1.1 Malware Flashcards
Given a scenario, analyze indicators of compromise and determine the type of malware
Virus
Viruses are programs that are designed to spread from one system to another through self-replication and to perform any wide range of malicious activities.
Crypto-Malware
Crypto-Malware is any form of malware that uses cryptography as weapon of defense
Ransomeware
Ransomeware is a form of malware that aims to take over a computer system in order to block its use while demanding payment
Worms
Worms are designed to exploit a single flaw in a system (operating system, protocol, service, or application) and then use that flaw to replicate themselves to other systems with the same flaw.
Trojan Horses
A Trojan Horse is a form if malicious software that is disguised as something useful or legitimate.
Rootkits
A rootlet is a type of malicious code that fools the OS into thinking that active processes and files don’t exist. Rootkits render a compromised system completely untrustworthy
Keyloggers
A keylogger is a form of malware that records the keystrokes typed into a system’s keyboard.
Spyware & Adware
Spyware gathers information about users and may employ that information to customize advertisements or steal identities. Adware gathers information about users and uses it to direct advertisements to the user. Both spyware and adware are usually unwanted software that gathers information without authorization.
Botnets
A botnet is a network of robots or malicious software agents controlled by a hacker in order to launch massive attacks against targets
RAT
A Remote-Access Trojan (RAT) is a form of malicious code that grants an attacker some level of remote-control access to a compromised system
Logic Bomb
A logic Bomb is a form of malicious code that remains dormant until a triggering event occurs. The triggering event can be a specific time and date, the launching of a specific program, or the accessing of a specific URL =.
Backdoor Attacks
There are two types of backdoor attacks: a developer-installed access method that bypass any and all security restrictions, or a hacker-installed remote access client.
Understanding Malicious Code
The best countermeasure to viruses an other malicious code is an anti-virus scanner that is updated regularly ad that monitors all local storage devices, memory, and communication pathways for malicious activity. Other countermeasures include avoiding downloading software from the internet, not opening email attachments, and avoiding the use of removable media from other environments
