Malware Flashcards
Malware
Software designed to infiltrate a computer system and possibly damage it without the user’s knowledge or consent
Malware Types
- Viruses
- Worms
- Trojan horses
- Ransomware
- Spyware
- Rootkits
- Spam
Virus
Malicious code that runs on a machine without the user’s knowledge and infects the computer when executed
Viruses require a user action in order to reproduce and spread
Boot sector Virus
Boot sector viruses are stored in the first sector of a hard drive and are loaded into memory upon boot up
Macro
Virus embedded into a document and is executed when the document is opened by the user
Program Virus
Program viruses infect an executable or application
Multipartite Virus
Virus that combines boot and program viruses to first attach itself to the boot sector and system files before attacking other files on the computer
Encrypted Virus
An encrypted virus is a computer virus that encrypts its payload with the intention of making detecting the virus more difficult
Polymorphic Virus
an encrypted virus that changes itself every time it is executed by altering the decryption module to avoid detection
Metamorphic Virus
Virus that is able to rewrite itself entirely before it attempts to infect a file (advanced version of polymorphic virus)
Stealth Virus
Virus that uses various mechanisms to avoid detection by antivirus software
Armored Virus
Armored viruses have a layer of protection to confuse a program or person analyzing it
Worm
§ Malicious software, like a virus, but is able to replicate itself without user interaction
§ Worms self-replicate and spread without a user’s consent or action
§ Worms can cause disruption to normal network traffic and computing activities
Trojan Horse
Malicious software that is disguised as a piece of harmless or desirable software
Remote Access Trojan (RAT)
Provides the attacker with remote control of a victim computer and is the most commonly used type of Trojan
Ransomware
§ Malware that restricts access to a victim’s computer system until a ransom is received
§ Ransomware uses a vulnerability in your software to gain access and then encrypts your files
Spyware
§ Malware that secretly gathers information about the user without their consent
§ Captures keystrokes made by the victim and takes screenshots that are sent to the attacker
Adware
Displays advertisements based upon its spying on you
Grayware
Software that isn’t benign nor malicious and tends to behave improperly without serious consequences
Rootkits Types
Rootkits
DLL Injection
Driver Manipulation
Rootkit
§ Software designed to gain administrative level control over a system without detection
§ DLL injection is commonly used by rootkits to maintain their persistent control
DLL Injection
Malicious code is inserted into a running process on a Windows machine by taking advantage of Dynamic Link Libraries that are loaded at runtime
Driver Manipulation
§ An attack that relies on compromising the kernel-mode device drivers
that operate at a privileged or system level
§ A shim is placed between two components to intercept calls and redirect
them
