I'm looking for some ransomware samples that work on Linux so that I can show a proof of concept with Qubes OS on how one's other virtual machines can be safe from a ransom attack if a single virtual machine (or a disposable virtual machine) gets compromised.

But I don't know where I can find such samples. Can anyone help?

  • @Rice I don't want malware, I want a ransomware sample for educational purposes only (ideally it should just encrypt the files and show a fake ransom note and not be a perfect crystal copy of an existing ransomware) – user135783 Jan 9 '17 at 19:00
  • 1
    I found two, hidden tears and bash-ransomware. Just search for open source ransomware and your bound to find something. That being said, if you just want something to encrypt some files and leave a ransom note, it wouldn't be too tough to find some sort of encryption program on github and modify it for your needs. This would be a safer alternative as well. – INV3NT3D Jan 9 '17 at 19:08

Perhaps you don't need ransomware to demonstrate what happens. You could fake the output of the attack using openssl like this:

Encrypt: openssl aes-256-cbc -pass pass:pwd -in victim -out victim.ransom && rm victim

Decrypt: openssl aes-256-cbc -pass pass:pwd -d -in victim.ransom -out victim

However, it looks like you may be more interested in demonstrating the activity of the ransomware file system scanner, to prove that your isolated VM can't encrypt the files of the host system or of other guest systems. That's rather like proving a negative. The best demonstration might be to show how find works, because that's exactly what ransomware would have to do.

Create a file named /tmp/sacrificial_pic_<vmname>.jpg on each of the VMs, including the VM hosting the fake malware, substituting the machine name in the filename above. Run the find command on the VM hosting the fake malware, like this:

find / -name \*.jpg -print

This will emulate the activity of malware searching for picture files to encrypt. The only sacrificial JPG your find command should discover is the one on your local VM.


The best way to demonstrate the risk of ransomware is to write a simple shell script that encrypts files in a folder. Not only will this prove useful, but it is also very easy to understand for people who are not technically literate or inclined.

Linux has openssl as an optional package where as most Windows systems has cipher built in.

A relevant discussion around proper backup policies should also be included.


Why not make a quick one ?

As a demo, you only need:

  • an archiver with command line like 7zip,

  • a target file (document) to encrypt

  • a nice picture asking for ransom

  • a batch/script file to make an archive

You make the batch/script file of the document with password and then within the same script file you erase the document. You will have no original document and an encrypted file (and for password you need to pay the ransom). As proof of concept it's quite enough to demonstrate what you want.

  • The OP asked for Linux versions. You appear to be suggesting Windows-centric solutions. – schroeder Apr 10 '17 at 13:55
  • 7zip exists for linux and scripts you can do just the same. There is no relevance on what operating system you do it. The proof of concept will behave in a very similar manner. – Overmind Apr 11 '17 at 6:31
  • Sure, but the other answers appear to be saying the same thing as you are, and the only difference is that you use Windows terminology. It just makes this answer a little strange. – schroeder Apr 11 '17 at 6:37

Most of malware can be identified by hash (MD5, SHA1, etc.). You may need to find the hash and search (which will bring you to the site provides samples you want) or random look up on this list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.