Identifying Ransomware - Specific Properties using Static Analysis of Executables

Abstract

Ransomware attacks have risen exponentially over the past decade with increasing severity, potency to cause damage, and ease of carrying out attack. The conventional anti-malware techniques are compelled to include advanced ransomware detection mechanisms. This paper presents the results of the study and analysis of ransomware executable files in order to identify the characteristic properties that distinguish ransomware from other malware and benign executable files. The program binaries are analyzed statically and dynamically to observe the typical behaviour and structure of the ransomware. Using the dynamic and static analysis technique, ransomware-specific properties are extracted from the executable files. The experiments show that higher accuracy of classification, using machine learning algorithms, is achieved by combining these properties with the set of generic malware properties for malware detection. 367 higher accuracy. Static and debug-time analysis of ransomware identified 9 specific properties, when added to 60 generic properties for malware detection, the classification accuracy is increased. Along with these properties, 7 dynamic behavior patterns specific to ransomware are identified. This research work can be further enhanced by addressing the challenges present in this work such as evasive behavior of certain ransomware and their system locking property.

Using ChatGPT to Analyze Ransomware Messages and to Predict Ransomware Threats

“…This necessitates the consideration and implementation of deceptive methodologies, such as the deployment of honeypots [2], [45]. These honeypots serve a dual purpose: they act as baits to lure potential ransomware threats, thereby allowing for their early identification and comprehensive analysis, and they function as a means to safeguard the broader network infrastructure from the damaging impact of these threats [46], [47].…”

RansomCillin: Leveraging NTFS Spare Space to Recover from Ransomware Attacks

“…Initial entry points often involve social engineering, spear-phishing campaigns, and exploitation of software vulnerabilities [32]. Once inside a system, ransomware typically escalates its privileges to execute its payload [33]. This process often involves a series of complex steps designed to avoid detection by security software [22].…”

“…As such, reliance solely on network security is insufficient in providing comprehensive protection against ransomware [31], [32]. The current landscape of ransomware defense has a clear gap in effective post-infection recovery solutions [33], [34]. The limitations of antivirus software, educational efforts, and network security measures highlight the urgency for innovative approaches in ransomware mitigation, particularly in the realm of data recovery [35].…”

RansomCillin: Leveraging NTFS Spare Space to Recover from Ransomware Attacks

“…As such, reliance solely on network security is insufficient in providing comprehensive protection against ransomware [31], [32]. The current landscape of ransomware defense has a clear gap in effective post-infection recovery solutions [33], [34].…”