Original subtitles

1

Welcome to this new lesson of Introduction to Malware Analysis

2

Now lets talk about the main types of malware

3

Virus or Worm: is a Malware that is capable of copying itself and spreading to other computers.

4

Rootkit: is a Malware that provides the attacker with privileged access to the infected system and conceals its presence

5

or the presence of other software.

6

Backdoor / Remote Access Trojan (RAT): This is a type of Trojan that enables the attacker to gain access to,

7

and execute commands on the compromised system. If you are interested in this kind of malware Metasploit plataform, is amazing.

8

A downloader try to establish a connection to a Command and Control Center and download malware,

9

sometimes is confused by a dropper but this last one execute itself almost immediately, for example could camouflaged in a word macro

10

if you allow the macro, the payload try to infect the system. Will be doing a simple downloader exercise later on this course.

11

Ransomware: Malware that holds the system for ransom by locking users files.

12

We’ll have a big section for ransomware ahead on this course.

13

Adware: Malware that presents unwanted advertisements.

14

Information stealer: Malware designed to steal data such as banking credentials or keystrokes from the infected system.

15

Some examples of these malicious programs include keyloggers, spyware, sniffers, and form grabbers.

16

We'll have a big section dedicated to keyloggers.

17

Botnet: is an army of infected equipment, waiting to receive instructions from the command-and-control center

18

controlled by the attacker. The attacker can then issue a command to these bots,

19

which can perform malicious activities such as Distribution denial of service attacks or sending spam.

20

Trojan: is a Malware that disguises itself as a regular program and trick users to install it on their systems.

21

Malware components. Payload: This is the core component of malware, it’s the code that carry on the main malicious actions.

22

Obfuscator: Usually a packer or protector to encrypt or compress the malware.

23

Persistence: How the malware manages to stay in the system.

24

Stealth component: Hides the malware from antivirus, analysis tools and security researchers.

25

Armoring: Protects the malware from: antivirus, debuggers, decompilers, disassembler, etc.

26

Command and Control Center (C&C): This is the control center that malware try to connect to for further instructions.

27

Managed by the attackers, try to establish a connection line to victim system to exfiltrate data, send malware and more.

28

Command and control center also known as c and c, cc or c two

29

Command and Control center is a server that attacker use to send instructions to infected hosts and receive data exfiltration

30

made by the malware installed in those hosts

31

Once the malware installs itself could try to make contact to CC for further instructions.

32

For example a keylogger makes contact to CC to send the stolen keystrokes, or a ransomware connects to a CC asking for an ecryption key.

33

Will see this in more detail in the correspondents keylogger and ransomware sections.

34

CC could also be used to try to download more malware

35

A successful CC must remain anonymous, a popular way to do this is using TOR

36

Tor is a navigator that enable people to browse the internet anonymously,

37

achieves this by disguising your identity moving your traffic across different Tor servers,

38

and encrypting that traffic.

39

We can see the attacker in this picture, and the red line means there's not encryption,

40

but once in tor, the green line indicates that the data is encrypted.

41

In this cloud could be many tor routers, once the data reach out destination, the data arrives decrypted,

42

but if someone try to trace back this traffic, to try to catch the attacker, is necessary ask for the logs in these routers

43

and tor does not store ip's, then is very powerful for anonymity

44

The extension .onion indicates the site can only be access through TOR,

45

that's why usually ransomware rescue notes, asking for money, use .onion links,

46

because it makes very difficult to trace those links back, to the attackers.

47

thanks and please join me on the next lesson.