Malware

Introduction

Welcome to the Malware Practice Lab. In this module you will be provided with the instructions and devices needed to develop your hands-on skills.

Learning Outcomes

In this module, you will complete the following exercises:

• Exercise 1 - Run Sample Virus Application

After completing this lab, you will be able to:

• Understand how malware would manifest itself

Exam Objectives

The following exam objectives are covered in this lab:

• Understand malware - viruses

Lab Duration

It will take approximately 30 minutes to complete this lab.

Exercise 1 - Run Sample Virus Application

Malicious ware also called “Malware” is a general term used for referring to an array of hostile software such as viruses, worms, Trojans horses, adware, rootkits, ransomware, scareware, backdoors and other harmful programs intended to corrupt, alter, steal or destroy data eventually denying users access to system resources.

Viruses must be executed and generally requires a host program to able to deliver its payload on a computer system. An example is Office macro virus that requires Office apps that use macros for automating repetitive tasks.

Worms do not entail a host program and will be able to infect an unpatched computer system and replicate itself.

Trojan horse is a malware that masquerades itself as a legitimate application and misleads users of its true intent which is to steal information from a computer system.

Adware is a program designed to display advertisements in the user interface of the software to generate revenue for its developer. It is not intended to cause system damage however it can cause annoyance and distraction to a user as it appears occasionally.

Rootkit is a malware intended to provide intruders with administrative access to a computer undetected and can be used to control it remotely. This malware can be installed by software and third party application extensions that appear safe. Most antivirus vendors use a root kit scanner to detect and remove this type of malware.

Ransomware is malicious software that takes over a computer and denies the user access to data. The intruder demands a ransom promising to restore access to data upon payment.

Scareware is malware that tricks the unsuspecting user into purchasing and downloading non-essential and potentially suspicious software like a fake antivirus security product.

Backdoor is a generally a secret portal for bypassing system security undetected to perform maintenance. Similarly, it can refer to an undocumented portal used by hackers to gain access then steal a computer’s proprietary data.

For this lab exercise, a sample virus application called eicar.com created by the European Institute for Computer Antivirus Research (EICAR). This file will test the functionality of installed anti-malware in Windows 10. Due to the security policy implemented in the labs, it is not possible to use real malware that will cause problems on the computers.

Learning Outcomes

After completing this exercise, you will be able to:

• Understand how malware would manifest itself