Malware Flashcards
Malware is….
Any software that has been created to damage, disable, or produce an unwanted condition within a computer system.
A virus is…
Intentionally malicious code
Worm
Self-replicating
Trojan
Malware hidden in legitimate files
RAT
Remote access trojan
Keylogger
Logs keystrokes and sends to a controller for credential theft
Rootkit
Parts of or the entire bootloader has changed
What defeats rootkits?
Secure boot
Firmware Rootkit
Operates lower than a bootloader. Overwrites the firmware of the BIOS so that the malware is persisted before the bootloader starts.
Kernel Rootkit
Malicious drivers/kernel modules
Application rootkit
Modification of regular files to hide malicious activity
Memory rootkit
FIleless process running in memory.
Backdoor
Persistent control of a system by offering recurring access to an attacker.
Ransomware.\
Encrypts a victims files
File wipers
Destructive malware that destroys or corrupts files.
Who are you defending against in malware?
A human adversary, not a piece of software.
What was the first worm to garner public attention?
The morris worm
When was the morris worm created?
1988
Who created the morris worm?
Robert Tappan Morris
What was Morris charged with?
Computer Fraud and Abuse Act.
Stuxnet.
The first digital weapon, used to target an Iranian nuclear facility in 2010
WannaCry
Widespread ransomware worm in 2017
NotPetya
Ransomware by Russian military against Ukraine in 2017
What are the two types of ransomware encryption techniques?
Hard coded keys - key is easily discoverable.
Client generated keys - Still easily discoverable, but key is not reusable to decrypt all infections.
Key -> server - Generate key during infection, and send to server for storage. Hard to discover.
Bake public key into ransomware & store private on server
Bake public key into the client & don’t store any keys (send to server
Use a hybrid - best of all worlds
Two ways to analyze malware
Static analysis - the file
Dynamic Analysis - behavior
What is fingerprinting?
Obtaining a hash of the malicious binary
What is string extraction?
Look for malicious strings (IP, URL, etc.)
What is Packer Analysis
Looking for packed files that are hidden in other files
What is disassembly/decompilation?
Analyzing the files manually to look for malicious code.
YARA Rules
Schema to classify malware through text-based rules.
Machine Learning for malware analysis
Corpus - the set of malware trained.
Defined Point Analysis (Dynamic)
Malware is executed on a system with a known state.
Runtime behavior analysis (Dynamic)
Observe the behavior directly in a sandboxed environment.
What does modern malware do to manage its keys?
Generates a client key and uses a hardcoded server public key. This is known as the hybrid method.
What time of malware is used for cryptomining and DDoS attacks?
Botnets
When statically analyzing malware using machine learning, was must be done to the malware file before the ML model makes a decision?
FX
What malware was the first digital weapon?
Stuxnet
