Malware Threats Flashcards
What does the ‘Payload’ component of malware do?
The payload is the part of the malware that performs the desired activity when activated. It may be used for deleting or modifying files, degrading the system performance, opening ports, changing settings, etc., to compromise system security
What does the ‘Obfuscator’ component of malware do?
The obfuscator is a program that conceals the malicious code of malware via various techniques, thus making it difficult for security mechanisms to detect or remove it
What does the ‘Dropper’ component of malware do?
The dropper is a covert carrier of malware. Attackers embed notorious malware files inside droppers, which can perform the installation task covertly. Attackers need to first install the malware program or code on the system to execute the dropper. The dropper can transport malware code and execute the malware on a target system without being detected by antivirus scanners
What does the ‘Injector’ component of malware do?
The injector injects exploits or malicious code available in the malware into other vulnerable running processes and changes the method of execution to hide or prevent its removal
What is a crypter?
A crypter is a software program that can conceal the existence of malware. Attackers use this software to elude antivirus detection. It protects malware from reverse engineering or analysis, thus making it difficult to detect by security mechanisms
What is a packer?
A packer is software that compresses the malware file to convert the code and data of the malware into an unreadable format. It uses compression techniques to pack the malware.
What is an overt channel?
An overt channel is a legal channel for the transfer of data or information in a company network and works securely to transfer data and information
What is a covert channel?
Covert channels are methods attackers can use to hide data in an undetectable protocol. They rely on a technique called tunneling, which enables one protocol to transmit over the other. Any process or a bit of data can be a covert channel. This makes it an attractive mode of transmission for a Trojan because an attacker can use the covert channel to install a backdoor on the target machine.
What is an APT (Advanced Persistent Threat)?
An APT is an attack that focuses on stealing information from the victim machine without its user being aware of it. The impact of APT attacks on computer performance and Internet bandwidth is negligible as these attacks are slow in nature. APTs exploit vulnerabilities in the applications running on a computer, operating system, and embedded systems.
Which port number is used by the trojans Zeus, OceanSalt, and Shamoon?
Port 8080
Which ports are used by the trojan Emotet?
Ports 20, 22, 80 and 443
Which port number is used by the trojan Senna Spy?
Port 11000
What is Emotet?
Emotet is a dropper/downloader for well-known banking Trojans such as Zeus Panda banker, Trickbot, and Iced ID to infect victims globally
What is IExpress Wizard?
IExpress Wizard is a wrapper tool that guides the user to create a self-extracting package that can automatically install the embedded setup files, Trojans, etc
What is Godzilla?
Godzilla is a downloader that can be used for deploying malware on the target machine
What is BitCrypter?
BitCrypter is used to embed a crypter in binaries and can be used to encrypt and compress 32-bit executables and .NET apps without affecting their direct functionality
Which port number is used by Trojans such as Silencer and WebEx?
1001
Which port number is used by Trojans such as Psyber Stream Server and Voice?
1170
Which port number is used by the njRAT trojan?
1177
Which port number is used by the Doly trojan?
1011
Which port number is used by trojans such as WannaCry, Petya, and Dragonfly 2.0?
445
Which port numbers are used by the Hackers Paradise trojan?
31 and 456
Which port numbers are used by the TCP Wrappers trojan?
421
