MOD7: Malware Threats Flashcards
What’s the difference between trojans and viruses?
Trojans - infect systems
Viruses - infect files
What is malware?
malicious software that damages or disables computer systems and gives limited or full control of the systems to the malware creator for the purpose of theft / fraud
List examples of malware.
Trojans backdoors rootkits ransomware adware viruses worms spyware botnets crypters
What 3 malware components are meant to make code undetected?
Crypter
Obfuscator
Packer
What is a payload?
A piece of software that allows control over a computer system after it has been exploited.
What are APTs?
Advanced Persistent Threats.
APTs are defined as a type of network attack, where an attacker gains unauthorized access to a target network and remains undetected for a long period of time.
Their main objective is to gain sensitive information rather than sabotaging the organization/network.
What is a Trojan?
A program in which the malicious or harmful code is contained inside apparently harmless programming or data in such a way that the code can get control and cause damage.
How do hackers use Trojans?>
- delete/ replace OS
- generate fake traffic
- download malware/spyware /malicious files
- record screenshots etc
- create backdoors to gain access
- disable firewalls /antivirus
- steal personal info
- encrypt data
What port does Emotet use?
20/22/80/443
What port did WannaCry and Petya use?
445
Name types of Trojans.
Remote Access Trojan (RAT) Backdoor Trojan Botnet Trojan Rootkit Trojan E-banking Trojan Point-of-Sale Trojan Defacement Trojan Service Protocol Trojan Mobile Trojan IoT Trojan Security Software Disabler Trojan Destructive Trojan DDoS Attack Trojan Command Shell Trojan
Attackers use covert channels to deploy and hide malicious trojans in an undetectable protocol.
True/False.
True.
Covert channels operate on a tunneling method and are mostly employed by attackers to evade firewalls that are deployed in the target network.
Port 443 is encrypted.
True/False.
True.
Which one is a Trojan technique for evading antivirus software?
a) break the trojan file into multiple pieces and zip them as a single file.
b) always write your own trojan, and embed it into an application.
c) change the Trojan’s syntax (ex. convert an EXE to VB script, change .EXE extension to a known extension)
d) all of the above
d) all of the above
Note: never use trojans from the web. Antivirus detects it.
What is an exploit kit?
a platform to deliver exploits and payloads such as trojans, spywares, backdoors, bots, and buffer overflow scripts to the target system.
Exploits come with pre-written exploit codes and can be easily used by an attacker, who is not an IT / security expert.
What is a virus?
A virus is a self-replicating program that produces it’s own copy by attacking itself to another program, computer boot sector or document. Viruses are generally transmitted through file downloads, infected disk/flash drives, and as email attachments.
Characteristics of viruses.
- infects other programs
- transform themselves
- encrypt themselves
- alter data
- corrupt files and programs
- self-replicate
Purpose of creating viruses.
- inflict damage on competitors
- financial benefits
- vandalism
- play pranks
- research projects
- cyber terrorism
- distribute political messages
- damage networks or computers
- gain remote access to a victim’s computer
What is ransomware?
A type of malware that restricts access to the computer system’s files and folders and demands an online ransom payment to the malware creator(s) to remove the restrictions.
Dharma is a type of ransomware.
True/False.
True.
Dharma is a ransomware attack through email campaigns.
A virus can be created in two different ways:
- Writing a virus Program
- Using Virus Maker tools
True/False
True.
What are computer worms?
Computer worms are malicious programs that independently replicate, execute, and spread across the network connections, thus consuming available computing resources without human interaction.
ex of worms: Monero, Bondat, Beapy.
How is a worm different than a virus?
A worm replicates on it’s own (replicates itself and use memory but cannot attach itself to other programs).
A worm spreads through the infected network (worm takes advantage of file or info transport features on computer systems and automatically spreads through the infected network, but a virus does not).
What is fileless malware?
aka non-malware.
Infects legitimate software, applications and other protocols existing in the system to perform various malicious activities. It leverages any existing vulnerabilities to infect the system. It resides in the RAM. It injects malicious code into the running processes such as Microsoft Word, Flash, Adobe PDF Reader, Javascript, and PowerShell.
