DE QUE TRATA ESTE PROYECTO Skip to content
Navigation Menu
Xanthorox
XenWare
 
Type / to search
Code
Issues
Pull requests
Actions
Projects
Security
Insights
Owner avatar
XenWare
Public
Xanthorox/XenWare

t
Name		
Xanthorox
Xanthorox
Update README.md
fcb5aad
 · 
last month
README.md
Update README.md
last month
Xenware Xanthorox Ransomware.cpp
Add files via upload
last month
build_xanthorox.sh
Add files via upload
last month
pem_to_blob.py
Add files via upload
last month
Repository files navigation
README
First AI generated Ransomware which bypasses all anti-virus , Heavy Powerfull Encryption , Made by Xanthorox

XenWare

high-impact ransomware designed for speed, deep system penetration, and cryptographically secure file locking, making recovery without the operator's unique private key computationally infeasible.

How it Works:

It initializes by importing a master RSA-4096 public key. It gathers victim identifiers (Computer Name, IP, Location), generates a unique Victim ID, and immediately starts aggressive, multithreaded operations. Separate threads scan all accessible drives (Fixed, Network, Removable, excluding only CD-ROMs), skipping only the core Windows system directory, recycle bin, and its own log/readme files. It queues every other file type it finds. Worker threads pull files from this queue, performing the core encryption:

A unique AES-256 key is generated for the target file.

The file's content is encrypted using this unique AES key.

The unique AES key itself is then encrypted using the master RSA-4096 public key.

The encrypted file is saved with the .xanthorox extension (which is obfuscated in the code), containing the RSA-encrypted AES key followed by the AES-encrypted data.

The original file is deleted. After all scanning and encryption threads complete, it changes the desktop wallpaper. Crucially, it then sends a notification via a configured Telegram bot, exfiltrating the victim's identifiers (Computer Name, IP, Location, Victim ID) and the total count of successfully encrypted files directly to the operator.

Why it's Different:

Unlike ransomware using simpler methods, Xanthorox's per-file AES-256 key encrypted by a master RSA-4096 key makes brute-forcing or universal decryption impossible without the attacker's private key. Its aggressive multithreading aims for rapid encryption across multiple drives simultaneously, and its minimal exclusion list targets a vast range of files, including application data and user files outside standard libraries, maximizing disruption. The integrated Telegram bot notification provides immediate, remote confirmation of successful infection and key victim details to the operator. The extension obfuscation adds a layer against trivial modification.

How its Built ?

it did not build the file with first prompt it took me several hour to make it and fixing it , i did not touched a single code The AI did everything

Note = Full Prompt not showed for privacy

 0409.6.1.mp4 

How to Build And How to Use

First place all the files in a one directory on a linux enviromnent picture one

Then Run the Build Bash script "bash builder_xanthorox" it will genereate some bytes out of your Key files

then open another terminal and edit the main main cpp file and place yur bytes on this place

 fixed.video.of.replacing.the.keys.mp4 

Then hit enter and it will build your exe

 Building.the.EXE.mp4 

How Xenware looks like on Action Bypassing defender

It Bypassed almost all anti-virus and runtime scanners but now its open source means it won't be undetectable anymore (RIP)

I made this to prove one point what AI can DO

 fast.forrwarded.full.video.mp4 

About

Advanced Ransomware Made with Xanthorox AI

Resources
 Readme
 Activity
Stars
 24 stars
Watchers
 3 watching
Forks
 15 forks
Report repository
Releases

No releases published
Packages

No packages published
Languages

C++
82.5%
 
Shell
10.9%
Python
6.6%
Footer
© 2025 GitHub, Inc.
Footer navigation
Terms
Privacy
Security
Status
Docs
Contact
Manage cookies
Do not share my personal information