CurveLock

KO | EN

gitlite — search

#javascript #python #llm #golang #android #machine-learning #deep-learning #java #windows #pytorch #ios #openai #mcp #open-source

(★ 9)

A modern ransomware designed from scratch to infect faster and encrypt target contents using Elliptical Curve Cryptography

CurveLock 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# CurveLock
A mordern ransomware designed from scratch to infect faster and encrypt target contents using Elliptical Curve Cryptography (ECC) algorithm. 
For implementation details, visit -> https://swayampadhy.gitbook.io/root/projects/curvelock

## Disclaimer 
This project is a demonstration and should not be used maliciously. Developing or deploying ransomware without explicit permission is illegal and unethical. The author is not responsible for any misuse of this code.

## Features Of CurveLock - 
1. Utilizes Api Hammering to obfuscate call stack of the ransomware to evade detection from sandbox environments
2. Creates a random compile time IAT seed to evade static detection
3. Unhooks NTDll by creating a suspended process, copying the clean Ntdll from it and replacing out NTDll in the `.text` section
4. Extracts process token and checks it's elevation and integrity and determines it it is being run as Admin or not.
5. If not being run as admin, it exploits CVE-2024-6769 to create a new process with high integrity token. Cve Link -> https://github.com/fortra/CVE-2024-6769/tree/main
6. Exploits DcSync using the DCSyncer tool (https://github.com/notsoshant/DCSyncer) to extract username and NTLM hash combinations from the domain controller and parses it.
7. Performs self deletion to avoid manual analysis after execution.
8. Embeds the Ransomware Payload into a `.PNG` file's IDAT sections and encrypts each section with it's own RC4 key.
9. Payload is extracted from the `.PNG` file at runtime and executed.
10. Also provides the decryptor for the encrypted files.

## Steps To Run

1. Build The Solution
2. Host all the required exploits and the files given in "Attacker Server Files" in a web server. Also edit the hardcoded IP addresses in CurveLock project.
3. Execute the CurveLock binary in the target machine.

## Results
#### CurveLock

1. Execution In Unprivileged Context and Privilege Escalation

2. Credential Dumping Using DCSyncer

3. Decryptor Download Success/Failure

4. Attacker Server Output

#### CurveLock Payload

1. Before Execution Of Payload

2. After Execution Of Payload

3. Payload dealing with BlackListed extensions

4. Decryptor Output

## Credits
I thank @Maldev-Academy for providing me with knowledge to build this malware. I would also like to thank @notsoshant and @fortra for DcSyncer and CVE-2024-6769 POC respectively.

CurveLock

CurveLock 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

CurveLock

CurveLock 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README