Module 07 — Malware Threats · Must-Know Facts¶
One-page, high-yield recall sheet. If you can reproduce this from memory, you own the module. Pairs with README.md · practice-questions.md · flashcards.csv · lab-walkthrough.md.
The one distinction the exam always tests¶
| Type | Host file? | Self-replicates? | User action to spread? |
|---|---|---|---|
| Virus | Yes (rides a file/program) | Yes | Usually (run the infected file) |
| Worm | No (standalone) | Yes | No — spreads over the network itself |
| Trojan | No (poses as legit) | No | Yes (user installs/runs it) |
Hook: worm = wire (self-spreads), virus = vessel (rides a host), trojan = trick (you install it).
Malware components (the "distribution kit")¶
| Part | Job |
|---|---|
| Dropper | Carries + writes the malware already inside it to disk |
| Downloader | Fetches later stages from the internet |
| Exploit | Gets the code running |
| Injector | Loads code into another process |
| Obfuscator / packer / crypter | Compress/encrypt the binary to defeat static signatures |
| Payload | The part that does the actual damage |
Don't swap dropper (has it) vs downloader (fetches it).
Virus types (know on sight)¶
| Type | Trick |
|---|---|
| Boot sector | Infects MBR/VBR, loads before the OS |
| Macro | Office document macros (VBA) |
| Polymorphic | Mutates its encrypted body; decryptor changes each time |
| Metamorphic | Rewrites its own code each generation — no static signature |
| Encrypted | Body encrypted, constant decryptor (weaker than polymorphic) |
| Cavity (spacefiller) | Hides in a file's empty space → size unchanged |
| Multipartite | Infects boot sector and files |
| Stealth / tunneling | Intercepts AV/OS calls to hide its changes |
Rootkits — classified by where they hide¶
| Level | How | Detection |
|---|---|---|
| User-mode | Hooks user API (DLL injection) | Easier (EDR sees it) |
| Kernel-mode | Malicious driver | Hard |
| Bootkit | Bootloader/MBR/UEFI | Very hard (loads first) |
| Hypervisor | OS runs inside a rogue VM | Very hard |
| Firmware / hardware | BIOS/UEFI, device firmware | Survives reinstall |
Fileless / LOLBins¶
Runs in memory via trusted, signed system binaries ("living off the land"): powershell.exe, wmic.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe. Nothing malicious hits disk → signature AV has little to match. Detection shifts to behavior (rare parent-child, encoded PowerShell, service acct beaconing).
APT lifecycle (stealth + persistence + funded actor)¶
Recon → Initial compromise → Establish foothold → Escalate privilege → Internal recon → Lateral movement → Maintain presence → Exfiltrate / act on objective. An APT is defined by stealth, persistence, and a goal-driven funded actor, not one technique.
Malware analysis & detection¶
- Static = don't run it:
sha256sum,file,strings, PE headers/imports (pefile/PEStudio), disassembly (Ghidra), YARA rules. - Dynamic = run it in a sandbox (Cuckoo/CAPE) and watch behavior. Always isolated, snapshotted, no-network VM.
- Detection approaches: signature · heuristic/behavioral · integrity checking; plus IoCs.
Ports & C2 to recognize¶
- 31337 Back Orifice · 12345/12346 NetBus · 27374 Sub7 · 1080/3128 proxy/SOCKS abuse · 6660-6669 IRC C2.
- Modern C2 beacons over 443 because it blends in.
The one-line PAM answer key¶
- Trojan/RAT/dropper install & persist → remove standing local admin + default-deny app control (EPM/WDAC/AppLocker).
- Ransomware → immutable/offline backups, JIT admin so encryptor lacks rights, canary files, segmentation.
- Fileless/LOLBins → script-block logging, constrained language mode, ASR rules.
- Credential-stealing payload (LSASS) → Credential Guard + EPM credential-theft protection.
- Rootkit/bootkit → Secure Boot + measured boot, driver block-list, HVCI, tamper-protected EDR.
PAM angle: the single highest-value anti-malware lever is removing standing local-admin rights — most droppers, rootkits, and ransomware need privilege to install and persist; pair with app allow-listing, JIT elevation, and immutable backups.
Top traps¶
- Worm self-propagates over the network; virus needs a host file; trojan needs the user to run it. (Asked constantly.)
- Polymorphic = changes its encrypted form; metamorphic = rewrites its actual code (harder to signature).
- Dropper already contains the malware; downloader pulls it from the internet — don't swap.
- Fileless ≠ harmless — evades signature AV, not behavioral detection.
- A rootkit hides presence/privilege; a backdoor gives re-entry — a rootkit may contain a backdoor, not a synonym.
- APT = persistence + determined funded actor, not a specific tool.