Cryptalyst is a user-friendly GUI application designed to assist in the analysis of ransomware-encrypted files. It provides a visual comparison between original and encrypted files, helping security researchers and analysts understand the encryption patterns and characteristics of various ransomware strains.
Note: This project is currently a work in progress and is in its early stages of development.
Cryptalyst requires two sets of files for effective analysis:
-
Original Files: These are unencrypted files from before the ransomware attack. They can be sourced from:
- Backup drives or USB devices
- Cloud storage backups
- Any other location where pre-attack files were stored
-
Encrypted Files: These are the files that have been encrypted by the ransomware.
The tool compares these file pairs to identify the changes made by the ransomware, providing insights into its encryption patterns and behavior.
Note: It's essential to have access to original, unencrypted versions of the files to perform this analysis. If you don't have backups of any file from the system from before the ransomware attack, the tool is of no use. It's important to note that for the analysis to work, the original and encrypted versions of each file must be of the same size.
This screenshot showcases the main interface of Cryptalyst, demonstrating its user-friendly design and key features:
- File selection buttons for original and encrypted files
- Analysis progress bar
- Visual representation of file encryption patterns
- Detailed byte range information
- Export options for analysis results
- File Comparison: Easily compare original files with their encrypted counterparts.
- Visual Representation: Get a graphical view of encrypted portions within files.
- Detailed Analysis: View exact byte ranges affected by encryption.
- Batch Processing: Analyze multiple file pairs simultaneously.
- Export Functionality: Export results to HTML or JSON formats.
- Python 3.6+
- PyQt6
-
Clone this repository:
git clone https://github.com/yourusername/cryptalyst.git cd cryptalyst -
Install the required dependencies:
pip install -r requirements.txt
-
Run the application:
python main.py -
Use the "Select Original Files" and "Select Encrypted Files" buttons to choose the files for analysis.
-
Click "Start Analysis" to begin the comparison process.
-
View the results in the application window, including visual representations and detailed encryption ranges.
-
Export the analysis report in HTML or JSON format using the "Export Report" button.
Contributions to Cryptalyst are welcome! Please feel free to submit pull requests, report bugs, or suggest new features.
Cryptalyst is intended for educational and research purposes only. Always handle potentially malicious files with caution and in a secure, isolated environment.