RanDS

The largest ransomware dataset.

The dataset contains 104,616 ransomware samples from 533 ransomware families targeting Microsoft Windows OS, along with 110,788 benign samples.
Use the navigation menu above to explore the raw dataset samples. You can search, filter, and download samples directly from the interface. Each sample is compressed into a zip file and protected with the password "infected".
We have also created several processed datasets from the raw dataset. You can view their details and download them using the navigation menu above. Below, we summarize them:
  • PE Static Raw Strings Dataset

    Extracts ASCII and UTF-16 strings from PE files using static analysis. The dataset is cleaned, normalized, and consolidated into text for each sample.

  • PE Static English Strings Dataset

    A filtered version of the Raw Strings Dataset that keeps only meaningful English words using the Python Enchant library.

  • PE Static APIs Dataset

    Extracts imported and exported API calls from PE files using the PeFile module and stores them in structured JSON format.

  • PE Static Demangled APIs Dataset

    Provides a demangled version of the APIs Dataset using Demumble, supporting both Itanium and Visual Studio symbols.

  • PE Behaviour Activities Dataset

    Generated by executing PE files in CAPEv2 and Cuckoo Sandbox to capture runtime behaviors such as registry, file, process, network, and API activities.

    • Collected by Saleh Alzahrani

    Paper

    For more details about the dataset, please check our paper listed below

    The paper details will be available here after publication.
    The ransomware dataset provided on this website is intended solely for research purposes.
    Unauthorized or malicious use of this dataset, including any attempts to exploit or distribute, is strictly prohibited and may violate applicable laws. We do not endorse any illegal activity, and we assume no liability for any misuse of the data. Users are responsible for ensuring that their use of this dataset complies with all relevant laws and regulations.
    Please be aware that this dataset contains live ransomware samples, which have the potential to cause harm to your data and devices. By accessing or using this dataset, you acknowledge the risks involved and agree that you are doing so at your own risk. We strongly recommend taking appropriate precautions to protect your systems.
    If you use this dataset in your research, please cite our paper as show in Home page.
    For any questions or concerns, please contact us at: [email protected]