Ethical Hacking Malware Basics
Malware is software built to harm, spy on, or take control of a computer. The word joins "malicious" and "software". Ethical hackers study malware to understand attacker behavior and to help organizations defend against it. The content covers recognition and defense only.
Common Malware Types
| Type | What It Does |
|---|---|
| Virus | Attaches to a file and spreads when the file opens |
| Worm | Spreads across networks on its own |
| Trojan | Pretends to be useful software while hiding harm |
| Ransomware | Locks files and demands payment |
| Spyware | Watches activity and collects information |
| Adware | Floods the user with unwanted ads |
| Rootkit | Hides deep inside the system |
| Botnet client | Turns a computer into a remote-controlled machine |
How Malware Reaches a Computer
Phishing Email ---+ Fake Download ---+ Infected USB ---+---> [User Action] ---> [Malware Runs] Unpatched App ---+ Malicious Ad ---+
Most infections need a human action, such as clicking a link or opening an attachment. Strong habits stop many attacks before software does.
The Malware Life Cycle
- Delivery: the file arrives by email, download, or device.
- Execution: the user or a software flaw starts the program.
- Persistence: the malware sets itself to restart after reboot.
- Action: it steals data, encrypts files, or waits for commands.
- Spread: it tries to reach other machines.
Signs of Infection
- The computer slows down without a clear reason.
- Unknown programs appear or start by themselves.
- The browser homepage changes.
- Antivirus software turns off.
- Files become unreadable or change names.
- Network traffic spikes at idle times.
Introduction to Malware Analysis
Analysts examine suspicious files to learn what they do. Two main approaches exist.
Static Analysis
The analyst studies the file without running it. Checks include file hashes, readable text strings, and embedded links. A hash lookup on a public reputation service often identifies known malware within seconds.
Dynamic Analysis
The analyst runs the file inside an isolated sandbox and watches its behavior. Observers record file changes, new processes, and network connections.
Safe Analysis Lab Rules
Analysis needs strict isolation. Use a virtual machine with no shared folders, take a snapshot before each test, and keep the network disconnected or routed through a controlled environment. Never test suspicious files on a work or personal computer.
Example Scenario
An employee receives an email that looks like an invoice. The attached document asks the user to enable macros. A security analyst opens the file in a sandbox, and the sandbox report shows the document contacting an unknown server and creating a hidden program. The team blocks the server, removes the email from all inboxes, and warns staff.
Protection Steps
- Keep operating systems and apps updated.
- Use trusted antivirus and endpoint protection.
- Back up important files offline and test the backups.
- Disable macros from unknown sources.
- Train staff to spot suspicious emails.
- Limit user rights so a single infection stays small.
Legal Reminder
Writing, spreading, or deploying malware against others is a crime. Ethical hackers study samples from approved research sources only and follow their country's laws.
Indicators of Compromise
Analysts collect clues that prove an infection took place. These clues, called indicators of compromise, include file hashes, strange domain names, unusual registry entries, and odd file locations. Teams share indicators with other defenders, so one discovery protects many organizations.
Backups Beat Ransomware
Offline backups give victims a way to recover without paying criminals. Store at least one copy on a disconnected drive or a locked cloud space, and practice restoring from it every few months.