Ransomware, a malware intended to prevent entry to a device in a Security Breach Structure, or the information contained on it without paying out an amount of money.
Below are ten common trends observed while studying and investigating the methods of over 250 ransomware variants.
Ransomware: Infection Vector
Although many are distributed via mail, the content seems to contain unique attributes. The mail may emerge from a range of areas, most frequently a delivery corporation, a bank card, or a “potential worker” resume.
The email-related form address implies what form of objectives the creator of malware is searching to invade.
Ransomware: Encryption Algorithm
The majority of this malware use cryptosystems of RSA combined with the dataset of AES-256 encryption. RSA is a community key system in which the key for encryption is general and varies from the key for decryption frequently retained on a C2 server.
Ransomware: Demands for the Ransom
Ransom payment often depends on what form of a target for which the malware intended. The ransom money is often greater if the hackers send emails specifically for small firms.
The demand for the ransom depends entirely on the authors of the ransomware. Some malware target at quantity rather than quality and charge just $40 for decryption, while the 7ev3n ransomware costs 13 bitcoin ($8000).
Security Breach Structure: Limited Time Persuasion
Ransomware authors often use some type of time-limit to view profits without having to wait too long. For instance, a demand for ransoms could double in cost every 72 hours.
Or a more hostile strategy, the data will be permanently lost within 7 days. Another malicious sort of malware would erase files every hour before payment of the ransom.
Options for Payment
After persuading the victim to pay the money, authors of this malware will most frequently direct the victim about how to buy Bitcoin and also how to use the Tor network to pay. These are both used by the attackers to stay untraceable.
When they do not choose browser-based transaction, the creators of the ransomware can supply victims with an email address to inquire for further detail. This mode of interaction with offline Ransomware is much more common.
Recovery Prevention
Shadow volume copies are sometimes removed when compromised with ransomware, in order to avoid a quick recovery phase. There are a few ways that ransomware does this but by far the most popular is by using the vssadmin.exe which is a windows software that enables an administrator to handle duplicates of Shadow Volume.
Internal Key Storage
For this type of malware to store its private keys the most secure way is on a C2 server. Any ransomware, however, should operate offline to target more machines.
This malware must hold the private key in memory somewhere and sometimes a security expert can develop a decoding tool if stored insecurely.
Various Method of Persuasion
Ransomware uses several ways to persuade a target and pay the ransom, but the most popular non-time-based approach is to require an individual to decode 1 sample. This helps persuade a customer that once the ransom is charged, their device would return to normal.
Popular Process of Persistence
For ransomware, the most popular way of continuity is to develop Run and RunOnce windows registry. Many ransomware often attaches an asterisk before the key, which causes it to operate in Safe Mode.
Replicating the malware to the “%UserProfile%/Start Menu\Programs\Startup” is the second most popular tactic.
Most Popular Adjustments in Registry
Including persistence, ransomware may allow certain modifications that restrict the exposure a target has to their device. The most popular variety in the registry is the deactivating of the Task Manager.
This most probably is to deter the data encryption from halting when the ransomware is initially installed, particularly if the malware uses an especially sluggish algorithm.
