Very often people call everything that corrupts their system as virus, not aware of what it actually means or does. This paper systematically gives an introduction to different varieties of beasts that come under the wide umbrella called as malware, their distinguishing features, prerequisites for malware analysis and an overview of malware analysis process.
What is Malware?
The genesis of Computer viruses started in early 1980 when some researchers came up with self-replicating computer programs. In 1984 Dr. Cohen provided a definition for computer viruses. Here is Cohen's informal definition of a computer virus:
"A virus is a program that is able to infect other programs by modifying them to include a possibly evolved copy of itself."
This definition, based on the behavior of programs of that period was appropriate. However over time, viruses have evolved into dozens of different categories and are now termed as malware collectively instead of virus. Virus is considered as one category of malware.
Malware, short for, MALicious softWARE. It is software specifically designed to harm user’s computer data in some way or the other. Malwares have evolved with technology and have taken advantage of new developments.
Malware consists of programming (code, scripts, active content, and other softwares) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior. The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.
Symptoms of infected system
How do you know that your system is infected with possible malware? Following are some of the symptoms of an infected system:
- System might become unstable and respond slowly as Malware might be utilizing system resources
- Unknown new executables found on the system
- Unexpected network traffic to sites where you don’t expect to connect
- Altered system settings like browser homepage without your consent
- Random pop-ups are shown as advertisements
- Recent addition to the set are alerts shown by fake-security application that you never installed like “Your computer is infected!” and it asks to register the program to remove detected threats.
Overall, your system will have unexpected behavior.
The category of malware is decided based upon different parameters like how it affects the system, functionality or the intent of the program, spreading mechanism, and whether program asks for users' permission or consent before performing these operations.
A program that can be regarded as malware if it does one of the following activities:
- modifies another program
- replicates through a network or a file system without users’ consent
- allows an unauthorized person to take control over a remote system
- sends personal or confidential information to a remote system without user’s consent
- sends data to a system in order to disrupt normal functioning
- opens port for listening on local machine to accept commands from control server
- record keystrokes and send this information to remote servers
- connects to suspicious remote servers
- downloads and executes files from suspicious remote servers
- copy itself to multiple locations
- injects code into another program
- makes unauthorized changes to the system
- modifies a protected system setting
- modifies a registry setting used for launching programs upon startup
Now we will specific malware categories based on distinguishing malicious features of the sample:
Virus is the first category of malware to appear on the horizon of Computer Security. They are self-replicating in nature and are referred to as parasitic infectors. They don't have separate existence; however they insert their code into existing files on the system. They could be executable programs or scripts of different programming languages like VBS, JS, Perl etc.
Worm are self-replicating; however they are stand-alone malware. They don't modify other files to spread, instead makes copies of own over network shares or on other systems. Worms are further classified based upon spreading mechanism used like Email, P2P, IRC etc.
Trojan is disguised as useful software and tempts user to install it and it is bundled with hidden malicious functionality. They are non-replicating in nature, i.e. they don't spread themselves as in case of viruses or worms.
Backdoor allow unauthorized access to compromised system by opening a port on victim’s system. This creates a pathway for hackers to control the compromised system by sending commands of his choice. SubSeven, Netbus and Back Orifice are some of the well-known examples of Backdoor which enables unauthorized people to access users' system over the Internet without his/her knowledge.
Fig. 1 Backdoor.SubSeven
HackTool is used by a hacker to attack and exploit users' system to gain unauthorized access to system resources. They attempt to gain information on the system bypassing security mechanisms inherent to the system. netcat is an example of HackTool. Sometimes it is used by Network Administrators; however it is used by hackers to get unauthorized access and to transmit data on network.
Spyware is software that gathers personal or confidential information from users' system without his knowledge. It includes monitoring on victims system to collect information like his browsing habits, recently visited sites, passwords, credit card information, and other such confidential information. Once Spyware is installed, it doesn’t have any visible notification to indicate it’s monitoring users' activities. It sends this information to the configured remote server.
Rootkit use stealth technique to actively hide its presence by hiding it components like files, registry key, running processes and other objects. These techniques are used to hide its behavior from user and to bypass detection from security applications.
These are fake applications which pose themselves as Security Applications or System Tools to mislead user into paying for removal of non-existent malwares or issues with users' system. This category of malware is on rise of from last 4-5 years. They use different Social Engineering techniques to mislead the user into installing it. Its downloader component may come as a video codec to run certain video clips, P2P software or trojanized shared applications. Malware writers use SEO poisoning technique to push malicious urls based on recent popular news. When user visits such malicious urls, it gets downloaded using drive-by-download technique by exploiting vulnerabilities in web browser and its plugins.
Fig. 2 Rogue Application – System Security
An infection vector refers to spreading mechanism used by malware.
- Boot Sector: Infecting Master Boot Record of the physical disk
- File infection: Parasitic infectors
- Email: Email worms
- File shares: Parasitic infectors, worms
- Network: Network worms, through vulnerabilities
- IRC: Internet Relay Chat
- P2P networks: IM, Kazaa, etc.
- Removable Media: Floppy, USB Disks
- Bluetooth: Worms for mobile devices
- Web Apps: Using cross-site scripting vulnerabilities
- Vulnerabilities: Operating system, Web Browser & plugins, Adobe Reader vulnerabilities
Prerequisites for Malware Analysis
Now being equipped with the knowledge of what malware is, you may want to look at it more closely. Natural question might come to your mind is, “how to analyze malware?”Prerequisites for Malware Analysis include understanding of malware classification, essential x86 assembly language concepts, file formats like Portable Executable file format, Windows APIs, expertise in using Monitoring tools, Disassemblers and Debuggers. This section will introduce you with prerequisites for malware analysis.
Cheat sheet of x86 assembly language