Skip to main content

Understanding Malware & Threats

info

The content of this Malware Analysis pages is my understanding and notes based on the course Introduction to Malware Analysis by Prof. Ahmed Lekssays.

What Makes Software "Malicious"?​

Software is defined as malicious based on Intent and Behavior, not just the code itself. Key characteristics include:

  • Intent: Designed to cause harm or unauthorized actions.
  • Behavior: Performs actions without user consent.
  • Stealth: actively attempts to hide its presence.
  • Persistence: Mechanisms to maintain access across system reboots.

Common objectives include data theft, system damage (wipers), resource hijacking (cryptomining), and espionage.

Modern Threat Landscape (2024-2026)​

The landscape has shifted from simple file-based attacks to complex, behavior-based operations.

1. Ransomware​

The dominant threat in recent years.

  • RaaS (Ransomware-as-a-Service): A business model where developers sell the malware to affiliates who execute the attacks.
  • Double Extortion: Attackers encrypt data and threaten to leak it publicly if the ransom isn't paid.
  • Examples: LockBit, ALPHV/BlackCat, Royal.

2. APT (Advanced Persistent Threat)​

State-sponsored or highly sophisticated groups focusing on long-term espionage.

  • Use custom tooling and 0-day exploits.
  • Examples: APT28 (Fancy Bear), APT29 (Cozy Bear), Lazarus Group.

3. Infostealers​

Malware designed to harvest credentials, session tokens, and financial data.

  • Examples: RedLine, Raccoon, Vidar.

Execution Strategies​

  • Fileless Malware: Abuse of PowerShell, WMI, or CertUtil to run code without dropping files to disk.
  • Living-off-the-land (LOLBins): Using legitimate system tools for malicious purposes.

Case Study: WannaCry (2017)​

WannaCry serves as a classic example of a "Kill Chain" in action. It infected over 200k computers by exploiting a leaked NSA tool.

The Kill Chain​

  • Delivery: EternalBlue Exploit. It targeted CVE-2017-0144 in Windows SMBv1. It acted as a worm, scanning port 445 to propagate automatically.
  • Installation: Double Pulsar Backdoor. Implanted a persistent backdoor in kernel memory and injected malicious DLLs.
  • Action: Encryption. Used AES-128 for files and RSA-2048 for keys. Targeted specific extensions (.doc, .pdf, etc.).

The Kill Switch​

Researcher Marcus Hutchins discovered the malware queried a specific, nonsense domain iuqerfsodp9...com.

  • Logic: If the domain resolves (exists), the malware terminates.
  • Reason: Likely an anti-sandbox technique (sandboxes often simulate "all Internet is live").
  • Result: Hutchins registered the domain, accidentally activating the kill switch and stopping the global spread.