Lakhasly

2.1.AIDS Trojan, also called PC Cyborg, was the first ransomware 328 International Journal of Communication Networks and Information Security (IJCNIS) Vol.On each infected system, it displayed a loving poem, "It will get on all your disks; It will infiltrate your chips; Yes, it's Cloner!" [14]. Basit and Amjad, two Pakistani brothers, developed Brain Boot Sector Virus in 1986 to infect MS-DOS computers, which was the first virus to infect the MS-DOS system [15]. They designed this virus to test their company's software and to prove that it was not a secure platform. This virus was replicating with the help of a floppy disk. Authors designed this virus to point out loopholes in their system rather than cause damage or harm to the system. PCwrite Trojan was one of the earliestTrojans designed in 1986 to erase all the user files once affected [16]. It was spreading through a shareware program called PC-Writer [17]. In 1988, Robert Tappan Morris, a graduate student at Cornell, drafted a program that would check a computer system's configuration to jump from one computer to another utilizing UNIX's sendmail program and the Internet's SMTP protocol [18]. It caused an increase in network traffic and eventually caused the Internet to crash at that time. Morris was arrested for creating this worm and convicted by the Computer Fraud and Abuse Act from 1986 [19]. Stoned is a boot sector virus that appeared in 1987 and infected floppy disks. It would sometimes display a message on the infected machine upon startup that would read: "Your computer is now stoned" [20].An accepted definition of a computer virus was crafted by Fred Cohen to be "a program that can infect other programs by modifying them to include a possibly evolved copy of itself" [9]. Viruses can spread throughout a computer system or network. The difference between viruses and worms is that a virus usually requires human interference such as opening an infected file to start replicating, whereas worms can replicate without an intervention [10]. A common characteristic for malware in this phase is that they do not try to remain hidden from the user. Most would display a message or image on the computer's screen. The first instance of a worm was developed by Robert H Thomas in 1971 and was called Creeper worm. It could move from one system to another and display a message that read "I'm the creeper: catch me if you can" [11].The mutation engine or Dark Avenger Mutation Engine (DAME), a toolkit from Virus Creation Laboratory, was the next innovative step in malware evolution [25].Elk Cloner is one of the first epidemic self-replicating viruses developed by a 15-year old named Richard Skrenta to infect PCs.Early Phases of Malware Evolution (1949 - 1991) Nowadays, malware is the most significant threat faced by the modern digital world.John Von Neumann introduced the first virus as an idea of "self-replicating string of code" in 1949. He designed a "self-reproducing automata", which was able to transform a new version by itself [8].

2.1. Early Phases of Malware Evolution (1949 - 1991)
Nowadays, malware is the most significant threat faced by the
modern digital world. Initially, the intention of malware was
not to harm, steal, or manipulate, but it evolved into becoming
dangerous threats to our society. Here we are going to discuss
some of the malware designed in the early phases of its
evolution. John Von Neumann introduced the first virus as an
idea of “self-replicating string of code” in 1949. He designed
a “self-reproducing automata”, which was able to transform a
new version by itself [8].
Most of the malware in the early phases was not developed to
harm the system or steal data. It was mainly used to point out the
loopholes in MS-DOS systems. The payload caused by malware
in this phase was a temporary crash in the system due to the
consumption of the system resources. Viruses and worms in this
phase have propagated through infected floppy drives or the
ARPANET. An accepted definition of a computer virus was
crafted by Fred Cohen to be “a program that can infect other
programs by modifying them to include a possibly evolved copy
of itself” [9]. Viruses can spread throughout a computer system or
network. The difference between viruses and worms is that a virus
usually requires human interference such as opening an infected
file to start replicating, whereas worms can replicate without an
intervention [10]. A common characteristic for malware in this
phase is that they do not try to remain hidden from the user. Most
would display a message or image on the computer’s screen.
The first instance of a worm was developed by Robert H Thomas
in 1971 and was called Creeper worm. It could move from one
system to another and display a message that read “I’m the
creeper: catch me if you can” [11]. Wabbit is a self-replicating
program developed in 1974 to reduce sys- tem performance and
ultimately crash the system. The name Wabbit (rabbit) came from
the speed at which it replicates [12]. Wabbit was only capable of
infecting the system it was installed on [13].
Elk Cloner is one of the first epidemic self-replicating viruses
developed by a 15-year old named Richard Skrenta to infect
PCs. On each infected system, it displayed a loving poem, “It
will get on all your disks; It will infiltrate your chips; Yes, it’s
Cloner!” [14]. Basit and Amjad, two Pakistani brothers,
developed Brain Boot Sector Virus in 1986 to infect MS-DOS
computers, which was the first virus to infect the MS-DOS
system [15]. They designed this virus to test their company’s
software and to prove that it was not a secure platform. This virus
was replicating with the help of a floppy disk. Authors designed
this virus to point out loopholes in their system rather than cause
damage or harm to the system. PCwrite Trojan was one of the
earliestTrojans designed in 1986 to erase all the user files once
affected [16]. It was spreading through a shareware program
called PC-Writer [17]. In 1988, Robert Tappan Morris, a graduate
student at Cornell, drafted a program that would check a computer
system’s configuration to jump from one computer to another
utilizing UNIX’s sendmail program and the Internet’s SMTP
protocol [18]. It caused an increase in network traffic and
eventually caused the Internet to crash at that time. Morris was
arrested for creating this worm and convicted by the Computer
Fraud and Abuse Act from 1986 [19].
Stoned is a boot sector virus that appeared in 1987 and infected
floppy disks. It would sometimes display a message on the infected
machine upon startup that would read: “Your computer is now
stoned” [20]. Stoned virus has spawned many variants, one of these
appeared in 1991, and was called Monkey. Monkey infects the
master boot record of hard drives and floppies. It would embed its
code into the first block of the master boot record and place the
master boot record in the third block. The affected system would
usually boot except in the case of booting from a floppy disk [21].
AIDS Trojan, also called PC Cyborg, was the first ransomware
328
International Journal of Communication Networks and Information Security (IJCNIS) Vol. 12, No. 3, December 2020
released in 1989 [22]. Joseph L. Popp designed it, and it was
comparatively easy to break. He made this attack by
distributing infected floppy disks to AIDS researchers at the
World Health Organization’s conference for AIDS research.
Simple symmetric cryptography was used in this malware
[23].
One of the fascinating viruses created after Brain Boot Sector
Virus was the Omega virus, which affected the boot sector of
the system. An infected system could not boot on Friday the
13th, however, on all the other days, the system would
function normally. Michelangelo designed a virus in 1991 as
his name to affect DOS systems. Since it redrafts the first 100
sectors of hard disk, the file allocation table would be
destroyed, and the PC will not boot. The system would get
infected with the virus, on March 6th, which is the author’s
birthday [7].
Casino virus was a fascinating virus that originated at the start
of 1991. It would infect command.com in C drive root
directory. When a system is affected by this virus, the user
will get the following message: “I have just DESTROYED
the FAT on your Disk!! However, I have a copy in RAM, and
I’m giving you a last chance to restore your precious data.
WARNING: IF YOU RESET NOW, ALL YOUR DATA
WILL BE LOST - FOREVER!! Your Data depends on a
game of JACKPOT”. If the user loses the game, the FAT table
would be destroyed [24]. The mutation engine or Dark
Avenger Mutation Engine (DAME), a toolkit from Virus
Creation Laboratory, was the next innovative step in malware
evolution [25]. It introduced mutation functionality to
existing viruses to make it difficult to detect by anti-virus
software. Table 1 summarizes the malware in this phase.