Malware › Module 2 › Lesson 2
Ransomware Named
Ransomware is named for defender and IR literacy — encryption impact, extortion, recovery — NO how-to encrypt or build ransomware.
Visual · mal_ransomware_named
Ransomware named — defender view. $MAL_LAB only. Original Cyberlium.
Opening
This lesson is IR and backup literacy — not encryption tutorials or ransomware builders.
Ransomware families encrypt or exfiltrate data then demand payment. Defenders respond with isolation, scope assessment, backup restore, and law enforcement/reporting per policy. IR playbooks name behaviors: mass file rename, shadow copy deletion, double extortion — mapped to detection and containment. Cyberlium explicitly does NOT teach how to encrypt files, build ransomware, or test lockers on unauthorized systems. You learn recognition and response literacy for $MAL_LAB reports. Next: Spyware/APT Named.
1. Ransomware behaviors defenders recognize
Mass file encryption with uniform extensions, ransom notes (README.txt), deletion of volume shadow copies, service stop lists, and C2 for key exchange or data leak sites. EDR and SIEM rules target these sequences — not student-built encryptors.
On $MAL_LAB, you may read public reports or static strings mentioning ransom notes — never deploy encryptors, even 'on your own files' outside controlled fixtures.
Command guide
Try these commands — Ransomware behaviors defenders recognize
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, curl. Reference sites: ATT&CK software (https://attack.mitre.org/software/); Hybrid Analysis trends (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. IR response literacy (named steps)
Isolate affected hosts, preserve evidence, identify scope (lateral movement, backups touched), restore from clean backups, reset credentials, report per org policy. Communication templates warn users not to pay without legal/exec guidance.
Purple teams may simulate ransomware prep indicators in lab SIEM — still $MAL_LAB only with written lab policy, not live encryption of production or classmates.
3. Hard boundary: no encryption how-to
Forbidden: ransomware builders, encryption loop tutorials, 'test on roommate laptop,' or sharing locker source in chat. Allowed: name families from reports, document IOC types, and write defender checklist for IR.
Ship: ransomware defender checklist — five IR/detection items, zero encryption steps. Next: Spyware/APT Named.
4. What you ship: ransomware defender checklist (no encrypt how-to)
Five IR/detection items. Explicit NEVER builders/encryption tutorials. $MAL_LAB report context. chmod 600.
5. What you record before the next lesson
Date. Ransomware defender checklist. NEVER encrypt how-to. File t22-m02-l02-ransomware-named.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Download ransomware builder 'for analysis.' Write encrypt loop as homework.
Right
Write ransomware defender/IR checklist — no encryption steps. Next: Spyware/APT Named.
Mission: document ransomware defender view
1) List five defender/IR recognition or response items. 2) Write NEVER builders/encryption tutorials line. 3) chmod 600. Never include encrypt implementation steps.
Stuck? Ask Cyberlium AI Mentor
Backups and isolation beat paying — IR literacy saves orgs.
Knowledge Check
APPLY: Ransomware Named on Cyberlium teaches:
Multiple choice
Knowledge Check
APPLY: True or False: Cyberlium allows ransomware builder tutorials for lab.
True or False
Knowledge Check
APPLY: Mass file rename + ransom note + shadow copy deletion suggests:
Multiple choice