Module 12 - Malware, its Components and Distribution Methods

Currently, _____________, commonly called ________, is the most efficient tool for compromising the security of a computer or any other electronic device connected to the internet. This has become a menace owing to the rapid progress in technologies such as easy encryption and data hiding techniques.

malicious software; malware

What is the major source of various cyberattacks and internet security threats; therefore, computer forensic analysts need to have the expertise to deal with them?

Malware

Understand Malware, its Components and Distribution Methods: What is a malicious software that damages or disables computer systems and gives limited or full control of the systems to the malware creator for the purpose of theft or fraud?

Malware

Understand Malware, its Components and Distribution Methods: Which of the following are different types of malware?

Viruses, worms, and trojans

Understand Malware, its Components and Distribution Methods: What is useful when an unauthorized person wants to illegally access a locked or secure device?

Malware

Understand Malware, its Components and Distribution Methods: What programs include viruses, worms, trojans, rootkits, adware, spyware, etc., that can delete files, slow down computers, steal personal information, send spam, and commit fraud?

Malware

Understand Malware, its Components and Distribution Methods: What can perform various malicious activities, ranging from simple email advertising to complex identity theft and password theft?

Malware

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Attack browsers and track websites visited

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Alter system performance, making it very slow

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Cause hardware failure, rendering computers inoperable

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Steal personal information, including contacts

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Erase important information, resulting in potentially huge data losses

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Attack additional computer systems directly from a compromised system

Understand Malware, its Components and Distribution Methods: Malware programmers develop and use it to do what?

Spam inboxes with advertising emails

Understand Malware, its Components and Distribution Methods: True or False: Attackers use malware to break down cyber security. Therefore, it is crucial for forensic analysts to have a sound knowledge of different malware programs: their working, propagation, site of impact, output, along with different methods of their detection and analysis.

True

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Instant Messenger and Internet Relay Chat

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Removable Devices

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Email and Attachments

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Browser and Software Bugs

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Bluetooth and Wireless Networks

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

File Downloads

Understand Malware, its Components and Distribution Methods: Which of the following are the most common ways an attacker can send a malware into a system?

Network File Sharing (Using NetBIOS)

Understand Malware, its Components and Distribution Methods: True or False:

Internet Relay Chat (IRC), on the other hand, is a chatting service that allows multiple users to connect with each other and exchange data and files over the internet. Malware such as trojans use IRC as a means of propagation. The intruders rename Trojan files as something else to fool the victim and send it over IRC. When the IRC user downloads and clicks on the file, the Trojan executes and installs a malicious program in the system.

True

Understand Malware, its Components and Distribution Methods: True or False:

CDs, DVDs, and USB storage devices such as flash drives or external hard drives come with Autorun support, which triggers certain predetermined actions in a system on connecting these devices. Attackers exploit this feature to run malware along with genuine programs by placing an Autorun.inf file with the malware in a CD/DVD or USB.

True

Understand Malware, its Components and Distribution Methods: True or False:

An outdated web browser may not be able to identify if a malicious user is visiting a malicious site and cannot stop the site from copying or installing programs onto the user’s computer. Sometimes, a visit to a malicious site can automatically infect the machine without downloading or executing any program

True

Understand Malware, its Components and Distribution Methods: True or False:

Attackers use open Bluetooth and Wi-Fi networks to attract users to connect to it. These open networks have software and hardware devices installed at the router level that could capture the network traffic and data packets, and find other account details, including usernames and passwords.

True

Understand Malware, its Components and Distribution Methods: What malware can prompt email, POP3 account passwords, cached passwords, and keystrokes to the attackers through email secretly?

File downloads

Understand Malware, its Components and Distribution Methods: True of False: Sometimes, disgruntled employees of a company create a seemingly legitimate shrink-wrapped software package with malware and place it in the company’s internal network. When other employees access these files and try to download and execute them, the malware will compromise the system and may also cause intellectual and financial losses. Beside fake software, the intruder can also construct other fake files such as music players, files, movies, games, greeting cards, screensavers, etc.

True

Understand Malware, its Components and Distribution Methods: True or False: If the users share a common network with open ports, then the malware can propagate from a corrupted system to other systems through shared files and folders.

True

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Crypter

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Downloader

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Dropper

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Exploit

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Injector

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Obfuscator

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Packer

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Payload

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Malicious Code

Components of Malware: Malware authors and attackers create malware using the components that can help them achieve their goals. They can use malware to steal information, delete data, change system settings, provide access, or simply multiply and occupy space. Malware are capable of propagating and functioning secretly. Which of the following are some basic components of most malware programs?

Fileless Malware

Components of Malware: What refers to a software program that can conceal the existence of a malware? Attackers use this software to elude antivirus detection. The crypter encrypts the malicious file in a malware or the entire malware itself to avoid detection.

Crypter

Components of Malware: What is a type of Trojan that downloads other malware (or) malicious code and files from the Internet on to the PC. Usually, attackers install a downloader when they first gain access to a system?

Downloader

Components of Malware: Attackers need to install the malware program or code on the system to make it run, and this program can do the installation task covertly. The _____________ can contain unidentifiable malware code that antivirus scanners cannot detect and can download additional files needed to execute the malware on a target system.

Dropper

Components of Malware: What is a part of the malware that contains a code or sequence of commands to take advantage of a bug or vulnerability in a digital system or device? Attackers use this code to breach the system’s security through software vulnerabilities to access information or install malware. Based on the type of vulnerabilities they abuse, the exploits have different categories, including local exploits and remote exploits.

Exploit

Components of Malware: What is a program that injects the exploits or malicious code available in the malware into other vulnerable running processes and changes the way of execution to hide or prevent its removal?

Injector

Components of Malware: What is a program that conceals the malicious code of a malware via various techniques, making it hard for security mechanisms to detect or remove it?

Obfuscator

Components of Malware: What is a software that compresses the malware file to convert the code and data of malware into an unreadable format? _________ utilize compression techniques to pack the malware.

Packers

Components of Malware: What is a part of the malware that performs a desired activity when activated? __________ can have the tendency of deleting or modifying files, thereby affecting system performance, opening ports, changing settings, etc. as a part of compromising the security.

Payload

Components of Malware: What is a piece of code that defines the basic functionality of the malware and comprises commands that result in security breaches?

Malicious Code

Components of Malware: What various forms can malicious code take?

Java Applets, ActiveX Controls, Browser plugins, and Pushed content

Components of Malware: Some ________ might come packaged as device firmware and live in the memory, which help them run even after disk formatting, OS reinstallation, and system reboot.

Fileless malware

Components of Malware: Attackers also use built-in Windows features and authorized applications, such as PowerShell, command prompt, and Windows Management Instrumentation, to install and execute such malware on any system. Thus, such a _____________________ can easily bypass application whitelisting processes as it uses only approved applications. The absence of any physical file also enables attackers to evade security programs and continue the attack.

Fileless malicious attack

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Blackhat Search Engine Optimization (SEO)

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Social Engineered Clickjacking

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Spear Phishing Sites

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Malvertising

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Compromised Legitimate Websites

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Drive-by Downloads

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Domain Shadowing

Common Techniques Attackers Use to Distribute Malware across Web: Which of the following are common techniques used to distribute malware on the web?

Mouse Hovering

Common Techniques Attackers Use to Distribute Malware across Web: What uses aggressive SEO tactics such as keyword stuffing, doorway pages, page swapping, and adding unrelated keywords to get a higher search engine ranking for their malware pages?

Blackhat Search Engine Optimization (SEO)

Common Techniques Attackers Use to Distribute Malware across Web: When attackers inject malware into legitimate-looking websites to trick users into clicking them, once clicked, the malware embedded in the link executes without the user’s knowledge or consent. What is this known as?

Social Engineered Clickjacking

Common Techniques Attackers Use to Distribute Malware across Web: What technique helps attacker mimic legitimate institutions such as banks, to steal passwords, credit card and bank account data, and other sensitive information?

Spear Phishing Sites

Common Techniques Attackers Use to Distribute Malware across Web: What involves embedding malware-laden advertisements in authentic online advertising channels to spread malware onto the systems of unsuspecting users?

Malvertising

Common Techniques Attackers Use to Distribute Malware across Web: Often, attackers use compromised websites to infect systems with malware. When a non - suspecting user visits the compromised website, the malware secretly installs itself on the user’s system and thereafter carries out malicious activities. What is this known as?

Compromised Legitimate Websites

Common Techniques Attackers Use to Distribute Malware across Web: What refers to the unintentional downloading of software via the Internet? Here, an attacker exploits the flaws in a browser software to install malware merely by visiting a web page.

Drive-by Downloads

Common Techniques Attackers Use to Distribute Malware across Web: What refers to a technique in which attackers gain access to domain account credentials via phishing and create multiple tiers of subdomains to perform malicious activities, such as redirecting users to landing pages that serve exploits? These subdomains, which direct traffic to malicious servers, are associated with trustworthy domains and do not affect the working of their parent domains in any manner. Besides, subdomains linked to a single domain are rapidly rotated by the attackers, which makes their detection quite difficult.

Domain Shadowing

Common Techniques Attackers Use to Distribute Malware across Web: What is a relatively new and unique technique used by attackers to infect systems with malware? Attackers send spam emails to target users along with a Microsoft PowerPoint file attachment with .PPSX or.PPS extension. When the users download and open the malicious file, they unknowingly enable the malware to run on their systems. The malware gets automatically executed with the simple action of users hovering their mouse pointers over any hyperlinked text or photo within the malicious file.

Mouse Hovering