Ransomware detection

Ransomware is classified as a category of malicious software (often reffered to as malware), which is designed to perform changes on the targeted sytem (e.g. encrypt certain files), and subsequently demand a payment of ransom, which is promised to result in restoring the system state (for instance by decrypting the once encrypted files). This thesis provides information on ransomware from the attackers’ viewpoint, including their motivation and money laundering schemes typical for the industry, and methods used by attackers to evade detection and analysis. Further, common ransomware distribution and detection are described, together with technical analyses of selected recent well-known ransomware attack, i.e. WannaCry, CryptoLocker and NotPetya. Main focus of this thesis is open-source tools which can be leveraged for ransomware detection, and their usage in Proof-of-Concept type of solutions. Author presents a few of solutions he created which were designed to detect and in some cases mitigate particular ransomware families attacks. These solution can be useful for entities like small businesses, which could find commercial solutions focused on this area too costly or too complex in terms of implementation and maintenance.