog here! would you prefer to make some invite posts on my blog?
I got what you intend, thankyou for putting up.Woh I am delighted to find this website through google. «Delay is preferable to error.» by Thomas Jefferson.
I got what you mean , thankyou for posting.Woh I am pleased to find this website through google.
Good day! Do you know if they make any plugins to protect against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
O GOLDCARD é um cartão virtual com acesso à conteúdos de tv, filmes e séries
Only wanna comment on few general things, The website design and style is perfect, the subject matter is very great. «In business school classrooms they construct wonderful models of a nonworld.» by Peter Drucker.
Tv Programını Da App Üzerinden Telefonunuzda Açabilir Maç İzleyebilirsiniz.
Asyabahis Sitesinde Kayıt Yaptırmak Ya Da Üye Olmak İçin Üye Ol Sekmesine Tıklayıp Sizden İstenilen Bilgileri Doldurmanız Gerekiyor.
Appreciate it for helping out, wonderful info. «The surest way to be deceived is to think oneself cleverer than the others.» by La Rochefoucauld.
Thanks for helping out, superb info. «If at first you don’t succeed, find out if the loser gets anything.» by Bill Lyon.
Thanks for ones marvelous posting! I really enjoyed reading it, you might be a great author.I will always bookmark your blog and definitely will come back at some point. I want to encourage continue your great work, have a nice evening!
Keep functioning ,great job!
There is noticeably a bundle to know about this. I assume you made certain nice points in features also.
Wow! This blog looks exactly like my old one! It’s on a completely different subject but it has pretty much the same page layout and design. Outstanding choice of colors!
This blog is definitely rather handy since I’m at the moment creating an internet floral website – although I am only starting out therefore it’s really fairly small, nothing like this site. Can link to a few of the posts here as they are quite. Thanks much. Zoey Olsen
Very efficiently written story. It will be valuable to anybody who utilizes it, as well as myself. Keep doing what you are doing – looking forward to more posts.
I really like your writing style, excellent information, thanks for posting : D.
whoah this blog is great i love studying your posts. Keep up the good work! You know, a lot of persons are hunting around for this information, you can help them greatly.
Hey! Do you know if they make any plugins to safeguard against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
Awsome blog! I am loving it!! Will come back again. I am taking your feeds also
Hi! Do you know if they make any plugins to safeguard against hackers? I’m kinda paranoid about losing everything I’ve worked hard on. Any tips?
I like what you guys are up too. Such clever work and reporting! Keep up the excellent works guys I’ve incorporated you guys to my blogroll. I think it’ll improve the value of my web site :).
I’m still learning from you, but I’m making my way to the top as well. I absolutely liked reading everything that is written on your website.Keep the posts coming. I enjoyed it!
I love your blog.. very nice colors & theme. Did you create this website yourself? Plz reply back as I’m looking to create my own blog and would like to know wheere u got this from. thanks
O Cupom da Vez é um aplicativo inovador que permite aos usuários ganhar dinheiro extra ao avaliar produtos e cupons em categorias como vestuário, eletrônicos, itens domésticos e muito mais.
I went over this website and I believe you have a lot of wonderful information, saved to my bookmarks (:.
I am not real superb with English but I find this rattling easy to interpret.
Hey there, You have done a fantastic job. I’ll definitely digg it and personally recommend to my friends. I am confident they’ll be benefited from this website.
Hey! I just wanted to ask if you ever have any issues with hackers? My last blog (wordpress) was hacked and I ended up losing months of hard work due to no backup. Do you have any methods to protect against hackers?
Some really nice and useful information on this website , likewise I believe the design and style contains fantastic features.
Great beat ! I would like to apprentice whilst you amend your site, how could i subscribe for a blog website? The account helped me a applicable deal. I have been tiny bit familiar of this your broadcast provided vivid clear idea
Thank you for the auspicious writeup. It in reality used to be a leisure account it. Glance complex to more delivered agreeable from you! By the way, how could we be in contact?
Very interesting subject, thankyou for putting up. «I do not pretend to know where many ignorant men are sure-that is all that agnosticism means.» by Clarence Darrow.
Hiya, I’m really glad I’ve found this information. Nowadays bloggers publish only about gossips and net and this is actually annoying. A good blog with exciting content, this is what I need. Thank you for keeping this website, I’ll be visiting it. Do you do newsletters? Cant find it.
Some really prime posts on this site, saved to bookmarks.
Hello.This post was really interesting, particularly because I was investigating for thoughts on this topic last Monday.
Link alternatif duatoto resmi internasional.
DUATOTO – Situs Togel Pasaran Terlengkap Pasti Bayar
Heya! I just wanted to ask if you ever have any problems with hackers? My last blog (wordpress) was hacked and I ended up losing months of hard work due to no back up. Do you have any solutions to stop hackers?
DUATOTO – Link Bandar Togel Online Paling Terpercaya di Indonesia
This blog is definitely rather handy since I’m at the moment creating an internet floral website – although I am only starting out therefore it’s really fairly small, nothing like this site. Can link to a few of the posts here as they are quite. Thanks much. Zoey Olsen
I got what you mean ,saved to bookmarks, very nice web site.
The following time I learn a weblog, I hope that it doesnt disappoint me as much as this one. I mean, I do know it was my option to learn, however I really thought youd have one thing attention-grabbing to say. All I hear is a bunch of whining about one thing that you can repair in case you werent too busy on the lookout for attention.
Very interesting subject, thanks for posting. «He who seizes the right moment is the right man.» by Johann Wolfgang von Goethe.
Hey, you used to write fantastic, but the last few posts have been kinda boringK I miss your great writings. Past few posts are just a little bit out of track! come on!
Hiya, I am really glad I have found this information. Today bloggers publish only about gossips and web and this is really irritating. A good blog with interesting content, this is what I need. Thanks for keeping this site, I’ll be visiting it. Do you do newsletters? Can not find it.
Hello! Do you know if they make any plugins to help with SEO? I’m trying to get my blog to rank for some targeted keywords but I’m not seeing very good gains. If you know of any please share. Kudos!
I envy your work, regards for all the informative content.
I would like to thnkx for the efforts you have put in writing this web site. I’m hoping the same high-grade web site post from you in the upcoming as well. In fact your creative writing abilities has inspired me to get my own website now. Actually the blogging is spreading its wings rapidly. Your write up is a good example of it.
You are my intake, I own few blogs and often run out from to post .
I truly appreciate this post. I’ve been looking all over for this! Thank goodness I found it on Bing. You’ve made my day! Thx again
This really answered my problem, thanks!
Hey There. I found your blog using msn. This is a very well written article. I will be sure to bookmark it and come back to read more of your useful information. Thanks for the post. I will certainly return.
Hi there just wanted to give you a quick heads up. The text in your content seem to be running off the screen in Firefox. I’m not sure if this is a formatting issue or something to do with browser compatibility but I figured I’d post to let you know. The design and style look great though! Hope you get the issue fixed soon. Cheers
Some really prime articles on this internet site, saved to my bookmarks.
I’ll immediately grab your rss feed as I can’t to find your e-mail subscription link or newsletter service. Do you have any? Kindly let me know so that I may subscribe. Thanks.
I’d constantly want to be update on new articles on this site, saved to bookmarks! .
Simply wanna input on few general things, The website layout is perfect, the written content is very wonderful. «The reason there are two senators for each state is so that one can be the designated driver.» by Jay Leno.
Hello there, just became alert to your blog through Google, and found that it’s really informative. I am gonna watch out for brussels. I will appreciate if you continue this in future. A lot of people will be benefited from your writing. Cheers!
After study a few of the blog posts on your website now, and I truly like your way of blogging. I bookmarked it to my bookmark website list and will be checking back soon. Pls check out my web site as well and let me know what you think.
Yay google is my king helped me to find this great web site! .
Only wanna comment on few general things, The website style is perfect, the content material is very good. «By following the concept of ‘one country, two systems,’ you don’t swallow me up nor I you.» by Deng Xiaoping.
Absolutely pent articles, appreciate it for entropy. «Necessity is the mother of taking chances.» by Mark Twain.
I am often to blogging and i really appreciate your content. The article has really peaks my interest. I am going to bookmark your site and keep checking for new information.
Would love to incessantly get updated great website! .
I really like reading and I think this website got some truly utilitarian stuff on it! .
I will right away take hold of your rss feed as I can’t in finding your e-mail subscription hyperlink or newsletter service. Do you have any? Kindly let me recognise so that I may just subscribe. Thanks.
You are my inspiration , I have few blogs and rarely run out from to brand : (.
After all, what a great site and informative posts, I will upload inbound link – bookmark this web site? Regards, Reader.
I am glad to be one of the visitants on this great website (:, regards for putting up.
Very interesting info !Perfect just what I was looking for! «The medium is the message.» by Marshall McLuhan.
Of course, what a great site and educative posts, I definitely will bookmark your website.Have an awsome day!
great post.Never knew this, appreciate it for letting me know.
Hello. magnificent job. I did not expect this. This is a remarkable story. Thanks!
I couldn’t resist commenting
Thanks for this rattling post, I am glad I noticed this web site on yahoo.
Wohh precisely what I was looking for, thanks for posting.
You got a very great website, Gladiola I noticed it through yahoo.
Thank you for the sensible critique. Me and my neighbor were just preparing to do some research on this. We got a grab a book from our area library but I think I learned more from this post. I’m very glad to see such magnificent info being shared freely out there.
Appreciate it for this post, I am a big fan of this web site would like to go on updated.
I’ll immediately grab your rss feed as I can’t to find your e-mail subscription link or newsletter service. Do you have any? Kindly allow me recognise in order that I may subscribe. Thanks.
Hello would you mind sharing which blog platform you’re using? I’m going to start my own blog in the near future but I’m having a hard time deciding between BlogEngine/Wordpress/B2evolution and Drupal. The reason I ask is because your design seems different then most blogs and I’m looking for something completely unique. P.S My apologies for getting off-topic but I had to ask!
Respect to op, some excellent entropy.