I Built a Time Bomb Malware That Triggers Ransomware

Recently, I created a custom malware program that works like a time bomb. Instead of acting immediately, this malware waits silently in the background. After a set amount of time passes, it activates and locks down the system, displaying a full-screen ransomware message.

This project was designed to study how these types of attacks work, how they affect victims, and how they use fear and pressure to force people into taking action.

How the Time Bomb Works

The malware does not show any signs at first. Once it is opened, it runs quietly without showing any window or pop-up. It simply waits. You can continue using your computer as usual — nothing looks suspicious.

However, in the background, a countdown is running. You don’t see it. You don’t hear anything. But once that timer reaches zero, the malware takes full control of the screen.

What Happens When It Triggers

Once the timer ends, the screen goes completely dark, and then a large warning message appears. It takes up the entire screen and cannot be closed or minimized. The message says that your files have been encrypted.

You cannot exit the screen. You cannot open Task Manager. The only thing you can do is read the message.

It Shows a List of “Encrypted” Files

The malware encrypts all files in the Documents, Downloads, Pictures, and Desktop folders.

It Demands a Payment in Bitcoin

The screen also includes a ransom demand. It tells the user to send a payment of $500 worth of Bitcoin to a wallet address shown on the screen. There is a live countdown timer right above it, giving the victim a limited time to respond.

The message says that if payment is not made before the countdown ends, the files will be permanently deleted.

There’s a Decryption Box — But Only One Key Works

At the bottom of the screen, there is a text box asking for a decryption key. This is where the victim can unlock their system.

However, unless the exact key is entered, nothing happens. If the wrong key is typed in, the screen shows a red error message that says the key is invalid.

Only the correct key will remove the ransomware screen and return the system and files to normal.