Chapter 6 - Malicious Code Activity Flashcards
Does a virus have to be executed to infect a system?
yes - simply downloading malware does not execute/deliver the payload
What are Stealth Viruses?
Stealth Viruses hide themselves from AV by providing AV with misleading information such as misreporting file size when the file executes.
What are Armoured Viruses?
Armoured viruses make it difficult for researchers to reverse-engineer virus code.
This is done through the use of compilers in conjunction with encryption to make code decryption difficult.
What are Polymorphic Viruses?
Polymorphic viruses mutate each time they replicate through different encryption means each time a virus executes.
This makes IOC detection difficult for AV as IOC for each virus would be different from each other even though purpose remains the same.
What are Metamorphic Viruses?
Metamorphic viruses actually alter their code slightly when they replicate / execute.
This alters a number of things for the virus and makes detection more difficult.
What are Boot-Sector viruses?
Boot sector viruses reside in the device’s boot sector and executes when the system is booted/rebooted.
What are Multipartite Viruses?
Multipartite viruses are multi-dimensional viruses such as a boot-sector virus infecting different files and have metamorphic capabilities.
What are Macro Viruses?
Macro Viruses reside in MS Office document as a macro function.
What are Worms?
Worms travel along a network looking for hosts to infect and they typically do not need user interaction to execute.
What are Trojan Horses?
Trojan Horse are malicious applications masquerading as something benign and safe.
Many trojans install a RAT once a system is infected.
What are Remote Access Tools (RATs)?
Remote Access Tools grant attackers access to a system remotely via the internet.
What are Scareware?
Scareware are malware that disguises themselves as AV software instructing the user to install the software / pay for services they do not need.
Scareware can be RATs, Trojans, worms - the scareware part is simply a delivery method.
What are Logic Bombs?
Logic Bombs are malware that executes when certain defined criteria are met such as time, date, system the malware reaches etc.
Keyloggers can have a logic bomb capability where it sends data once it detects that the user is on a banking website.
What are Ransomware?
Ransomware is malware that blackmails the user to handing over sums of money in exchange for decrypting their systems, promising not to expose sensitive information etc.
This type of attack will typically have a time component to instil panic for the user.
What are keyloggers?
Keyloggers are software/hardware based tools that captures a system’s keystrokes.
Data is then exfiltrated out to the attacker.
