Domain 1.1 - Given a scenario, analyze indicators of compromise and determine the type of malware. Flashcards
Describe an Armored Virus
Armored viruses cover themselves with protective code that stops debuggers or disassemblers from examining critical elements of the virus.
Describe a Companion Virus
A companion virus attaches itself to legitimate programs and then creates a program with a different filename extension.
What does a Macro Virus affect?
Affects Microsoft office products (Word, Excel, etc.)
What does a Multipartite Virus infect?
It may attempt to infect your boot sector, infect all of your executable files, and destroy your application files
How do you remove a Phage Virus?
The only way to remove this virus is to reinstall the programs that are infected.
Describe a Polymorphic Virus
Polymorphic viruses and polymorphic malware of any type change form in order to avoid detection.
What does Retrovirus attack?
A retrovirus attacks or bypasses the antivirus software installed on a computer
A stealth virus attempts to avoid detection by ________ itself from applications.
Masking
It may attach itself to the boot sector of the hard drive.
What does Ransomware Do?
RansomWare encrypts your hard drive. Then a third party requests payment to decrypt it. Usually through Bitcoin.
What is the key feature of a worm?
A worm is Self-Replicating
What is a Trojan?
A virus disguised as a legitimate program.
What is a RAT?
A Remote Access Trojan.
What is the goal of a RootKit?
The goal of a rootkit is to gain root access to a computer. In order to gain Escalated Privileges.
What does a Key logger do?
It logs every key stroke and mouse click on an infected system. It then sends that info to the threat actor.
What does Spyware do?
monitors your activity then sends it back to whoever created the software.
