EH Chapter 8: Malware

In a botnet, what are the systems that tell individual bots what to do called?

C2 servers

What is the primary difference between a worm and a virus?

A worm can self‐propagate.

What is one advantage of static analysis over dynamic analysis of malware?

Static analysis limits your exposure to infection.

What would you use VirusTotal for?

Identifying malware against antivirus engines

What are two sections you would commonly find in a portable executable file?

Text and data

What could you use to generate your own malware?

Metasploit

What is the purpose of a packer for malware?

To obscure the actual program

What is the primary purpose of polymorphic code for malware programs?

Antivirus evasion

What would be one reason not to write malware in Python?

The Python interpreter may not be available.

What would you use Cuckoo Sandbox for?

Dynamic analysis of malware

If you wanted a tool that could help with both static and dynamic analysis of malware, which would you choose?

IDA

What is the purpose of using a disassembler?

Converting opcodes to mnemonics

What does the malware that is referred to as a dropper do?

Drops files that may be more malware

Why would you use an encoder when you are creating malware using Metasploit?

To evade antivirus

If you were to see the following command in someone's history, what would you think had happened?

msfvenom -i 5 -p windows/x64/shell_reverse_tcp -o program

A malicious program was generated.

What is the difference between a virus and ransomware?

Ransomware may be a virus.

Why would someone use a Trojan?

It pretends to be something else.

Which of these tools would be most beneficial when trying to dynamically analyze malware?

OllyDbg

Which end of a client‐server communication goes on the infected system if it is communicating with infrastructure?

Server

Which of these would be a reason why it is best for communications to originate from inside the infected network?

Firewall

What is the tactic of allowing software to continue running across reboots of a system called?

Persistence

What tool could you use to deeply analyze malicious software?

Ghidra

What practice could an organization use to protect itself against data loss from ransomware?

Implement good backup practices

What piece of software could you use to recover from a ransomware attack?

Decryptor

What persistence mechanism might allow malware to protect itself against anti‐malware software?

Pre‐boot malware