Detecting Malware

Question 1

What are some infection vectors?

Answer 1

• Emails
• Drive-by Downloads
• Vulnerabilities in software/OS

Question 2

How do you detect malware?

Answer 2

Using antivirus software that identifies and removes malware and also tries to stop users from getting infected in the first place.

Question 3

What are virus dictioanries?

Answer 3

A large dictionary of signatures of known malware, used to compare with files - but what if malware is polymorphic and metamorphic?

Question 4

What is a safe analysis environment?

Answer 4

It is to create a virtual machine and running the suspected program in the VM and then examined and monitored for malware-like behavior/changes (indicators of compromise).

Question 5

What are the two Anti-VM techniques?

Answer 5

Checking for IO ports and determining Hypervisor brand using CPUID.

Question 6

What is the preliminary analysis technique?

Answer 6

• Isolate
• Unpack
• Submit to VirusTotal

Question 7

Why are malware becoming multi-staged?

Answer 7

Multi-staged malware is much harder to identify as they drop multiple files each time and have different payloads for different purposes.