Authors: Gurdip Kaur; Renu Dhir; Maninder Singh
Addresses: Department of Computer Science and Engineering, Dr. BR Ambedkar National Institute of Technology, Jalandhar – 144011, India ' Department of Computer Science and Engineering, Dr. BR Ambedkar National Institute of Technology, Jalandhar – 144011, India ' Department of Computer Science and Engineering, Thapar University, Patiala – 147004, India
Abstract: Rapidly increasing malware samples pose a serious threat to cyber security especially when they are not getting detected by security tools and techniques. Malware writers obfuscate the malware samples to conceal malicious code inside a legitimate executable to evade antivirus solutions and tamper it without changing its genuine structure to exploit target machines and remain fully undetected (FUD). Thus, it is a major challenge before Cyber Clean operations run by various government agencies to monitor malicious activities in their official network. Ransomware is a malware that encrypts documents to breach information on victim machine and asks for ransom to provide the decryption key. This paper presents the results of static and dynamic analysis of nine prominent variants of ransomware samples obtained from renowned malware repositories. A test bed is prepared to analyse these samples in Cuckoo's sandbox environment to monitor altered files/directories, tampered registry keys, Command and Control (C&C) and accessed application programming interfaces (APIs). At the end of this paper, we present the observations from our experimental analysis and provide remedial measures to deal with these samples, which would more likely impact the future analysis of ransomware.
Keywords: ransomware; malware detection; reverse engineering; cyber security; static analysis; dynamic analysis.
International Journal of Security and Networks, 2017 Vol.12 No.3, pp.188 - 197
Received: 14 Sep 2016
Accepted: 05 Jan 2017
Published online: 06 Jun 2017 *