Types of malware.
Common Types.
Droppers or Downloaders.
Keyloggers.
Or info.
Stealers.
Bots or spam Bots.
Banker.
Worm.
Ransomware Miner.
Backdoor.
First.
What are droppers and downloaders?
Droppers use embedded scripts to extract embedded executable from itself and then execute.
It typically spreads through malware spam using office word or Excel documents.
Downloaders are the same as droppers, except in this second stage is downloaded remotely from a C2
server command and Control server.
So the file is not embedded, but instead the malware will reach out to the internet to download the
second stage.
Info stealers and keyloggers.
Info stealers and Keyloggers typically come in one same executable.
Their purpose is to log keystrokes.
To exfiltrate data by emailing the logs.
The key logs that it has captured or it could use FTP as well.
Data may also be stored locally.
Communication with the server could be encrypted.
It may be able to steal browser or application password.
For example, Chrome, Firefox, Imvu Outlook or files passwords.
Things to look out for for keyloggers.
Keyloggers.
Typically use the following API.
Get async key state.
Set windows hook x and get foreground window features using Steelers.
Examples are sqlite3 used for Chrome, firefox DL and also the API called crypt.
Unprotected data in order to decrypt the credentials that are stored in Chrome.
Then we also have spam or spam bots or just bots, in short, a type of malware.
So an infected machine becomes part of a botnet.
The botnet is controlled by the bot master or masters.
It may be used in mining, cryptocurrencies or in distributed denial of service attacks, also known
as D, d, o.
S.
Or it can also be used for sending malicious spam.
Examples are Mirai, satori, cartwheel and zeroaccess.
So on the right is a diagram of a hierarchy of a typical botnet.
At the top we could have a bot master below it.
We have the command and control servers, short C2 servers, and below that we have all the infected
machines.
Then we also have banker malware.
These are very common and exist alongside info stealers.
Their main purpose is to steal banking information.
It does that through web injection or API hooking.
For example, Zeus DNA bought Ramnit a sample of API hooking it can intercept APIs and redirect it to
its own fake API in order to steal information.
For example hooking of http send request API.
Then you also have worms.
Worms self propagates across the network.
Usually no interaction is required.
This is because it can exploit vulnerabilities in operating systems.
For example, the eternalblue exploit or vulnerability.
A worm can contain malicious payload, for example WannaCry.
It uses the eternal blue and double pulsar exploit, and it contains ransomware payload.
Then we also have the ransomware malware.
Ransomware encrypts files and displays message to ask payment in order to release those files and typically
uses bitcoin as payment for example WannaCry.
It is gaining popularity because of cryptocurrency attacks are becoming larger, involving hundreds
of thousands of machines becoming encrypted and there are also miners also known as crypto miners.
They are usually created from open source cryptocurrency mining software, and miners use the victim
machines to mine for cryptocurrency and send them to the attacker's wallet.
It can spread through botnets or malware spamming.
Then we also have the back doors.
Back doors are also known as Rad, which stands for Remote access to or remote access Trojans.
This gives the attacker hidden remote access to the system.
It may include the info stealing and keylogging functionality.
It also could use reverse TCP connection if the victim machine is behind the firewall, so it can do
a reverse connection to a control and command server on the internet.
Sophisticated back doors or wraps utilize modular framework for example.
Remcos Rat.
Thank you for watching.