Network activity analysis of CryptoWall ransomware

Abstract

The paper presents the analysis of the CryptoWall ransomware network behaviour. In this approach a HoneyPot technology as well as the automatic run-time malware analytical system called Maltester were used. We present the practical results of the analyses, technologies and tools used, and the gained experience with dynamic analysis of ransomware software in a dedicated environment. Most of the data was collected with the use of the HoneyPot infrastructure created and deployed in the network of the Institute of Computer Science WUT.Streszczenie. Praca przedstawia analizę zachowania sieciowego złośliwego oprogramowania CryptoWall typu ransomware. W badaniach wykorzystano technologię HoneyPot oraz system automatycznej analizy działania złośliwego oprogramowania w czasie jego wykonywania o nazwie Maltester. Zaprezentowano zarówno uzyskane wyniki analiz, wykorzystane technologie i narzędzia jak i doświadczenia zebrane podczas analizy oprogramowania typu ransomware w autorskim środowisku analitycznym. Większość danych zebrana została z wykorzystaniem infrastruktury HoneyPot stworzonej i wdrożonej w sieci Instytutu Informatyki Politechniki Warszawskiej. (Dynamiczna analiza aktywności sieciowej oprogramowania CryptoWall typu ransomware).

The impact of malware evolution on the analysis methods and infrastructure

“…The results presented in this paper are continuation of the previous works associated with the analysis of the CryptoWall ransomware conducted at the beginning of 2015 [13]. Because of unknown reasons new samples of the CryptoWall were not observed in the January 2016 and later the whole CryptoWall infrastructure was shut down.…”

“…Unfortunately, due to the great popularity of this system, these two virtual environments are the most often detected by the malware (in such case it simply stops its hostile activity). To deal with that, during our research we have developed two different environments dedicated for dynamic analysis -Maltester [13] and MESS [12].…”

Towards Data Resilience: The Analytical Case of Crypto Ransomware Data Recovery Techniques

“…(1) whether to locally generate the asymmetric key pair on the victim after infection, (2) or whether to contact the Command & Control (C2) servers to download the asymmetric key pair [11].…”

Developing malware evaluation infrastructure

“…Analysis of few more CryptoWall samples showed that these lists of proxies contain many infected servers, and these lists are centrally managed by attackers. Detailed description of this network activity and results from its initial analysis can be found in [4].…”

“…The ARTA has a dedicated subnet with a set of HoneyPots and a DNS redirecting the whole traffic to these HoneyPots. The malware sample is executed within the dynamic evaluation system Maltester (see [4]). Moreover, the whole system is remotely controlled with dedicated the Web application.…”