Domain 1.1 - Given a scenario, analyze indicators of compromise and determine the type of malware. Flashcards
Describe an Armored Virus
Armored viruses cover themselves with protective code that stops debuggers or disassemblers from examining critical elements of the virus.
Describe a Companion Virus
A companion virus attaches itself to legitimate programs and then creates a program with a different filename extension.
What does a Macro Virus affect?
Affects Microsoft office products (Word, Excel, etc.)
What does a Multipartite Virus infect?
It may attempt to infect your boot sector, infect all of your executable files, and destroy your application files
How do you remove a Phage Virus?
The only way to remove this virus is to reinstall the programs that are infected.
Describe a Polymorphic Virus
Polymorphic viruses and polymorphic malware of any type change form in order to avoid detection.
What does Retrovirus attack?
A retrovirus attacks or bypasses the antivirus software installed on a computer
A stealth virus attempts to avoid detection by ________ itself from applications.
Masking
It may attach itself to the boot sector of the hard drive.
What does Ransomware Do?
RansomWare encrypts your hard drive. Then a third party requests payment to decrypt it. Usually through Bitcoin.
What is the key feature of a worm?
A worm is Self-Replicating
What is a Trojan?
A virus disguised as a legitimate program.
What is a RAT?
A Remote Access Trojan.
What is the goal of a RootKit?
The goal of a rootkit is to gain root access to a computer. In order to gain Escalated Privileges.
What does a Key logger do?
It logs every key stroke and mouse click on an infected system. It then sends that info to the threat actor.
What does Spyware do?
monitors your activity then sends it back to whoever created the software.
DoS stands for
Denial of service
How is a DoS attach different from a DDoS?
DoS is done with a single computer. A distributed Denial of service or DDoS is a denial of service using multiple computers to attack the target.
What triggers a Logic Bomb?
Either a specific action, or timer.
For instance: Open a spreadsheet and go to the internet.
What is a BackDoor?
The person who wrote the software intentionally or accidentally left a way for them to get back into the Kernel/Core of the software.
An alert signals you that a server in your network has a program running on it that bypasses authorization. Which type of attack has occurred?
A. DoS
B. DDoS
C. Backdoor
D. Social engineering
An alert signals you that a server in your network has a program running on it that bypasses authorization. Which type of attack has occurred?
C. Backdoor
You’re explaining the basics of security to upper management in an attempt to obtain an increase in the networking budget. One of the members of the management team mentions that they’ve heard of a threat from a virus that attempts to mask itself by hiding code from antivirus software. What type of virus is she referring to?
A. Armored virus
B. Malevolent virus
C. Worm
D. Stealth virus
You’re explaining the basics of security to upper management in an attempt to obtain an increase in the networking budget. One of the members of the management team mentions that they’ve heard of a threat from a virus that attempts to mask itself by hiding code from antivirus software. What type of virus is she referring to?
A. Stealth virus
Your system has just stopped responding to keyboard commands. You noticed that this occurred when a spreadsheet was open and you connected to the Internet. Which kind of attack has probably occurred?
A. Logic bomb
B. Worm
C. Virus
D. ACK attack
Your system has just stopped responding to keyboard commands. You noticed that this occurred when a spreadsheet was open and you connected to the Internet. Which kind of attack has probably occurred?
A. Logic bomb
What kind of virus could attach itself to the boot sector of your disk to avoid detection and report false information about file sizes?
A. Trojan horse virus
B. Stealth virus
C. Worm
D. Polymorphic virus
What kind of virus could attach itself to the boot sector of your disk to avoid detection and report false information about file sizes?
B. Stealth virus
