Malware
The main malware families classified by propagation and payload, the five stages of an infection and how to recognise a family from its symptoms.
- 27 cards
- 5 topics
- Free
The outline, topic by topic
Each topic is weighted the way the exam weighs it.
- Concepts
- Questions
- Sort and link
- Scenarios
- Understand
A few cards from the deck
Malware: what is it?
Show the answer
A program designed to harm a system or its data, or to act without its owner's knowledge.
What defines it is its author's intent, not the technique: the same mechanism can serve a legitimate program or an attack.
An employee opens “invoice_march.pdf.exe” from an attachment and nothing seems to happen. An outgoing connection then opens to an unknown server. Which family is it?
- A Trojan horse
- A worm, which copied itself to the other machines
- A virus, which inserted itself into a document on the machine
- Ransomware, which is waiting to encrypt the files
Show the answer
A Trojan horse
The file poses as an invoice and the victim runs it: that is a Trojan horse. Nothing points to automatic spreading (worm) or infection of another file (virus). The double extension
.pdf.exeis a classic sign.A … is a group of infected machines that an attacker commands remotely, for example to send spam or flood a website.
Show the answer
A botnet is a group of infected machines that an attacker commands remotely, for example to send spam or flood a website.
The machine's owner often notices nothing. The machine serves the attacker, who rents it out or uses it for a distributed denial-of-service attack.
Virus: what is it?
Show the answer
A program that inserts itself into a healthy file or program and spreads only when that host is run or passed on.
It depends on a host and on a user action, such as opening an infected file. That is what sets it apart from a worm.
A machine has its processor at 100% at night, its fans at full speed, no window open, and it makes connections to a mining pool. What conclusion and action?
- Ransomware is preparing to encrypt: restore the latest backup right away
- A worm is spreading: cut the machine off the network and wait for the computing to stop
- The processor is faulty: replace the machine and reuse the same files
- A cryptominer is running: remove it, then find how it got in
Show the answer
A cryptominer is running: remove it, then find how it got in
Constant computing outside any use, with connections to a mining pool, points to a cryptominer. Deleting it without finding the entry flaw would let it come back.