Article: Anatomy of ransomware malware: detection, analysis and reporting Journal: International Journal of Security and Networks (IJSN) 2017 Vol.12 No.3 pp.188 - 197 Abstract: Rapidly increasing malware samples pose a serious threat to cyber security especially when they are not getting detected by security tools and techniques. Malware writers obfuscate the malware samples to conceal malicious code inside a legitimate executable to evade antivirus solutions and tamper it without changing its genuine structure to exploit target machines and remain fully undetected (FUD). Thus, it is a major challenge before Cyber Clean operations run by various government agencies to monitor malicious activities in their official network. Ransomware is a malware that encrypts documents to breach information on victim machine and asks for ransom to provide the decryption key. This paper presents the results of static and dynamic analysis of nine prominent variants of ransomware samples obtained from renowned malware repositories. A test bed is prepared to analyse these samples in Cuckoo's sandbox environment to monitor altered files/directories, tampered registry keys, Command and Control (C&C) and accessed application programming interfaces (APIs). At the end of this paper, we present the observations from our experimental analysis and provide remedial measures to deal with these samples, which would more likely impact the future analysis of ransomware. Inderscience Publishers - linking academia, business and industry through research

Title: Anatomy of ransomware malware: detection, analysis and reporting

Authors: Gurdip Kaur; Renu Dhir; Maninder Singh

Addresses: Department of Computer Science and Engineering, Dr. BR Ambedkar National Institute of Technology, Jalandhar – 144011, India ' Department of Computer Science and Engineering, Dr. BR Ambedkar National Institute of Technology, Jalandhar – 144011, India ' Department of Computer Science and Engineering, Thapar University, Patiala – 147004, India

Abstract: Rapidly increasing malware samples pose a serious threat to cyber security especially when they are not getting detected by security tools and techniques. Malware writers obfuscate the malware samples to conceal malicious code inside a legitimate executable to evade antivirus solutions and tamper it without changing its genuine structure to exploit target machines and remain fully undetected (FUD). Thus, it is a major challenge before Cyber Clean operations run by various government agencies to monitor malicious activities in their official network. Ransomware is a malware that encrypts documents to breach information on victim machine and asks for ransom to provide the decryption key. This paper presents the results of static and dynamic analysis of nine prominent variants of ransomware samples obtained from renowned malware repositories. A test bed is prepared to analyse these samples in Cuckoo's sandbox environment to monitor altered files/directories, tampered registry keys, Command and Control (C&C) and accessed application programming interfaces (APIs). At the end of this paper, we present the observations from our experimental analysis and provide remedial measures to deal with these samples, which would more likely impact the future analysis of ransomware.

Keywords: ransomware; malware detection; reverse engineering; cyber security; static analysis; dynamic analysis.

DOI: 10.1504/IJSN.2017.084399

International Journal of Security and Networks, 2017 Vol.12 No.3, pp.188 - 197

Received: 14 Sep 2016
Accepted: 05 Jan 2017
Published online: 06 Jun 2017 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article

Title: Anatomy of ransomware malware: detection, analysis and reporting

Keep up-to-date