{"id":20796834,"url":"https://github.com/cpscript/death","last_synced_at":"2025-04-09T19:23:49.408Z","repository":{"id":143262319,"uuid":"567345744","full_name":"CPScript/Death","owner":"CPScript","description":"A  Old Ransomware","archived":false,"fork":false,"pushed_at":"2023-04-13T12:43:44.000Z","size":24,"stargazers_count":5,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-09T07:01:56.398Z","etag":null,"topics":["fun","harmfull","malware","open","open-source","ransom","ransomware","source","virus"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CPScript.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-11-17T15:40:25.000Z","updated_at":"2025-02-10T00:17:40.000Z","dependencies_parsed_at":"2023-04-19T16:49:29.871Z","dependency_job_id":null,"html_url":"https://github.com/CPScript/Death","commit_stats":null,"previous_names":["cpscript/death"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CPScript%2FDeath","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CPScript%2FDeath/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CPScript%2FDeath/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CPScript%2FDeath/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CPScript","download_url":"https://codeload.github.com/CPScript/Death/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248096144,"owners_count":21046983,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["fun","harmfull","malware","open","open-source","ransom","ransomware","source","virus"],"created_at":"2024-11-17T16:29:10.479Z","updated_at":"2025-04-09T19:23:49.388Z","avatar_url":"https://github.com/CPScript.png","language":"Python","readme":"# Death\n\n## How it works?\n\nFirst, the script checks if it's in a sandbox, debugger, vm, etc, and try bypass it.                                                       \nIt then encrypts all files starting with the defined directory.                                                                          \nThen, downloads the ransom request script, disable cmd, taskmanager and the registry tools. And starts the counter to delete the files.\n\n## How to use?\n\nGenerate the keys, upload the public key to pastebin, copy the raw link, and change the site on the line 7 in deathransom.py  ``` python generate_key.py ```                                                                                                                     \nTransform time_script.py and main.py(Located at Ransom Request) into exe.                                                      \nTransform the time_script into exe using pyinstaller in python2 version typing ``` pyinstaller --onefile --windowed \u003cFILE\u003e ```                                                                                                                                    \nTo transform the main of ransom request we will use the pyinstaller in the python3 version ``` pyinstaller --onefile --windowed main.py ```                                                                                                                                    \nThen uploads the scripts to any file hosting service and change the links on the line 28 and 31 in deathransom.py                        \nSo just transform deathransom.py into exe using pyinstaller in python2 version and be happy :D\n\n## Bypass Technics\n\n- ### Anti-Disassembly\nCreates several variables to try to make disassembly difficult.\n\n- ### Anti-Debugger\nChecks if a debugger is active using the ctypes function: windll.kernel32.IsDebuggerPresent()\n\n- ### Anti-Vm\nChecks if the machine's mac is the same as the standard vms mac.\n\n- ### Anti-Sandbox\n                                                                                                                                         \n- Sleep-Acceleration\n\nSome sandboxes speed up sleep, this function checks if nothing out of the ordinary has occurred.\n\n- Sandbox in Process\n\nChecks if have any sandbox in running processes\n\n- Display-Prompt\n\nShows a message, if the user interact with the pop up, the malware will be executed.\n\n- Idle-Time\n\nSleeps for a while and proceed. Some sandboxes wait for a while and stop running, that tries to bypass this.\n\n- Check-Click\n\nIf the user does not click the number of times necessary the malware not will be executed.\n\n- Check-Cursor-Pos\n\nIf the user not move the mouse in a seted time the malware not be executed.\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcpscript%2Fdeath","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcpscript%2Fdeath","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcpscript%2Fdeath/lists"}