Malware Flashcards
What information does static analysis provide?
File type
File hash
Strings
Embedded Elements Packer information
Imports / exports
Benefits of static analysis
Speed
Safety
Comprehensive Insight
Detection of known threats
Limitations of black box
Inability to detect runtime behavior
complexity with Obfuscation
False Positives
What are the Five Ws of analysis
Who
What
When
Where
Why
Types of destructive malware?
Ransomware
Wiper
Virus
Worm
Spyware
First step before extracting malware?
Create an image of the HDD.
What is whiteboxing? and What Ws are covered
Reverse Engineering code of malware … which is Who and Why
Spyware
Monitors user activity and collects personal information without consent
Botnet?
Network of infected computers controllected by an attacker to perform coordinated tasks
Keyloggers?
…
What is blackboxing?
…
What is motive types? (Why)
Financial gain
Hacktivism
Corporate Espionage
Curiosity/Challenge
State
Personal Vendetta
Victims (Who?)
Individuals
Corporations
Governments
Non-Profits
Methods (How and Where)
Phishing
Malware
Exploiting Vulnerabilities
Insider Threats
Timeline (When?)
Often over extended timelines due to delayed detection
Malware Symptoms
Slow
Freezing or Crashing
Diminished Storage Space
Popups
Deleted or modified files
New programs or icons
changes in security setting
unusual network activity
browser changes
programs running without consent
error messages
suspicious applications
Malware Spreading Techiques
Phishing attacks
malvertising
Drive-by downloads
Social Engineering
Malicious Links in Social Media
Software Bundling
Remote Desktop Protocol (RDP)
Lateral Movement
Typosquatting
involving registering domains name is similar to legitimate sites hoping users will mistype
Torrents / Peer to Peer Sharing
disguised malware as pirated content
Infected Removable Media
malware is spread through removable media
Exploiting Unpatched Vulnerabilities
unpatched vulnerabilities using exploit kits designed for this purpose
ransomware
encrypts files and demands payments for decryption
Wiper
Deletes data rather than holding it for ransom
Viruses
Attaches itself to legitimate programs and replicates to infect other files
