Cryptocurrency based malware and ransomware detection systems and methods
Cryptocurrency based malware and ransomware detection systems and methods are disclosed herein. An example method includes analyzing a plurality of malware or ransomware attacks to determine cryptocurrency payment address of malware or ransomware attacks, building a malware or ransomware attack database with the cryptocurrency payment addresses of the plurality of malware or ransomware attacks, identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database, and denying the proposed cryptocurrency transaction.
1. A method for cryptocurrency-based malware detection, the method comprising:
analyzing a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
based on the analyzing:
identifying a uniform resource locator (URL) of a decryptor download site of the cryptocurrency-based malware or ransomware attack; and
identifying a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
identifying additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
storing the additional cryptocurrency addresses to a malware or ransomware attack database;
tracing a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
based on the tracing of the ransom payment paid to the cryptocurrency payment address, storing the cryptocurrency payment address in the malware or ransomware attack database; and
identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database.
2. The method according to claim 1 , further comprising determining whether a receipt or a decoder link for the cryptocurrency-based malware or ransomware attack is available.
3. The method according to claim 2 , further comprising:
based on determining that the receipt or the decoder link is available, obtaining the sample code of the cryptocurrency-based malware or ransomware attack.
4. The method according to claim 1 , further comprising blocking the identified proposed cryptocurrency transaction.
5. The method according to claim 1 , further comprising assigning a risk level to the proposed cryptocurrency transaction based on an activity related to the address.
6. The method according to claim 1 , further comprising alerting a cryptocurrency exchange in real-time when the proposed cryptocurrency transaction including the address is initiated.
7. The method according to claim 1 , further comprising:
finding related addresses of the address; and
storing the related address in the malware or ransomware attack database.
8. A system, comprising:
a processor; and
a memory for storing instructions, the processor executing the instructions to:
analyze a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
based on the analyzing:
identify a uniform resource locator (URL) of a decryptor download site of the cryptocurrency-based malware or ransomware attack; and
identify a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
identify additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
store the additional cryptocurrency addresses to a malware or ransomware attack database;
trace a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
based on the tracing of the ransom payment paid to the cryptocurrency payment address, store the cryptocurrency payment address in the malware or ransomware attack database; and
identify a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database.
9. The system according to claim 8 , wherein the processor further executes the instructions to determine whether a receipt or a decoder link for the cryptocurrency-based malware or ransomware attack is available.
10. The system according to claim 9 , wherein the processor further executes the instructions to: based on determining that the receipt or the decoder link is available, obtain the sample code of the cryptocurrency-based malware or ransomware attack.
11. The system according to claim 8 , wherein the processor further executes the instructions to block the identified proposed cryptocurrency transaction.
12. The system according to claim 8 , wherein the processor further executes the instructions to assign a risk level to the proposed cryptocurrency transaction based on an activity related to the address.
13. The system according to claim 8 , wherein the processor further executes the instructions to alert a cryptocurrency exchange in real-time when the proposed cryptocurrency transaction including the address is initiated.
14. The system according to claim 8 , wherein the processor further executes the instructions to:
find related addresses of the address; and
store the related address in the malware or ransomware attack database.
15. A method for cryptocurrency-based malware detection, the method comprising:
analyzing a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
based on the analyzing, identifying a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
identifying additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
storing the additional cryptocurrency addresses to a malware or ransomware attack database;
tracing a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
based on the tracing of the ransom payment paid to the cryptocurrency payment address, storing the cryptocurrency payment address in the malware or ransomware attack database;
identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database; and
denying the proposed cryptocurrency transaction.
16. The method according to claim 15 , further comprising determining whether a receipt or a decoder link for the cryptocurrency-based malware or ransomware attack is available.
17. The method according to claim 16 , further comprising:
based on determining that the receipt or the decoder link is available, obtaining the sample code of the cryptocurrency-based malware or ransomware attack.
18. The method according to claim 15 , further comprising blocking the identified proposed cryptocurrency transaction.
19. The method according to claim 15 , further comprising assigning a risk level to the proposed cryptocurrency transaction based on an activity related to the address.
20. The method according to claim 15 , further comprising alerting a cryptocurrency exchange in real-time when the proposed cryptocurrency transaction including the address is initiated.