GandCrab Ransomware Analysis on Windows Using Static Method

Abstract

Malware-infected operating systems may experience system damage, files or loss of important data. Ransomware is a type of malware that works by attacking the internet network and then encrypting the victim's computer. So that the victim can access his computer again, the victim is asked to redeem (ransom) with some money in the form of Bitcoin. One of them is GandCrab. Gandcrab is a very powerful ransomware and only the creators of Gandcrab know the description of the encrypted files.Static analysis is done by importing malware samples into Virustotal, Dependency walker, PEStudio, Exeinfo PE, and PEexplorer tools to get the strings function, which will then be analyzed to find out how the GandCrab Ransomware works.This study analyzes the gandcrab ransomware malware using a static method. In the Virustotal tool, it was found that the malware sample file was detected as malware with a ratio of 60 out of 70 antimalware. Furthermore, it was found that GandCrab is in PE (portable executable) format, compiled using Microsoft Visual C++ and GndCrab accesses some DLL (dynamic link-library) functions. Sistem operasi yang terinfeksi malware dapat mengalami kerusakan sistem, file atau kehilangan data-data penting. Ransomware merupakan salah satu jenis malware yang bekerja dengan cara menyerang jaringan internet kemudian mengenkripsi komputer korban. Agar korban dapat mengakses komputernya lagi, korban diminta unutk menebus (ransom) dengan sejumlah uang dalam bentuk Bitcoin. Salah satunya yaitu GandCrab. Gandcrab merupakan ransomware yang sangat kuat dan hanya pembuat gandcrab yang mengetahui deskripsi dari file yang terenkripsi. Analisis statis dilakukan dengan mengimpor sample malware kedalam tools Virustotal, Dependency walker, PEStudio, Exeinfo PE, dan PEexplorer untuk mendapatkan fungsi strings yang kemudian strings tersebut akan dianalisa untuk mengetahui cara kerja dari GandCrab Ransomware. Penelitian ini melakukan analisis terhadap malware gandcrab ransomware dengan menggunakan metode statis. Pada tool Virustotal, didapatkan bahwa file sample malware terdeteksi sebagai malware dengan rasio 60 dari 70 antimalware. Selanjutnya ditemukan bahwa GandCrab berformat PE (portable executable), dikompilasi menggunakan Microsoft Visual C++ dan GandCrab mengakses beberapa fungsi DLL (dynamic link-library).

Ransomware Behavior on Windows Endpoint: An Analysis

“…GandCrab was one of the most popular and active ransomware families from early 2018 until mid-2019, when it was said to have stopped being used. Like other types of ransomwares, GandCrab uses different Windows API calls to do its bad things [35], [36]. Some of the most common ones are:…”

Altitude Control of UAV Quadrotor Using PID and Integral State Feedback

“…The proportional Integral Derivative (PID) controller has been known for its wide use in many control systems; hence, it also has been applied to control altitude in quadrotor [9] [10]. The other controller is Sliding Mode Control (SMC) [11], Linear Quadratic Regulator (LQR) [12][13], Predictive Control [14], Fuzzy Control [15] [16], Neural Network [17] [18], Fractional Order PID [19], Feedback Linearization [20], and other control techniques [21]. This research presented an application of the Integral State Feedback (ISF) controller for altitude control in quadrotor as a practical solution that enables a precise and robust control system performance.…”