GitHub - MinervaLabsResearch/SporaVaccination: Vaccinating
against Spora ransomware: a proof-of-concept tool by Minerva
By lestera
Archived: 2026-04-05 14:20:39 UTC
Spora is presently among the most common ransomware families. For instance, it struck countless victims in the
fake "Chrome Font Pack Update" campaign, encrypting victims’ files even without having to communicate over
the Internet. Minerva is releasing a proof-of-concept tool that is able to contain Spora infections by generating an
infection marker that this ransomware seeks, to determine whether it’s already running on the system.
The actual vaccination code can be found in the VaccinateSpora() method in Program.cs :
private bool VaccinateSpora()
{
 uint volumeSerialNumber, maxComponentLength;
 WinApi.FileSystemFeature fileSystemFlags;
 if (!WinApi.GetVolumeInformation(@"C:\", null, 0, out volumeSerialNumber, out maxComponentLength, out fileSy
 {
 return false;
 }
 string mutexName = "m" + volumeSerialNumber;
 if (WinApi.CreateMutex(IntPtr.Zero, false, mutexName) == IntPtr.Zero)
 {
 return false;
 }
 return true;
}
Source: https://github.com/MinervaLabsResearch/SporaVaccination
https://github.com/MinervaLabsResearch/SporaVaccination
Page 1 of 1