Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CEH v11 Revision > Malware > Flashcards

Malware Flashcards

1
Q

What is meant by Overt Channels?

A

Legitimate communication channels used by programs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is meant by Covert Channels?

A

Used to transport data in unintended ways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a Malware Wrapper?

A

Software that allows you to bind an executable to an ordinary file.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a Crypter?

A

A software that provides combination of encryption, code manipulation and obfuscation to render malware undetectable from security applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a packer?

A

Used for compressing executables which helps evade signature based detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the following tools used for?
1. Infinity
2. Bleeding Life
3. Crimepack
4. Blackhole Kit

A

Exploit kits - Help delivery of exploits and payloads

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What type of Malware is a Trojan?

A

Software that appears legitimate but instead functions and performs malicious activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the purpose of a Proxy Trojan?

A

Turn the victims infected machine into a proxy server, routing traffic through it.

Additionally have full access to the infected host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the purpose of a Defacement Trojan?

A

Change the workings or appearance of a website or system, additionally can be used to exfiltrate data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the purpose of a Botnet Trojan?

A

Be able to remotely control the infected host, which could be used in DDoS attacks or spam. End goal is to weaponise infected hosts.

Examples:
- Chewbacca
- Skynet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What malware types are listed below:
1. RAT
2. MoSucker
3. Optix Pro
4. Blackhole

A

Remote Access Trojans, gives the attacker ability to remote into to infected hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What malware type is listed below:
1. Zeus
2. Spyeye

A

Banking Trojans - To steal banking information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Command Shell Trojan?

A

Purpose is to provide a backdoor access through a command line

Example:
- Netcat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a Covert Channel Tunnelling Trojan (CCTT)?

A

A RAT type trojan. Creates data transfer channels in the data streams authorized by a network access control system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does the following command do?

netstat -an

A

Shows open ports in order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does the following command do?

netstat -b

A

Displays all active connections and processes using them

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the general purpose of the following tools:
- SysAnalyzer
- Tiny Watcher
- Regshot

A

Registry Monitoring

Additional tools: Active Registry Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the purpose of msconfig?

A

Windows program that shows all programs set to start on startup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is meant by HIDS?

A

Host Intrusion Detection System

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What type of tool is Tripwire?

A

Integrity verifier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is SIGVERIF used in Windows?

A

Verify the integrity of the system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which of the following BEST describes the mechanism of a Boot Sector Virus?

Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR
Moves the MBR to another location on the RAM and copies itself to the original location of the MBR
Overwrites the original MBR and only executes the new virus code
Modifies directory table entries so that directory entries point to the virus code instead of the actual program
A

Moves the MBR to another location on the hard disk and copies itself to the original location of the MBR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is meant by Heuristic Analysis?

A

Examining code for malicious properties.

24
Q

What characteristics does a Virus have?

A

Self replicating malware, attaches itself to other executables

25
Q

What is Fake Antivirus malware?

A

Disguised as AV but is a malware. Tries convince users they have malware in order for people to download it.

26
Q

What type of malware is Wannacry?

A

Ransomware, exploited by unpatched SMB servers

27
Q

What type of malware is Cryptorbit?

A

Ransomware

28
Q

What type of malware is CryptoLocker?

A

Ransomware

29
Q

What type of malware is police-themed?

A

Ransomware

30
Q

What type of malware is CryptoDefense?

A

Ransomware

31
Q

What’s the purpose of a Shell Virus?

A

Wraps itself around other application codes

32
Q

What is the purpose of a Cluster Virus?

A

Modifies directory table entries. Every time a directory or file is opened, cluster virus executes.

33
Q

What is a Multipartite Virus?

A

Infects boot sectors and files. Virus with multiple infection methods.

34
Q

What is a Macro Virus?

A

Written in VBA, infects Word and Excel files.

35
Q

What is a Polymorphic Code Virus?

A

Virus that mutates its code (using polymorphic engine). Evades AV because code is always changing.

36
Q

What is a Encryption Virus?

A

Encrypts itself to hide from AVs.

37
Q

What is a Metamorphic Virus?

A

Rewrites itself after every infection.

38
Q

What is a Stealth/Tunnelling Virus?

A

Attempts to evade AVs by many means, tries to intercept AV requests to the OS.

39
Q

What is a Cavity Virus?

A

Embeds itself within files, replaces data to avoid increasing file size

40
Q

What is a Sparse Infector Virus?

A

Only infects occasionally (e.g. every 10th time) to avoid being discovered

41
Q

What is a Extension Virus?

A

Changes the file extensions of files.

42
Q

What is Sonic Bat?

A

Virus Generator

43
Q

What characteristics does a Worm have?

A
  • Self-replicating malware that sends itself to other computers without human intervention.
  • Mostly resides in Active Memory.
  • Used in Botnets
44
Q

In a VM, which NIC configuration is best used in Malware Analysis?

A

Host-only mode. Also disable open shares.

45
Q

What are these tools used for?
- binText
- UPX

A

Analysis of malware in static state

46
Q

What are these tools used for during malware analysis?
- NetResident
- TCPView
- Wireshark

A

Monitoring processes and network activity

47
Q

What are these tools used in malware analysis?
- IDA Pro
- VirusTotal
- Anubis
- Threat Analyzer

A

Determining what files were added, changed, or deleted

48
Q

What is meant “sheepdip”?

A

System that is used to analyse malware before it is introduced to other computers or network.

49
Q

What type of malware is Stuxnet?

A

Worm.

50
Q

What type of malware is Lemon Duck?

A

Botnet.

51
Q

What type of malware is Mirai

A

Botnet.

52
Q

What type of malware is Prometei?

A

Botnet.

53
Q

What is a Logic Bomb malware?

A

Malware that’s been placed and waits for programmed condition to trigger for execution.

54
Q

What is Botnet?

A

Network of infected zombie hosts, used for distributed attacks.

55
Q

How can a rootkit bypass Windows 7 operating system’s kernel mode, code signing policy?

A

Attaching itself to the master boot record in a hard drive and changing the machine’s boot sequence/options

56
Q

What type of malware is Morris?

A

Worm

57
Q

What type of malware is Code Red?

A

Worm

CEH v11 Revision (15 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions