Study on Emerging Trends in Malware Variants 1Yellepeddi Vijayalakshmi, 2Neethu Natarajan, 3P

International Journal of Pure and Applied Mathematics Volume 116 No. 22 2017, 479-489 ISSN: 1311-8080 (printed version); ISSN: 1314-3395 (on-line version) url: http://www.ijpam.eu Special Issue ijpam.eu Study on Emerging Trends in Malware Variants 1Yellepeddi Vijayalakshmi, 2Neethu Natarajan, 3P. Manimegalai and 4Suvanam Sasidhar Babu 1Department of Computer Science and Engineering, Karpagam University, Coimbatore, India. 2Department of Computer Science and Engineering, SNGCE, Kadayiruppu, Ernakulam (Dt.), India. 3Department of Computer Science and Engineering, Karpagam University, Coimbatore, India. 4Department of Computer Science and Engineering, SNGCE, Kadayiruppu, Ernakulam (Dt.), India. Abstract This survey is based on the new trendsin malware and its classification. Security researchers discovered an average four to five new malware variants emerged every second over the past years. This is a big problem to our computer security. To defeat those variants we must know more about its family and its features. This survey will helps to get an aware about malwares and its causes. Index Terms:Malware, trojan horse, backdoor, ransom ware, spyware, scare ware, cookie, window small ware. 479 International Journal of Pure and Applied Mathematics Special Issue 1. Introduction The ever-increasing volume of new malware variants produced every day is a challenging problem in security field. Security researchers have added more than 115 million malware samples to their databases so far this year, with Windows viruses making a comeback. Researchers discovered an average four to five new malware variants every second over the past year and recorded a surprising comeback of reproducing Windows-based viruses, according to a new study [2]. The number of new malware variants that emerged in February 2017 was three times higher compared to January, nearly reaching the record- high levels registered in October 2016, Symantec reports[3,4,5] .27% of all malware variants in history were created in the year 2015. The predominant platform for malware is still Windows. It covers 99.1% of the malware specimen. Trailing behind are scripts, Java applets, macros and other operating systems like OSX, Android, and Unix/Linux [7,8]. Malware, short for malicious software, including computer viruses, worms, Trojan horses, The remainder of this paper is organized as follows. Section II gives an overview of malware. Section III describes top 10 windows malwares in 2016 and 2017.In section IV top ransom ware families detected in 2017 .A brief summary of the predictions in the security field introduced in section V. We conclude this paper in section VI. 2. Malware Ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software [9,10]. Malware is defined by its malicious intent, acting against the requirements of the computer user - and so does not include software that causes unintentional harm due to some deficiency. Programs supplied officially by companies can be considered malware if they secretly act against the interests of the computer user. An example is the Sony rootkit, a Trojan horse embedded into CDs sold by Sony, which silently installed and concealed itself on purchasers' computers with the intention of preventing illicit copying; it also reported on users' listening habits, and unintentionally created vulnerabilities that were exploited by unrelated malware [9]. A computer virus is a type of malicious software program ("malware") that, when executed, replicates itself by modifying other computer programs and inserting its own code [10]. Infected computer programs can include, as well, data files, or the "boot" sector of the hard drive. When this replication succeeds, the affected areas are then said to be "infected" with a computer virus. 480 International Journal of Pure and Applied Mathematics Special Issue A Trojan horse is a malicious computer program which misrepresents itself to appear useful, routine, or interesting in order to persuade a victim to install it. The term is derived from the Ancient Greek story of the Trojan horse used to invade the city of Troy by stealth. Rootkits a malicious program is installed on a system, it is essential that it stays concealed, to avoid detection. Software packages known as rootkits allow this concealment, by modifying the host's operating system so that the malware is hidden from the user. Rootkits can prevent a malicious process from being visible in the system's list of processes, or keep its files from being read kits. A backdoor is a method of bypassing normal authentication procedures, usually over a connection to a network such as the Internet. Once a system has been compromised, one or more backdoors may be installed in order to allow access in the future [14] invisibly to the user. Ransomware is a type of malicious software from crypto virology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a knowledgeable person to reverse, more advanced malware uses a technique called crypto viral extortion, in which it encrypts the victim's files, making them inaccessible, and demands a ransom payment to decrypt them.[10][11][12][13] In a properly implemented crypto viral extortion attack, recovering the files without the decryption key is an intractable problem – and difficult to trace digital currencies such as Ukash and Bitcoin are used for the ransoms, making tracing and prosecuting the perpetrators difficult. Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment. However, one high-profile example the "WannaCry worm", traveled automatically between computers without user interaction. Spyware is software that aims to gather information about a person or organization without their knowledge that may send such information to another entity without the consumer's consent, or that asserts control over a device without the consumer's knowledge [10]."Spyware" is mostly classified into four types: adware, system monitors, tracking cookies, and Trojans[11] examples of other notorious types include digital rights management capabilities that "phone home", key loggers, rootkits, and web beacons. Spyware is mostly used for the purposes of tracking and storing Internet users' movements on the Web and serving up pop-up ads to Internet users. Whenever spyware is used for malicious purposes, its presence is typically hidden from the user and can be difficult to detect. Some spyware, such as key loggers, may be installed by the owner of a shared, corporate, or public computer intentionally in order to monitor users. Spyware can collect almost any type of data, including personal information like internet surfing habits, user logins, and bank or credit account information. Spyware can also interfere with a user's control of a computer by installing additional software or redirecting web browsers. Some spyware can 481 International Journal of Pure and Applied Mathematics Special Issue change computer settings, which can result in slow Internet connection speeds, un-authorized changes in browser settings, or changes to software settings. A cookie is just a bit of text in a file on your computer, containing a small amount of information that identifies you to a particular website, and whatever information that site wanted to retain about the user when they are visiting. Cookies are a legitimate tool used by many websites to track visitor information. As an example, I might go to an online computer store and place an item in the basket, but decide not to buy it right away because I want to compare prices. The store can choose to put the information about what products I put into my basket in a cookie stored on my computer. This is an example of a good use of cookies to help the user experience. The only websites that are supposed to be able to retrieve the information stored in a cookie are the websites that wrote the information in that particular cookie. This should ensure your privacy by stopping anyone other than the site you are visiting from being able to read any cookies left by that site. 3. Windows Malware a) Top 10 windows malwares in 2017 The top 10 malware listed below were responsible for approximately 56% of all new malware infections reported by the MS-ISAC in April 2017. This was an increase of almost eight percentage points from March 2017 and continues an upward trend since it bottomed out in January 2017 to 43% [15]. Figure 3.1: Top 10 Malware (MS-ISAC report) The above figure shows the malware infections in April 2017 statistics. This is done by using open source observations and reports on each malware type. The MS-ISAC observed a continued increase in spam and malware droppers, while malvertising continued to decline [15]. Kovter is a Trojan, which has been observed acting as click fraud malware or a ransomware downloader. Recently, it is disseminated via spam email attachments containing malicious office macros. Kovter is fileless malware that evades detection by hiding in registry keys. Reports indicate that Kovter has received updated instructions from command and control infrastructure to serve 482 International Journal of Pure and Applied Mathematics Special Issue as a remote access backdoor. ZeuS/Zbot is a banking Trojan which uses keystroke logging to compromise victim credentials when a user visits a banking website. Since the release of the ZeuS source code in 2011, many malware variants have adopted parts of its code, meaning that events classified as ZeuS may actually be other malware using parts of the ZeuS code. The widespread use of ZeuS has led to multiple vectors being used for distribution. Tinba, also known as Tiny Banker, is a banking Trojan, known for its small file size.

Load more