Ethical Hacking Malware Threats Syllabus

Distinguish crypto ransomware from locker ransomware.

Crypto ransomware encrypts the victim's files while leaving the system usable; locker ransomware locks the user out of the entire device/system but usually does not encrypt individual files.

What is the WannaCry ransomware notable for?

A 2017 ransomware worm that spread using the EternalBlue SMB exploit, self-propagating across networks and encrypting files—combining worm propagation with ransomware payload.

What are Indicators of Compromise (IOCs)?

Forensic artifacts (file hashes, malicious IPs/domains, registry keys, filenames, mutexes) that indicate a system has been breached and help detect or attribute an intrusion.

In static analysis, what does computing a file's hash accomplish?

It produces a unique fingerprint (e.g., MD5, SHA-256) used to identify the sample, check it against threat-intelligence databases, and confirm the exact file being analyzed.

Why are strings extracted during static malware analysis?

Readable strings (URLs, IP addresses, file paths, registry keys, commands, error messages) can reveal a malware's functionality, C2 servers, and indicators without running it.

What is disassembly in static analysis?

Converting a binary's machine code into human-readable assembly language (e.g., with IDA Pro or Ghidra) to analyze the program's logic without executing it.

What is the risk of running dynamic analysis outside an isolated environment?

Executing live malware can infect the analyst's host and spread to the production network; dynamic analysis must be done in an isolated sandbox or air-gapped VM.

What is a packed executable and why does it complicate static analysis?

A packed executable is compressed/encrypted so its real code is only unpacked at runtime; this hides strings and code from static tools, requiring unpacking or dynamic analysis first.

What is sandbox evasion?

Techniques malware uses to detect that it is running in a sandbox/VM (checking for VM artifacts, timing, user interaction, or low resources) and then withhold its malicious behavior to avoid analysis.

What is a Remote Access Trojan (RAT)?

A Trojan that opens a covert backdoor giving an attacker remote control over the victim's machine—file access, keylogging, webcam/mic capture, and command execution.

What does a Command-and-Control (C2/C&C) server do for malware?

It is the attacker-controlled server that infected machines contact to receive commands, exfiltrate stolen data, and download additional payloads or updates.

What is a dropper?

A type of Trojan/loader whose job is to install (drop) other malware onto the system, often carrying the payload internally or downloading it, then executing it.

What distinguishes a downloader from a dropper?

A dropper contains the malicious payload within itself; a downloader contains no payload but retrieves and installs it from a remote server after execution.

What is spyware?

Software that covertly monitors and collects information about a user's activity—keystrokes, browsing, credentials—and transmits it to a third party without consent.

What is adware?

Software that automatically displays or downloads advertisements; it is often unwanted (potentially unwanted program) and can bundle spyware-like tracking.

What is a keylogger?

A form of spyware (hardware or software) that records every keystroke a user types to capture passwords, messages, and other sensitive input.

How does a heuristic scanner assign a verdict using a threshold?

It accumulates weighted suspicion points for risky features and flags the file as malicious when the total exceeds a set threshold $T$, i.e., when $\sum_{i} w_{i} x_{i} \geq T$.

Define the false positive rate (FPR) for a malware detector.

$$\text{FPR} = \frac{FP}{FP + TN}$$ the fraction of benign files incorrectly flagged as malicious.

Define the true positive rate (detection rate / recall) of an antivirus engine.

$$\text{TPR} = \frac{TP}{TP + FN}$$ the fraction of actual malware samples correctly detected.

Write the precision of a malware classifier in terms of TP and FP.

$$\text{Precision} = \frac{TP}{TP + FP}$$ the fraction of flagged files that are genuinely malicious.

Give the accuracy formula used to evaluate a malware detection model.

$$\text{Accuracy} = \frac{TP + TN}{TP + TN + FP + FN}$$

What is the fileless malware technique?

Malware that operates in memory and abuses legitimate tools (e.g., PowerShell, WMI) rather than writing an executable to disk, making it harder for signature/file-based antivirus to detect.

What is the typical ransomware attack lifecycle?

Initial access (phishing/exploit) → execution and privilege escalation → lateral movement → (often) data exfiltration → encryption of files → ransom note and demand for payment.

What is double-extortion ransomware?

Ransomware that both encrypts the victim's data and steals a copy, threatening to publicly leak the stolen data unless the ransom is paid—pressuring even victims who have backups.

Why are offline/immutable backups a key defense against ransomware?

They let an organization restore encrypted data without paying, and because they are isolated or write-protected, the ransomware cannot encrypt or delete them during the attack.

What is a virus 'payload'?

The part of the malware that performs its intended malicious action (e.g., deleting files, encrypting data, stealing information), as opposed to the propagation/infection routine.

What are the two functional components common to a virus?

An infection (replication) mechanism that spreads it to new hosts, and a payload that carries out the malicious action; many also include a trigger that decides when the payload fires.

How does application whitelisting help endpoint protection?

It permits only explicitly approved (whitelisted) programs to run and blocks everything else by default, preventing unknown malware and unauthorized executables from executing.

What is heuristic 'emulation' or sandboxing within an antivirus engine?

The AV runs a suspicious file in a lightweight internal virtual machine/emulator to observe its behavior before allowing it on the real system, detecting malicious actions without live infection.

Compare static and dynamic analysis in terms of code coverage and evasion.

Static analysis can inspect all code paths but is defeated by packing/obfuscation; dynamic analysis reveals true runtime behavior of executed paths but only covers paths that actually run and can be foiled by sandbox-evasion or dormant triggers.