1. Malware and IOC Flashcards
malware
Software designed for some nefarious purpose.
polymorphic malware
It changes its code after each use, making each replicant different from a detection point of view.
virus
A piece of malicious code that replicates by attaching itself to another piece of executable code.
armored malware
The process of making malware more difficult to reverse engineering, such as encryption.
crypto-malware
Malware that encrypts files on a system and leaves them unusable, permanently or until some ransom paid.
worm
Pieces of code that attempt to penetrate networks and computer systems. Once in, it will create a new copy of itself on the system. Does not rely on attachment to another piece of code or file. It can “survive” on its own.
trojan horse
A software that appears to do one thing (and often does), but hides some other functionality. A standalone program that must be copied and installed by the user.
define: rootkit
Malware that is designed to modify the operation of the operating system to facilitate nonstandard functionality. It can do virtually anything the OS does. It can modify the system kernel and supporting functions.
describe: rootkit forms
It can load before the OS loads, acting as a virtualization layer. They can exist in firmware of video cards and expansion cards. They can exist as a loadable library module, changing ports of the OS from outside the kernel.
list: 5 types of rootkits
firmware virtual kernel library application
adware
Software supported by advertising.
spyware
Software that spies on users, recording and reporting on their activities.
bot
A piece of software that performs some task, under the control of another program.
define: RAT
Remote access trojan - a toolkit that provides the capability of covert surveillance and/or the ability to gain unauthorized access.
distinction of RAT
Rather than being just a program, there is an operator behind it, guiding it to do more persistent damage.
They typically involve the creation of hidden file structures on a system and are vulnerable to detection.
