CH03 Maware Infections

Question 1

What is a threat vector ?

Answer 1

method used by an attacker to access a victim’s machine. How the attacker get to the machine itself

Question 2

What is Attack Vector?

Answer 2

method used by an attacker to gain access to an victim’s machine in order to infect it with malware. It includes both the way attacker got to the machine and how they are going to infect it

Question 3

What is Watering hole?

Answer 3

Malware is placed on a website that you know your potential victims will access

Question 4

What is Typosquatting ?

Answer 4

url with very similar address as the real one. Ex: amazon.com vs. amazonS.com

Question 5

What is a zombie ?

Answer 5

victimized computer whose control is under the attacker

Question 6

What is Botnet

Answer 6

A collection of compromised computers under the control of a master node

Question 7

What is Command and Control (C2)

Answer 7

node that controls hundreds of other computer that are part of their botnet

Question 8

What is Active Interception ?

Answer 8

Occurs when a computer is placed between the sender and receiver and is able to capture or modify the traffic between them. Someone sending out false wifi network pretending to be public hotspot.. and all my network traffic goes through the attacker’s computer. He can capture whatever I am doing

Question 9

What is Privilege Escalation ?

Answer 9

Occurs when you are able to exploit a design flaw or bug in a system to gain access to resources that a normal user isn’t able to access. You are gaining access to a system as another user and finding ways to escalate their privilege to an admin role.

Question 10

What are Backdoors ?

Answer 10

Backdoors are used to bypass normal security and authentication functions. Remote Access Trojan (RAT) acts like a backdoor by granting attacker a persistent access

Question 11

What is an Ester Egg ?

Answer 11

Non-malicious code that when invoked, displays an insider joke, hidden message, or secret feature

Question 12

What is Logic Bomb ?

Answer 12

malicious code that has been inserted inside a program and will execute only when certain conditions have been met.

Question 13

What is dropper and downloader?

Answer 13

one of the exploitation techniques used by APT (Advanced Persistent Threat).

running lightweight shell code on your system which will download the rest of the code

Dropper - Malware designed to install or run other types of malware embedded in a payload on an infected host. They are usually a stage one dropper, it’s that cod you first get. And once you get that code and run it, it then goes out to get some other code using its own downloader

Downloader - a piece of code that connects to the internet to retrieve additional tools after the initial infection happens by a dropper.

Droppers are likely to implement anti-forensics techniques to prevent detection and analysis…. Such as encrypting their payloads, or compressing their payloads, or obfuscating their payloads, which makes reverse engineering a lot harder

Question 14

What is Code Injection ?

Answer 14

Exploit technique that runs malicious code with the identification number of a legitimate process

Question 15

What is Masquerading ?

Answer 15

dropper replaces a genuine executable with a malicious one

Question 16

What is DLL injection ?

Answer 16

dropper starts forcing a process to load as part of the DLL.

Question 17

What is DLL sideloading

Answer 17

dropper is going to exploit a vulnerability in a legitimate program’s manifest to load malicious DLL at runtime

Question 18

What is Process hollowing ?

Answer 18

dropper starts a process in a suspended state and then rewrites the memory locations containing the process code with the malware code. We’re taking over some place in memory and putting our malicious code in there

Question 19

What is Living off the Land ?

Answer 19

exploit techniques that use standard system tools and packages to perform intrusions.

very difficult to find them.

For example, they might use something like a PowerShell to do malicious activities. Detection of an adversary is more difficult when they are executing malware code within standard tools and processes (living off the land).