{"id":18964566,"url":"https://github.com/waived/waivelock","last_synced_at":"2025-08-17T13:38:46.997Z","repository":{"id":242315119,"uuid":"809238362","full_name":"waived/waivelock","owner":"waived","description":"Ransomware proof-of-concept that uses Discord as a C2 to store encryption keys","archived":false,"fork":false,"pushed_at":"2024-11-12T14:58:01.000Z","size":264,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-01T05:32:18.233Z","etag":null,"topics":["persistence","python3","ransomware","webhook"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/waived.png","metadata":{"files":{"readme":"README.txt","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-02T05:38:36.000Z","updated_at":"2024-11-20T16:30:48.000Z","dependencies_parsed_at":"2024-06-02T07:21:47.243Z","dependency_job_id":"24e8aa79-bafd-4b01-9838-0e14d84da939","html_url":"https://github.com/waived/waivelock","commit_stats":null,"previous_names":["waived/rware","waived/waivelock"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/waived%2Fwaivelock","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/waived%2Fwaivelock/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/waived%2Fwaivelock/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/waived%2Fwaivelock/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/waived","download_url":"https://codeload.github.com/waived/waivelock/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239959991,"owners_count":19725222,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["persistence","python3","ransomware","webhook"],"created_at":"2024-11-08T14:25:03.775Z","updated_at":"2025-02-21T05:22:26.460Z","avatar_url":"https://github.com/waived.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"*** PROOF OF CONCEPT // READ LEGAL STATEMENT // STRICTLY FOR EDUCATIONAL USE ***\n\nThis repository houses two files.\n\n    rware.py --- The ransomware itself \n    cure.py ---- The decryptor tool\n\n################\n# How it works #\n################\n    INDEXING\n    1) Rware indexes all files held in common user-directories (Desktop, Videos, Music, Downloads, Documents, \n       and Pictures) and add them to a list\n    2) Next a local Fernet encryption key is generated and written into the working directory of Rware\n\n    SORTING / LOCKING\n    3) Rware iterates through/encrypts each indexed file. If a file-extension is part of the blacklist (pre-set\n       by the attacker) the file is skipped. This helps avoid unnecessary files that yield no benefit to lock.\n    4) After encryption, files are then renamed to have a .lock file-extension. This ensures Rware won't overwrite\n       the same file upon next reboot.\n\n    EXFILTRATION\n    5) Once all files have been locked, a sub-routine then creates a message containing: the encryption key, a\n       custom user-ID and the account name (used for C2 indentification), network IP address, and the timestamp\n       of the encryption. This entire message is then sent to the pre-set Discord webhook. The local Fernet\n       encryption key is now deleted.\n\n    NOTIFICATION\n    6) A primivite HTML notification is constructed in the /tmp directory and then opened up in the victim's\n       default web browser. The message explains what has happened, how to pay for the decryption software,\n       etc.\n\n    PERSISTENCE\n    7) Finally, the Rware script is written to the local CronTab for system persistence. It will run each time\n       the machine reboots.\n\n    THE CURE\n    8) The cure works similarly. Upon payment, the victim is instructed to email the attacker with the crypto\n       transaction ID and their UID. The attacker looks up UID and locates the encryption key(s) used. Each reboot\n       will produce its own new encryption key and pass it to the web hook. The encryption keys need manually added\n       to the list in cure.py. The cure.py script does everything in reverse. Indexes all .lock files this time, and\n       overwrites the files with their decrypted content. It also removes the .lock file-extension and resets the\n       file to the original name.\n\n##############\n# Known bugs #\n##############\n\n    Although I've spent several hours trying to figure this out through trial/error (and not like it matters much\n    since this is a POC and not a script that should be used seriously in the field) Rware often skips a file every\n    now and then, even though said files were all found in the indexing list. No errors are raised, and I assume\n    somewhere around line #159 things aren't working smoothely. Since Rware is persistent, it gets the rest sooner\n    or later. If you've found a fix, please reach out. \n\n###############\n# Life advice #\n###############\n\n    In addition to the legal statement, don't be a douche with this. Use it responsibly and never to commit\n    final crime / extortion. \n\n\n\n------- Update: 11/12/2024 -------\nAlthough not directly intended for Windows NT systems, the\nMicrosoft Defender antivirus has now flagged this ransomware\nas \"Trojan:Python/FileCoder.AI!MTB\" and therefore will need to\neither be modified or obfuscated in order to avoid detection.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwaived%2Fwaivelock","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwaived%2Fwaivelock","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwaived%2Fwaivelock/lists"}