Malware Types Flashcards
From Chapter 1: Indicators of Compromise & Malware Types
What is a virus?
A program or piece of code that runs on your computer (w/out your knowledge), executed by some type of action (ex. clicking a link). It then attaches to other code and replicates.
Classification: How does a Resident Virus live?
Resides in memory and stays active after host program terminates. It loads each time sys starts and can infect other areas based on specific actions.
Classification: How does a Nonresident Virus live?
Looks for targets locally and across the network once it’s executed. It infects the targets and then exits - doesn’t stay active.
Classification: How does a Boot Sector Virus live?
Placed in 1st sector of hard drive and loads into memory when computer boots. Loads before the OS - more prevalent in floppy disk era.
Classification: How does a Macro Virus live?
Uses the macro language and executes when the document opens. It’s inserted into MS Office doc and emailed to unsuspecting users.
Characteristic: Program & File Infecting Virus
Virus infects executable program files and becomes active in memory. It will then seek out other files to infect (most common viruses are this type). Identified by its binary pattern (signature) - similar to a fingerprint.
Characteristic: Polymorphic Virus
Virus that avoids detection by changing its form or signature each time it’s executed. Each time it infects a new file or system, it changes its code. Difficult to detect by pattern/signature, use heuristic-based scanning to look for the instructions running within a program instead.
Characteristic: Armored Virus
Virus that makes it difficult to detect or analyze its functions (metaphorical layer of armor). This type also tries to defeat heuristic countermeasures and uses mechanisms to prevent disassembly & debugging.
Characteristic: Stealth Virus
This virus type resides in memory and will use various techniques to avoid detection. For example, it can temporarily remove itself from an infected file or mask a file’s size.
Characteristic: Multipartie Virus
Virus that infects executable files and attacks the master boot record. The boot sector must be cleaned along with the infected files or the files can become infected again.
What is a worm?
A worm is created to take advantage of a security hole in an application or OS. It finds other systems running the same software, then self-replicates to the new host. If it finds an Internet connection, it will replicate from one system to the next. Common methods of replicating: email, the network, the Internet
How are a virus and a worm different?
The main difference is that a worm replicates without a host file/user intervention.
What is ransomware?
Ransomware involves an attacker that attempts to hold a user ransom, typically for monetary gain (via cryptocurrencies). It’s an evolved and more demanding form of “scareware”.
Classification: What is crypto-malware?
Type of malware that is designed to specifically find valuable data on a system and encrypt it. Example - CryptoLocker. Encryption keys are generated after data is encrypted and they’re stored on a command-and-control server. The user must pay the ransom to receive the key, if not, the ransomware threatens to delete the key. The key is needed to regain access.
What is a Trojan horse?
Trojans are programs that trick users by disguising themselves as useful applications. Code hidden inside the application can attack and compromise the user’s system without their knowledge or consent. Example: collecting or sending data or causing the computer to malfunction.
