• Abstract and Figures
• Public Full-text

Nirupan: An e-Journal of RBIMS Vol. 1, No. 2 ISSN: 2395-7123 Nirupan: An e-Journal of RBIMS Vol. 1, No. 2 ISSN: 2395-7123 Analysis of Malwares and Crypto-Ransomware aDeepika G. Vaghela bSweta Dargad aAssistant Professor - Computer Science & Engineering Department, ITM Universe, Vadodara. bAssistant Professor - Computer Science & Engineering Department, ITM Universe, Vadodara Abstract — Ransomware which is a family of Among the most popular variants of ransomware, it malware that takes files on a PC or network is estimated that CryptoLocker and CryptoWall have storage, encrypts them, and then extorts money to collected millions of dollars from its victims. unlock the files is often called CryptoLocker, CryptoDefense or CryptoWall. Ransomware is one of Key highlights from the analysis include: the most widespread and damaging threats that internet users face today. • Ransomware proliferates through new attack vectors, such as malwartising, employing anti- Keywords — Crypto-Ransomware, encryption, analysis and persistence techniques to ensure decryption, Private key, Cryptography, system compromise Kryloggers . • Advanced encryption algorithms, such as I. INTRODUCTION RSA and AES, prevent decryption without the key This danger is supposed crypto-ransomware • Ransomware has shifted its attention to the (ransomware) and includes at littlest a half-dozen enterprise, targeting more than 230 file types variants, including CryptoLocker and CryptoWall. (up 200 percent from 70 file types in 2013) Ransomware shows picayune Very light of dim with a view familiar detection-based support, such as There are 11 types of malware which is antivirus, has proven ineffective at preventing mentioned below. the pretend to. In surely, ransomware has been 1. Adware : The least dangerous and most proliferationin handsomeness in compensation it lucrative Malware. Adware displays ads on crafty appeared in September 2013, your computer. ,leveraging original attack vector, embracing advanced encryption algorithms and expanding the 2. Spyware:. Spyware is software that spies on number of file types it targets. you, tracking your internet activities in order to send advertising (Adware) back to your system. Trojan attacks turn this way strive 3. Virus: A virus is a contagious program or code for to route origination and annex astute answer, that attaches itself to another piece of software, such as credit card numbers and bank account and then reproduces itself when that software is credentials. run. Most often this is spread by sharing In preference to, force ware unreservedly makes software or files between computers. its illusion make public by encrypting stationery and demanding payment for the keys to unlock them. 4. Worm: A program that replicates itself and destroys data and files on the computer. Worms Victims of the trouble may consent work to “eat” the system operating files and to consternation or be leery of, hence they data files until the drive is empty. are forced to spare the compel to put an end to the endanger, forever without reporting the crime 5. Trojan: The most dangerous Malware. Trojans in order to avoid further embarrassment. are written with the purpose of discovering your financial information, taking over your computer‟s system resources, and in larger systems creating a “denial-of-service attack” Denial-of-service attack: an attempt to 1 Nirupan: An e-Journal of RBIMS Vol. 1, No. 2 ISSN: 2395-7123 make a machine or network resource search activity and give you the results the unavailable to those attempting to reach it. developers want you to see. Its intention is to Example: AOL, Yahoo or your business make money off your web surfing. Using this network becoming unavailable. homepage and not removing the Malware lets the source developers capture your surfing interests. 6. Rootkit: This one is likened to the burglar hiding This is especially dangerous when banking or in the attic, waiting to take from you while you shopping online. These homepages can look are not home. It is the hardest of all Malware to harmless, but in every case they allow other more detect and therefore to remove; many experts infectious recommend completely wiping your hard drive There are two types of ransomware and reinstalling everything from scratch. It is designed to permit the other information 1) Encrypting ransomware, which incorporates gathering Malware in to get the identity advanced encryption algorithms. It‟s information from your computer without you designed to block system files and demand realizing anything is going on. payment to provide to provide the victim with the key that can decrypt the blocked 7. Backdoors: Backdoors are much the same as content. Trojans or worms, except that they open a Examples include CryptoLocker[2], Locky, “backdoor” onto a computer, providing a CrytpoWall[3] and more. network connection for hackers or other Malware 2) Locker ransomware, which locks the victim to enter or for viruses or SPAM to be sent. out of the operating system, making it impossible to access the desktop and any 8. Keyloggers: Records everything you type on apps or files. The files are not encrypted in your PC in order to glean your log-in names, this case, but the attackers still ask for a passwords, and other sensitive information, and ransom to unlock the infected computer. send it on to the source of the keylogging Example include the police-themed program. Many times keyloggers are used by ransomware or Winlocker. corporations and parents to acquire computer usage information. II. KEY CHARACTERISTICS 9. Rogue security software: This one deceives or misleads users. It pretends to be a good program Crypto-ransomware is rather different from to remove Malware infections, but all the while it is the Malware. Often it will turn off the real traditional malware: Anti-Virus software. The next image shows the typical screen for this Malware program, • It doesn‟t steal victim‟s information—instead it Antivirus 2010 makes it impossible to access your information 10. Ransomware: If you see this screen that warns • It doesn‟t try to remain stealthy after files are you that you have been locked out of your encrypted because detection won‟t restore the lost computer until you pay for your cybercrimes. data Your system is severely infected with a form of Malware called Ransomware. It is not a real • It‟s relatively easy to produce—there are a notification from the FBI, but, rather an infection number of well-documented crypto-libraries of the system itself. Even if you pay to unlock the system, the system is unlocked, but you are not III. TIMELINE AND DATASET free of it locking you out again. The request for money, usually in the hundreds of dollars is Given Figure shows the dataset and how the completely fake. malware raise their intensity with time. The given dates are based on various reports, coupled with 11. Browser Hijacker: When your homepage our own analysis. changes to one that looks like those in the images inserted next, you may have been infected with one form or another of a Browser Hijacker. This dangerous Malware will redirect your normal 2 Nirupan: An e-Journal of RBIMS Vol. 1, No. 2 ISSN: 2395-7123 4. Watch out for spam and phishing emails. For example, the post office will never send a document as a .zip file. And so-called legal documents that ask you to “enable content” are traps. Businesses should also use a good email filtering system, disable macro scripts from Office files received via email, and educate employees on current spam and phishing schemes. Fig 1: Diagram for Dataset and Timeline[11] CryptoLocker surfaced in the fall of 2013, and remained among the most widespread of the crypto-ransomware families until mid-2014 [2]. CryptoWall surfaced towards the end of 2013 [3], but didn‟t become prominent until 2014 . New strains of CryptoWall have appeared as recently as last month (October 2014). Critroni behaves similarly to CryptoWall— they both require using the TOR browser to make payments, and they both were prominent around the summer of 2014 [5]. Our sample of DirtyDecrypt outdates CryptoLocker, appearing in the summer of 2013—a few months before CryptoLocker became prominent[4]. This sample only targets and encrypts eight different file formats, which makes sense due to it being among the earliest iterations of ransomware. Steps to protect against Ransomware for businesses and consumers: 1. Take regular backups of files, and test them to make sure they‟re reliable. In case you do get hit, you won‟t be put in the difficult position of Fig 2: Diagram or Structure of Ransomware deciding whether to pay. Deployment [8]. 2. Keep all software up to date. Ransomware 1. Establish the Intial access : In this scenario , often infects by taking advantage of security the access to the victim‟s computer/device has flaws in outdated software, so keeping software establish with ransomware through network or current will go a long way. with some legal tools. This connection will start the first step to enter into the victim‟s device. 3. Use robust security software that employs a 2. Escalate Privileges: requires the attacker to layered approach to block known threats as well grant himself higher privileges. as brand new threats that haven‟t yet been seen. 3 Nirupan: An e-Journal of RBIMS Vol. 1, No. 2 ISSN: 2395-7123 2. Identify Backup, snapshot & DR system: When [6] Valach, Anthony P. "What to Do After a ransomware has granted to enter into victim‟s Ransomware Attack." Risk Management 63.5 (2016): device then have to find out the location of 12. backup, snapshot etc so it can easily attack on [7] Jakobsson, Markus, and Zulfikar data. Ramzan. Crimeware: understanding new attacks and 3. Identify mission critical system & data defenses. Addison-Wesley Professional, 2008. 4.

Load more

  45

Copy Link