Lecture 6

Question 1

Malware infection can be broken into five steps what are they?

Answer 1

Delivery: How it got onto the machine.
Execution: What does the malware actually do.
Persistence: How does the malware stay on the machine after things like restarts.
Propagation: How does the malware transmit itself to other machines.
Communication: Who is the malware communicating too eg servers during existence.

Question 2

Once you have detected malware how do you share this information?

Answer 2

You create a signature. eg Yara.

Question 3

Challenges with static analysis?

Answer 3

New malware needs to be up-to-date and code obfuscation.

Question 4

What is code obfuscation?

Answer 4

The process of obscuring meaningful information. Eg packing or encryption.