{"id":28376012,"url":"https://github.com/baum1810/ransomware-poc","last_synced_at":"2026-01-29T03:04:15.875Z","repository":{"id":296075246,"uuid":"992231111","full_name":"baum1810/Ransomware-POC","owner":"baum1810","description":null,"archived":false,"fork":false,"pushed_at":"2025-05-28T20:59:41.000Z","size":14,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-05-28T21:41:32.876Z","etag":null,"topics":["batch","maleware","poc","ransomware","undetected-maleware","undetected-ransomware"],"latest_commit_sha":null,"homepage":"","language":"Batchfile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/baum1810.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-05-28T20:31:30.000Z","updated_at":"2025-05-28T20:59:44.000Z","dependencies_parsed_at":"2025-05-28T21:45:55.653Z","dependency_job_id":"3972c045-95b7-4ffe-bbdc-ae8af7524678","html_url":"https://github.com/baum1810/Ransomware-POC","commit_stats":null,"previous_names":["baum1810/ransomware-poc"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/baum1810/Ransomware-POC","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baum1810%2FRansomware-POC","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baum1810%2FRansomware-POC/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baum1810%2FRansomware-POC/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baum1810%2FRansomware-POC/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/baum1810","download_url":"https://codeload.github.com/baum1810/Ransomware-POC/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/baum1810%2FRansomware-POC/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262029804,"owners_count":23247536,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["batch","maleware","poc","ransomware","undetected-maleware","undetected-ransomware"],"created_at":"2025-05-30T00:04:57.063Z","updated_at":"2026-01-29T03:04:10.841Z","avatar_url":"https://github.com/baum1810.png","language":"Batchfile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# PoC: Ransomware-Like File Encryption Using 7-Zip Password-Protected Archives\n\nThis repository contains a **Proof of Concept (PoC)** demonstrating a simple ransomware behavior using batch scripts and 7-Zip. The scripts encrypt files and folders on the desktop by compressing them into password-protected `.lol` archives, then delete the original files/folders. A complementary script decrypts (extracts) the archives and restores the files.\n\n\u003e **⚠️ WARNING:**  \n\u003e This is a PoC intended for educational purposes only.  \n\u003e Do **NOT** use on important data or systems without explicit permission.  \n\u003e Understand risks before running any script that deletes files.\n\n---\n\n## Scripts\n\n### 1. `encrypt.bat`\n\n- Zips **folders and files** on the desktop into password-protected `.lol` archives using AES-256 encryption  \n- Password is set in the script (`test123` by default)  \n- After successful compression, deletes the original files/folders\n\n**How it works:**  \n- Iterates over all folders and files on the desktop  \n- Creates `.lol` archives with password protection  \n- Removes original files/folders to simulate ransomware behavior  \n\n---\n\n### 2. `decrypt.bat`\n\n- Extracts all `.lol` archives from the desktop using the predefined password  \n- Restores the original files/folders  \n- Deletes the `.lol` archives after extraction\n\n**How it works:**  \n- Finds all `.lol` archives on the desktop  \n- Creates a folder named after each archive and extracts files into it  \n- Deletes the archive to clean up  \n\n---\n\n## Usage\n\n1. Place `encrypt.bat` and `decrypt.bat` on your machine.  \n2. Run `encrypt.bat` to encrypt desktop files/folders into password-protected archives and delete originals.  \n3. Run `decrypt.bat` to restore files from archives and remove `.lol` files.  \n\n---\n## Detection Status\n\nAs of the upload date (2025-05-28), this PoC is **fully undetected** by antivirus engines on VirusTotal:  \n[0/61 detection ratio on VirusTotal](https://www.virustotal.com/gui/file-analysis/OWNlYmZkZmY3NWU2ZGIyODRlYzVmZGJlNTZiMjlkNzM6MTc0ODQ2NDk1Mw==)\n\n---\n\n## Important Notes\n\n- The scripts use a **hardcoded password** (`test123`) for demonstration only.  \n- File/folder deletion is **permanent** unless backups exist.  \n- The archive extension `.lol` is arbitrary and can be changed.  \n- Designed as a minimal ransomware behavior simulation — lacks real-world ransomware complexity (e.g., communication with C2 servers, persistence).\n\n---\n\n## Disclaimer\n\nThis project is for **educational and research purposes only**.  \nThe author is **not responsible** for any misuse or damage caused by these scripts.  \nAlways test in a controlled environment.\n\n---\n## Community\n\nJoin the discussion, ask questions, or share improvements on our Discord:  \n👉 [https://discord.gg/yxyZpeS4p9](https://discord.gg/yxyZpeS4p9)\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbaum1810%2Fransomware-poc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbaum1810%2Fransomware-poc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbaum1810%2Fransomware-poc/lists"}