A NEW ANALYSIS OF CRYPTOLOCKER RANSOMWARE AND WELCHIA WORM PROPAGATION BEHAVIOR. SOME APPLICATIONS. III

In this paper we receive new models that in some situations can be applied to model computer viruses propagation. Welchia worm and Cryptolocker ransomware have a long growing phase in contrast to many other threats. In September 2013 the CryptoLocker malware starting its invasion using mainly P2P ZeuS (aka Gameover ZeuS) malware. CryptoLocker’ main aim was to receive money from the unsuspecting victims for decrypting their files. Welchia worm uses a vulnerability in the Microsoft remote procedure call service. Welchia firstly checks for Blaster worm and if it is exists continues with Blaster deletion as well as takes care for computer to be immunised for Blaster worm. Also we modeled Malicious high–risk Android App volume growth; Malware evolution; Number of users attacked by Trojan-Ransom malware; Number of users attacked by crypto-ransomware; Number of unique users attacked by Trojan-Ransom.AndroidOS.Fusob; and ”Seasonal data”. As the authors in [3] mention: “Even traffic traces used in research papers (e.g. Slammer [4] and Code-red [5]) are not public. From the published papers [4], [5] we are not able to find parameters that can be used in our model”. Many researchers make a hard efforts to describe adequately situation connected to worm propagation [15]–[63]. AMS Subject Classification: 97N50 360 N. KYURKCHIEV, A. ILIEV, A. RAHNEV, AND T. TERZIEVA