SPAGHETTI RANSOMWARE
simulator

The tool consists of an exfiltration server and a client agent, both written in the Go language. When the agent is executed (double click) on the device (Windows), it initiates a series of processes typical of an authentic ransomware, including:

• Controlled Replication – the executable self-copies within the filesystems of all reachable machines within the limits of execution privileges and the previously declared scope;
• "Stealing" – the malware searches for potentially sensitive files and data on the infected machine and exfiltrates them as a Stealer would;
• Controlled Data Encryption – the extracted files are not deleted, but instead are encrypted with a key that will be deposited in the ransom TXT file on the machine's filesystem; the client can also choose the option of performing a "safe" encryption operation, preventing the replacement of potentially useful files on the systems in scope.

At the end of execution, the system is cleaned of all remnants left by the Spaghetti Ransomware simulator (such as executables and archives) except for the ransom file, which is left on the system as proof of its infection. On the remote exfiltration server, an archive containing all the sensitive files extracted and a timeline of the operations performed by the malware regarding each of the infected systems will be deposited.

Based on these timelines, the security team can generate a report that includes a graphical infection map and all the operations performed, divided by system.