This tool blocks well known exe, bat, com launchers / executables of malwares (Trojans, ransomwares, worms etc) on windows
I tried to collect few well known executable files of diffrent malware categories like ransomware, worm, trojan, botnet etc, but mostly ransomwares, as they generally have same launcher name. This includes some ransomwares like WannaCry, BadRabbit, Cerber, Petya etc. then trojans like BokBot, Adylkuzz-Cryptocurrency Mining etc. The list has some worms, adwares as well. I have attached a txt file malware-exe-list.txt which has all these entries. I will keep updating this txt file when I get new launchers/exe/bat of different malwares. Parallely, you can also give new entries of malicious / suspicious files.
The python script will read all these entries and add those in windows registry, so these files won't execute. Please be aware that it is NOT A COMPLETE ANTIVIRUS, but just a primary and very basic solution / tool to prevent these files from execution. These applications might present at different locations, but that doesn't matter, as these will be blocked from anywhere. Majority of the malwares firstly run these files to trigger various malicious activities, like spreading in network, modifying registry entries, start keylogging, spreading all over the filesystem and encrypting all files and so on. Again, many of the malwares add the registry entries so that they can run on startup, but as we already blocked those, they won't be able to run at any time.
So, although it is not a comprehensive or full antivirus and there are ways to bypass it, still it is good tool to run on our windows machines as primary and basic protection. Note: Please run this tool as administrator
References: https://www.cyberswachhtakendra.gov.in/alerts.html (Cert-In) Also, various threat research blogs of carbon black, sophos, symantec, malwarebytes, kaspersky
Python Modules required to run this tool:
- winreg
How to install it (if its not already there): pip install winreg
Thanks.