Well, malware devs should just ship as a docker container.

version: '3.9'

services:
  ransomware:
    image: totally-legit/malware:latest
    container_name: scary_encryption_bot
    restart: always
    volumes:
      - path_to_your_sensitive_files:/data