Skip to content

NUL0x4C/DeleteShadowCopies

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 

Repository files navigation

DeleteShadowCopies: Deleting Shadow Copies In Pure C++


After Looking at some of the leaked ransomware code, i noticed that (at least for the samples i've seen), that the ransomware is using wmic or vssadmin via command line to delete shadow copies, so out of curiosity i had to look for something else, and thus this repo (so im not helping ransomware authers) ...

Example:
  - conti: wmic shadowcopy where "ID='{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}'" delete
  - babuk: vssadmin delete shadows /all /quiet

Demo (Creating):

poc1


Demo (Deleting):

poc2


Based On vshadow

About

Deleting Shadow Copies In Pure C++

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages