Home » machine learning

A Closer Look at the Locky Poser, PyLocky Ransomware

Posted on:September 10, 2018 at 5:02 am
Posted in:Ransomware, Spam
Author:
Trend Micro

While ransomware has noticeably plateaued in today’s threat landscape, it’s still a cybercriminal staple. In fact, it saw a slight increase in activity in the first half of 2018, keeping pace by being fine-tuned to evade security solutions, or in the case of PyLocky (detected by Trend Micro as RANSOM_PYLOCKY.A), imitate established ransomware families and ride on their notoriety.

In late July and throughout August, we observed waves of spam email delivering the PyLocky ransomware. Although it tries to pass off as Locky in its ransom note, PyLocky is unrelated to Locky. PyLocky is written in Python, a popular scripting language; and packaged with PyInstaller, a tool used to package Python-based programs as standalone executables.

Posted on:June 7, 2018 at 3:30 am
Posted in:Bad Sites, Machine Learning
Author:
Trend Micro Forward-Looking Threat Research Team

The ACM ASIA Conference on Computer and Communications Security (ACM ASIACCS) is an avenue for cybersecurity research breakthroughs, techniques, and tools. At the ACM ASIACCS 2018 in Incheon, South Korea, we presented our research using DefPloreX-NG, a tool for identifying and tracking web defacement campaigns using historical and live data. “DefPloreX-NG” is a play on the phrase “defacement explorer.” The appended “NG” acronym means “Next Generation,” signifying improvements from the previous version of the tool. DefPloreX-NG is equipped with an enhanced machine learning algorithm and new visualization templates to give security analysts and other professionals a better understanding of web defacement campaigns.

Posted on:April 12, 2018 at 5:00 am
Posted in:Malware
Author:
Marco Balduzzi (Senior Threat Researcher)

In this blog post, we will discuss how we developed a human-readable machine learning system that is able to determine whether a downloaded file is benign or malicious in nature.

The development of this actionable intelligent system stemmed from the question: How can we make our knowledge about global software download events actionable? More specifically, how can we use such information to do a better job at detecting the threats posed by the large amounts of new malicious software circulating on a daily basis?

In this last installment of this blog series, we will answer such questions and give a summary of what we did with the information we’ve obtained. Our research paper titled Exploring the Long Tail of (Malicious) Software Downloads provides a more comprehensive look into how we’ve gathered and analyzed our software downloads data.

Posted on:March 26, 2018 at 5:00 am
Posted in:Malware
Author:
Trend Micro

As new trends and developments in the malicious mining of cryptocurrency emerge, a smart and sustainable way of detecting these types of threats is swiftly becoming a cybersecurity necessity. By using Trend Micro Locality Sensitive Hashing (TLSH), a machine learning hash that is capable of identifying similar files, we were able to group together similar cryptocurrency-mining samples gathered from the wild. By grouping together samples based on their behavior and file types, detection of similar or modified malware becomes possible.

Posted on:February 7, 2018 at 5:00 am
Posted in:Malware
Author:
Marco Balduzzi (Senior Threat Researcher)

Cybercriminals are constantly looking for new strategies to defeat security solutions and improve the success of their attacks.

The increase in adoption of polymorphism and packing has made traditional signature-based detection at the client side (endpoint) obsolete. Backend systems struggle in analyzing modern malware since both static and dynamic analysis are limited when heavily obfuscated code or anti-sandboxing techniques are employed. In addition, the number of newly discovered threats is increasing, and faster detection systems are required to protect users around the world.

Page 1 of 212

A Closer Look at the Locky Poser, PyLocky Ransomware

Using Insights From DefPloreX-NG to Thwart Web Defacement Attacks

Uncovering Unknown Threats With Human-Readable Machine Learning

Cluster of Coins: How Machine Learning Detects Cryptocurrency-mining Malware

Detecting New Threats via Contextual Information and Reputation

Security Predictions for 2018

Business Process Compromise

Stay Updated

A Closer Look at the Locky Poser, PyLocky Ransomware

Using Insights From DefPloreX-NG to Thwart Web Defacement Attacks

Uncovering Unknown Threats With Human-Readable Machine Learning

Cluster of Coins: How Machine Learning Detects Cryptocurrency-mining Malware

Detecting New Threats via Contextual Information and Reputation

Security Predictions for 2018

Business Process Compromise

Popular Posts

Stay Updated