Dissecting .NET ransomware: key generation, encryption and operation. Issue 2 (February 2020)

• Record Type: Journal Article
• Authors: Bajpai, Pranshu; Enbody, Richard
• Is Part Of: Network security. Volume 2020:Issue 2(2020)
• Page Start: 8
• Page End: 14
• Publication Date: 2020-02
• Subjects: Computer security -- Periodicals; Computer networks -- Security measures -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; Computers -- Access control -- Periodicals; 005.805
• DOI: 10.1016/S1353-4858(20)30020-9
• Languages: English
• ISSNs: 1353-4858

Abstract

Abstract : The threat of ransomware is ever growing. Not all ransomware types are created equal and the cryptosystems in some forms are more virulent than others. This article dissects eight real-world variants belonging to different families of .NET ransomware and provides insights into key generation, encryption and other aspects of the ransomware kill chain. We also summarise ransomware execution flow and dynamic library calls based on the collected evidence. While this analysis was carried out using .NET ransomware samples, the lessons learned from the empirical evidence apply to all modern forms of ransomware and can be used for building more effective ransomware solutions. The threat of ransomware is ever-growing, but not all ransomware types are created equal. The cryptosystems in some forms are more virulent than others. Pranshu Bajpai and Richard Enbody at Michigan State University dissect eight real-world variants belonging to different families of .NET ransomware and provide insights into key generation, encryption and other aspects of the ransomware kill chain. They also summarise ransomware execution flow and the use of dynamic library calls. The lessons learned apply to all forms of ransomware and can be used for building more effective ransomware solutions.