Selling Ransomware with credibility.

Hi i go by Robin (Not actual name)

I am a new developer on this forum looking to establish long-term trust and technical credibility. Because I do not have a public reputation or historical vouches here, I am not asking you to take my word for what this tool can do. Instead, I have uploaded the live compiled Windows binary alongside its functional decryption key to the link below, allowing the community's analysts and reverse-engineers to examine the assembly logic directly in IDA Pro or Ghidra. Below the download link, you will find the complete, itemized list of capabilities and architectural features implemented within the code. FYI, if you wanna by the better version with anti EDR kills and better encryption, MSG me. I give full source code plus builder plus GUI

I do Escrow
You choose the price,

Underlying components with Honest review and the links:


Encryption Core

• Full-File Encryption: Basic | Encrypts the entire file (slower).
• Interleave Encryption: Moderate | Encrypts only the first and last 64 KB of large files to save CPU.
• Multi-Threading: Strong | Uses 64 threads for rapid file processing.
• Randomized Filenames: Basic | Renames encrypted files to random hex strings.
• Standard Encryption: Strong | Uses ChaCha20 + RSA-2048 military-grade encryption.

Static Evasion

• API Hashing (PEB Walk): Advanced | Resolves imports at runtime to leave the Import Address Table empty.
• PE Section Injection: Advanced | Moves the config into a .rhdata section to kill the overlay detection flag.
• Polymorphic Mutator: Strong | Injects random junk sections to change the file hash every build.
• XOR Strings: Basic | Hides literal strings from static scanners.

Dynamic Evasion & Execution

• Anti-Sleep-Skip: Basic | Detects sandbox time acceleration.
• Anti-VM Checks: Basic | Detects sandboxes via BIOS, CPU, RAM, Disk, and GPU.
• ETW Patching: Basic | Mutes Windows event logging in userland.
• Hell's Gate (Direct Syscalls): Advanced | Bypasses userland hooks by invoking kernel syscalls directly.
• HWBP AMSI Bypass: Advanced | Uses CPU debug registers to bypass Windows script scanning without memory patching.
• ntdll Unhooking: Moderate | Remaps a clean ntdll from disk to bypass EDR hooks.
• PPID Spoofing: Advanced | Fakes the parent process ID to hide the execution chain from EDRs.
• Process Hollowing: Advanced | Injects the payload into a suspended legitimate process to hide execution.

Persistence

• AppInit_DLLs: Advanced | Injects into every process on boot.
• BITS Job: Moderate | Uses the background transfer service for execution.
• COM Task: Basic | Alternative scheduled task creation.
• HKCU / HKLM Run Keys: Basic | Runs on logon via the Registry.
• IFEO Hijack: Advanced | Hijacks accessibility tools (sethc.exe, utilman.exe).
• Local Service: Moderate | Registers as a Windows service.
• Native Task (rundll32): Moderate | Proxies execution through a signed binary.
• Scheduled Task: Basic | Runs on logon via schtasks.exe.
• Startup LNK: Basic | Drops a shortcut in the Startup folder.
• Winlogon Shell: Advanced | Modifies the shell registry key.
• WMI Subscription: Advanced | Permanent event consumer that survives reboots.

Credential Theft

• Chrome / Edge Logins: Basic | Steals SQLite login databases.
• DPAPI Master Keys: Moderate | Steals Windows credential encryption keys.
• Firefox Profiles: Basic | Steals Firefox JSON login data.
• LSASS Dump: Advanced | Extracts memory via MiniDumpWriteDump (Blocked by PPL on modern Windows).
• NTDS.dit: Advanced | Extracts Active Directory database (Domain Controllers only).
• RDP cmdkey: Basic | Dumps saved RDP credentials.
• RDP Registry: Basic | Extracts connection history.
• SAM Hive: Moderate | Dumps local hashes via reg save.
• SECURITY Hive: Moderate | Dumps LSA secrets.
• SSH Private Keys: Basic | Steals plaintext ~/.ssh keys.
• SYSTEM Hive: Moderate | Required to decrypt the SAM hive.
• WDigest Enable: Basic | Turns on plaintext password caching in registry.
• WiFi Profiles: Basic | Dumps plaintext WiFi passwords via netsh.

Lateral Movement

• GPO SYSVOL: Advanced | Drops payload into Group Policy scripts.
• MSSQL xp_cmdshell: Moderate | Executes via SQL database.
• PsExec: Basic | Executes via external psexec.exe.
• RDP Hijack: Advanced | Uses tscon.exe to hijack a user session.
• SMB + ADMIN$: Advanced | Copies payload and creates a remote service.
• SSH: Moderate | Executes via sshpass.
• WinRM: Moderate | Executes via PowerShell Remoting.
• WMI Win32_Process: Moderate | Executes commands via WMI.

Ransomware Behavior & Anti-Recovery

• C2 HTTP POST: Basic | Sends a single completion report to a remote server.
• Desktop/Folder Notes: Basic | Drops ransom notes.
• Free Space Wiper: Basic | Overwrites free space.
• Printer Spam: Basic | Prints the ransom note.
• Self-Destruct: Basic | Deletes the executable.
• Wallpaper/Icon Hijack: Basic | Modifies desktop visuals.
• VSS / wbadmin Deletion: Moderate | Destroys backup copies.

Payload: Proton Drive

Private key: Proton Drive