• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.389-396
• /
• 2020

WannaCryptor is a type of ransomware which encrypts users' personal data or files and demands ransom payment in order to regain access. But it peculiarly spreads by itself like a Internet worm using Windows vulnerabilities of shared folder. In this paper, we analyzed and estimated the spread of WannaCryptor focusing on the wormable spread features different from the existed ransomware. Thus we observed its behaviors in virtual environments, and experimented the various spreads of WannaCryptor based on our prediction modeling.

• Smart Media Journal
• /
• v.8 no.1
• /
• pp.27-34
• /
• 2019

Ransomware is a malicious program code evolved into various forms of attack. Unlike traditional Ransomware that is being spread out using email attachments or infected websites, a new type of Ransomware, such as WannaCryptor, may corrupt files just for being connected to the Internet. Due to global Ransomware damage, there are many studies conducted to detect and defense Ransomware. However, existing research on Ransomware detection only uses Ransomware signature database or monitors specific behavior of process. Additionally, existing Ransomware detection methods hardly detect and defense a new Ransomware that behaves differently from the traditional ones. In this paper, we propose a method to detect Ransomware by arranging decoy files and analyzing the method how Ransomware accesses and operates files in the file system. Also, we conduct experiments using proposed method and provide the results of detection and defense of Ransomware in this paper.