4.8
RansomWhere
Generic ransomware detector. Contribute to objective
SHARE
Screenshots (1)
Screenshot 1 of 1
Overview
RansomWhere? is an open-source generic ransomware defense utility for macOS created by Objective-See. Designed to stop both known and zero-day file-encrypting malware, RansomWhere continuously tracks process file-creation entropy—automatically suspending untrusted processes the instant bulk encryption activity is detected and alerting the user to terminate them cleanly.
How It Works
RansomWhere operates through structured, deterministic execution stages:
Heuristic Bulk Encryption Analysis: Tracks file creation rates and cryptographic entropy signatures across user directories in real time.
Automated Process Suspension: Immediately suspends (
SIGSTOP) untrusted processes caught rapidly writing high-entropy encrypted files to disk.User Decision & Process Termination: Presents affected file paths and parent executable details so users can terminate malicious processes instantly.
Verified Signed Binary Filtering: Trusts Apple-signed system components and explicitly whitelisted backup suites to avoid interrupting daily workflows.
Key Technical Features & Capabilities
Zero-Day Generic Encryption Detection: Identifies ransomware heuristically by monitoring rapid creation of high-entropy encrypted files rather than relying on stale malware hashes.
**Instant Process Suspension (
SIGSTOP)**: Freezes suspected ransomware processes immediately in kernel scheduler state before personal documents can be wiped.Interactive Kill & Forensic Alert: Shows the suspect executable path, PID, and affected target files so users can terminate malicious payloads instantly.
Trusted Encryption App Compatibility: Automatically allows Apple-signed tools and approved encrypted backup/GPG utilities without interrupting normal backups.
Architecture & Technology Stack
Primary Languages: Objective-C, C
System Frameworks: Endpoint Security / FSEvents, Entropy Analysis Engine, Security.framework, XPC
Architecture: Persistent Monitor Daemon + Alert Helper UI
Supported Platforms: macOS 11+ (Universal Apple Silicon & Intel)
System Requirements
| Specification | Minimum Requirement | Recommended Specification |
|---|---|---|
| Operating System | macOS 11.0+ (Universal Apple Silicon & Intel) | Latest stable release build |
| Processor Architecture | 4-Core x86_64 or Apple Silicon M1 | 8-Core Apple Silicon / Core i7+ |
| Memory (RAM) | 4 GB Unified Memory | 16 GB+ High-Speed RAM |
| Disk Space | 1 GB free SSD storage | 5 GB+ free SSD storage |
Installation & Setup Guide
macOS Installation
1
Download
RansomWhere_2.2.0.zip directly from CookApps.2
Launch
RansomWhere Installer.app and approve Full Disk Access permissions so file system writes can be inspected.Building from Source
bash
git clone https://github.com/objective-see/RansomWhere.git cd RansomWhere open RansomWhere.xcworkspace
How to Use & Workflow
1
Deploy Background Guard: Install RansomWhere so it silently observes untrusted file creation spikes.
2
Respond Immediately on Alert: If RansomWhere suspends a process encrypting personal files, verify whether you launched it (e.g. GPG batch script) or click Terminate to stop malware dead.
Troubleshooting & Common Issues
Issue: Legitimate compression or local AI weight encryption triggers an alert.
*Cause*: Unsigned CLI tools rapidly outputting high-entropy archives match generic bulk encryption signatures.
*Resolution*: Click Allow on the prompt to whitelist that signed binary path safely.
How to Use & Getting Started
## Installation & Setup Guide
### macOS Installation
1. Download `RansomWhere_2.2.0.zip` directly from CookApps.
2. Launch `RansomWhere Installer.app` and approve Full Disk Access permissions so file system writes can be inspected.
### Building from Source
```bash
git clone https://github.com/objective-see/RansomWhere.git
cd RansomWhere
open RansomWhere.xcworkspace
```
Ready to run RansomWhere?
100% Free & Open-Source native desktop software. Star the repository to support development.
