{"id":29406349,"url":"https://github.com/godfwarsion/ransomtrace","last_synced_at":"2025-07-10T23:20:03.854Z","repository":{"id":302920499,"uuid":"1013645633","full_name":"GodFWarsion/RansomTrace","owner":"GodFWarsion","description":"Ransomware Detection and Analysis Framework","archived":false,"fork":false,"pushed_at":"2025-07-04T19:23:03.000Z","size":90,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-07-04T19:38:16.121Z","etag":null,"topics":["csharp","incident-response","malware-analysis","ransomware","sigma-rules","yara-rules"],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GodFWarsion.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-04T08:31:32.000Z","updated_at":"2025-07-04T19:23:06.000Z","dependencies_parsed_at":"2025-07-04T19:38:18.285Z","dependency_job_id":"19922a9e-c064-4559-873f-d02a3ec0943f","html_url":"https://github.com/GodFWarsion/RansomTrace","commit_stats":null,"previous_names":["godfwarsion/ransomtrace"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/GodFWarsion/RansomTrace","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GodFWarsion%2FRansomTrace","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GodFWarsion%2FRansomTrace/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GodFWarsion%2FRansomTrace/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GodFWarsion%2FRansomTrace/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GodFWarsion","download_url":"https://codeload.github.com/GodFWarsion/RansomTrace/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GodFWarsion%2FRansomTrace/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264686799,"owners_count":23649565,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["csharp","incident-response","malware-analysis","ransomware","sigma-rules","yara-rules"],"created_at":"2025-07-10T23:20:03.201Z","updated_at":"2025-07-10T23:20:03.841Z","avatar_url":"https://github.com/GodFWarsion.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RansomTrace: Analysis \u0026 Playbook for Ransomware\n\n![RansomTrace Banner](./banner.png)\n![GitHub last commit](https://img.shields.io/github/last-commit/GodFWarsion/RansomTrace)\n![Repo size](https://img.shields.io/github/repo-size/GodFWarsion/RansomTrace)\n![MIT License](https://img.shields.io/github/license/GodFWarsion/RansomTrace)\n![Issues](https://img.shields.io/github/issues/GodFWarsion/RansomTrace)\n![Stars](https://img.shields.io/github/stars/GodFWarsion/RansomTrace?style=social)\n\n![Platform](https://img.shields.io/badge/platform-Windows%2011-blue?logo=windows)\n![Built With](https://img.shields.io/badge/built%20with-C%23%20%7C%20.NET%20WPF-blueviolet?logo=.net)\n![Analysis Engine](https://img.shields.io/badge/analysis-YARA%20%7C%20SIGMA-yellow?logo=virustotal)\n![Sandbox](https://img.shields.io/badge/integrates-FlareVM%20%7C%20REMnux-orange?logo=vmware)\n\n**RansomTrace** is a modular ransomware analysis and incident response toolkit designed for cybersecurity researchers and forensic analysts. It enables both static and dynamic inspection of malware samples using YARA/SIGMA-based detection, entropy scanning, sandbox integration, and rule auto-generation — all wrapped inside a C# WPF-based GUI.\n\n---\n\n## 🔍 Abstract\n\nRansomware has evolved into sophisticated cyber threats involving encryption, persistence, anti-analysis, and data theft. **RansomTrace** aims to streamline the forensic process for ransomware by providing a structured platform for investigation, detection, and response. Integrated with the ransomware incident response playbook, the tool automates detection workflows while enabling modular reverse engineering capabilities via FlareVM and REMnux.\n\n---\n\n## 🧠 Key Features\n\n- 🔐 **Static Analysis**  \n  - Entropy scanning and visualization  \n  - PE structure inspection and string signature analysis  \n  - Auto-generated YARA rules from artifacts  \n  - Opcode disassembly and binary diffing\n\n- 🧪 **Dynamic Analysis**  \n  - API call monitoring (`CreateFile`, `CryptEncrypt`, etc.)  \n  - Registry, file system, and memory interaction logging  \n  - Honeypot trigger detection  \n  - Live behavior monitoring via sandboxed VM\n\n- ⚡ **Rule-Based Detection**  \n  - YARA and SIGMA rule integration  \n  - Memory rule matching and signature scanning  \n  - Log-based behavioral detection using Sysmon + Sigma\n\n- 🧩 **Modular Integration**  \n  - Ready for integration with FlareVM, REMnux  \n  - Debugging workflows via IDA Pro, x64dbg  \n  - Incident Playbook HTML module for live response mapping\n\n---\n\n## 🚀 Getting Started\n\n### 1. Clone the Repository\n\n```bash\ngit clone https://github.com/GodFWarsion/RansomTrace.git\ncd RansomTrace\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgodfwarsion%2Fransomtrace","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgodfwarsion%2Fransomtrace","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgodfwarsion%2Fransomtrace/lists"}