utkusen/eda2

a more complex ransomware honeypot

    ███████╗██████╗  █████╗ ██████╗ 
    ██╔════╝██╔══██╗██╔══██╗╚════██╗
    █████╗  ██║  ██║███████║ █████╔╝
    ██╔══╝  ██║  ██║██╔══██║██╔═══╝ 
    ███████╗██████╔╝██║  ██║███████╗
    ╚══════╝╚═════╝ ╚═╝  ╚═╝╚══════╝

This project is abandoned. If you are a researcher and want the code, contact me with your university or company e-mail http://utkusen.com/en/contact.html

eda2's Issues

Locked lol!

I was fascinated by this so decided to give it a try, I made the database on my server named panel and then a table named dummy with three columns, pcname, username and then privatekey and then I compiled It, after that I ran it then I got an error saying internal server 500 error, I then tried it a bunch of times, after some time I decided to check the website for the log of the private keys, and I saw like 5 of them haha xD, but anyway, now I can't get the screen where I can unlock all my files, what will I do?

EDIT : Thanks, I fixed it, it was a small issue on the server side, XP

Abandoned!?

OMG this project is good!

Ok thank you I know now how fucking ransomware works for educational purposes this project is very usefull!

ACAB!

error after encryption

get this error after encryption and no input from server.

************** Exception Text **************
System.Security.Cryptography.CryptographicException: Input string does not contain a valid encoding of the 'RSA' 'Modulus' parameter.
at System.Security.Cryptography.RSA.FromXmlString(String xmlString)
at eda2.Form1.RSAEncrypt(Byte[] data, Int32 keySize, String publicKeyXml)
at eda2.Form1.EncryptTextRSA(String text, Int32 keySize, String publicKeyXml)
at eda2.Form1.startAction()
at eda2.Form1.Form1_Load(Object sender, EventArgs e)
at System.Windows.Forms.Form.OnLoad(EventArgs e)
at System.Windows.Forms.Form.OnCreateControl()
at System.Windows.Forms.Control.CreateControl(Boolean fIgnoreVisible)
at System.Windows.Forms.Control.CreateControl()
at System.Windows.Forms.Control.WmShowWindow(Message& m)
at System.Windows.Forms.Control.WndProc(Message& m)
at System.Windows.Forms.ScrollableControl.WndProc(Message& m)
at System.Windows.Forms.Form.WmShowWindow(Message& m)
at System.Windows.Forms.Form.WndProc(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)
at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

************** Loaded Assemblies **************
mscorlib
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 (RTMRel.030319-0100)

CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll

eda2
Assembly Version: 1.0.0.0
Win32 Version: 1.0.0.0

CodeBase: file:///C:/Users/khan/Desktop/eda2.exe

System.Windows.Forms
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll

System.Drawing
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll

System
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll

System.Configuration
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 (RTMRel.030319-0100)

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll

System.Xml
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll

System.Core
Assembly Version: 4.0.0.0
Win32 Version: 4.0.30319.1 built by: RTMRel

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll

any help?

Encrypted AES Key - missing

Hello.

I tested this tool files locked works, get info:
PC Name, Username, Private Key
but NOT Encrypted AES Key and when click on Decipher nothing happend.

How fix it? Something wrong in SQL database maybe? Thank you for answer.

Help.

Hi,

setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //table name = dummy $q = $connection->query('SELECT \* FROM dummy'); ?>

But the table dummy, does not exists in my database... What can I resolve?

Thanks!