Developed as part of an academic project at
Victoria University, Melbourne, Australia
Follow the guide for your platform. You'll be protected in under five minutes.
One-click wizard installer - no technical knowledge needed.
RANZER requires Python 3.10 or later. Open a Command Prompt and run:
python --versionIf you see Python 3.10.x or higher, you're ready. If not - or if you get an error - download and install Python first:
Right-click RANZER_Setup.exe and choose Run as administrator. This is required to add RANZER to your system PATH and create Start Menu shortcuts.
The wizard will:
· Copy RANZER to C:\Program Files\Ranzer\
· Install the required Python libraries (watchdog, psutil, Pillow) automatically
· Create a RANZER shortcut in your Start Menu
· Optionally add a Desktop shortcut
· Add ranzer to your system PATH so it works in any terminal
Click Install and wait about 30–60 seconds for the pip packages to install.
Once installation is complete, you can launch RANZER in two ways:
From Start Menu: Press the Windows key, type RANZER, and click the app icon.
From Command Prompt: Open a new terminal window (important - existing windows won't have the updated PATH) and run:
ranzer guiIn a new Command Prompt, run:
ranzer --helpYou should see the RANZER command list. If you see an error, see the troubleshooting section below.
Go to Settings → Apps → RANZER and click Uninstall. Or find it in Control Panel → Programs. All files and PATH entries are removed automatically.
'ranzer' is not recognized - Open a new Command Prompt window. If still failing, restart your PC to refresh environment variables.
Python not found during install - Install Python 3.10+ from python.org, tick "Add Python to PATH", restart, then re-run the installer.
GUI doesn't open - Run python -m ranzer gui in a terminal to see the error message directly.
Debian package for Ubuntu, Debian, Kali, Linux Mint, and all apt-based distros.
Click the button above to download ranzer_1.0_amd64.deb to your Downloads folder. The file contains a self-contained RANZER bundle - no Python installation required.
Open a terminal, navigate to your Downloads folder, and run:
cd ~/Downloads sudo apt install ./ranzer_1.0_amd64.deb
The ./ prefix is important - it tells apt to install from a local file, not search online repositories. Enter your password when prompted.
After installation, RANZER appears in your Applications menu under System or Security. You can also launch it from the terminal:
# Open the GUI ranzer gui # Or check the CLI ranzer --help
If you prefer a GUI installer for future .deb files, install GDebi:
sudo apt install gdebiAfter that, double-clicking any .deb file will open a proper install window with a single Install Package button.
sudo apt remove ranzerThis removes the binary, desktop entry, and icon. Use sudo apt purge ranzer to also remove configuration files.
dpkg: dependency problems - Run sudo apt-get install -f after the failed install to auto-resolve missing dependencies.
GUI doesn't launch - Make sure you have a display server running. On Kali headless/server, install python3-tk and set DISPLAY=:0.
'ranzer' not found after install - Run hash -r in your shell or open a new terminal to refresh the command cache.
User Guide
A complete walkthrough from first launch to active protection.
When RANZER opens you'll see a landing screen with a brief overview of what the tool does. Click Get Started to move to the setup screen.
Click Add Directory and select folders you want to protect - your Desktop, Documents, Downloads, or any folder containing important files.
You can add multiple directories. RANZER monitors each one independently with its own set of honey files.
In the Setup screen, you'll see the Auto-Terminate toggle. When enabled, RANZER will automatically kill any process that reaches a CRITICAL threat score - no confirmation needed.
Click Start Monitoring. RANZER will:
· Deploy hidden honey files inside each monitored directory
· Begin watching every file event in real time
· Start entropy analysis on file writes
· Begin tracking process write rates
The Dashboard tab shows live statistics - events per second, files monitored, active processes, and current threat scores.
Events/sec - how many file events are being processed right now. A sudden spike is the first sign of ransomware behaviour.
Threat Score - a composite score from 0–100 based on entropy, honey file access, and write rate. Below 40 is normal. Above 70 is HIGH. Above 90 is CRITICAL.
Active Processes - processes currently writing to monitored directories. RANZER tracks which PID is responsible for suspicious activity.
The Alerts tab shows all detection events. Each alert has a severity level:
A file event was observed - write, rename, or creation. Normal background activity. No action needed.
Elevated entropy or write rate detected. Could be a backup tool, file compression, or the beginning of an attack. RANZER continues monitoring closely.
Multiple detection signals confirmed simultaneously - typically a honey file access combined with high entropy. Strong indicator of ransomware. If Auto-Terminate is on, the process is killed immediately.
All RANZER features are available from the command line - useful for servers, scripts, and headless systems.
| Command | Description |
|---|---|
| ranzer gui | Launch the graphical interface. |
| ranzer monitor --dir <path> | Start monitoring a directory in CLI mode. Prints events to stdout in real time. |
| ranzer monitor --dir <path> --auto-terminate | Monitor with automatic process termination when CRITICAL is reached. |
| ranzer monitor --dir <path> --honey | Deploy honey files before starting the monitor. |
| ranzer simulate --dir <path> | Run the built-in ransomware simulator against a test directory to verify detection is working. |
| ranzer simulate --dir <path> --new-only | Simulate only new file creation (Phase 4) - skips in-place encryption and rename phases. |
| ranzer --help | Show all available commands and flags. |
Quick Test
RANZER includes a built-in simulator that mimics real ransomware behaviour. Use it to confirm detection is working before relying on RANZER in production.
# Create a throwaway test directory mkdir ~/ranzer_test # Start RANZER monitoring it (with auto-terminate) ranzer monitor --dir ~/ranzer_test --auto-terminate & # Run the simulator - RANZER should detect and terminate it ranzer simulate --dir ~/ranzer_test
The simulator will be terminated by RANZER before it finishes writing all files. That's the expected result - it means detection is working correctly.
Developed as part of an academic project at
Victoria University, Melbourne, Australia