Master10
Cybersecurity & Digital Safety Module

Malware, Ransomware & Trojan Threats

Malicious software represents a broad spectrum of hostile code engineered to compromise system integrity, exfiltrate confidential data, or disrupt network operations. Key classifications include self-replicating worms that propagate across network vulnerabilities without user intervention, Trojan horses disguised as legitimate software, and low-level rootkits that conceal persistence mechanisms within operating system kernels. Ransomware variants, such as WannaCry and LockBit, deploy asymmetric cryptographic algorithms like RSA-2048 and AES-256 to encrypt local storage drives before demanding cryptocurrency ransoms. Modern endpoint detection and response (EDR) platforms deploy heuristic behavior analysis, signature matching, and sandboxed execution environments to intercept malicious payloads before lateral movement occurs.

Key Concepts & Examination Highlights

  • Worms propagate autonomously across network protocols without requiring host file attachment or human interaction.
  • Ransomware commonly utilizes hybrid encryption (combining AES for symmetric payload speed and RSA for secure asymmetric key exchange).
  • Rootkits alter kernel-level system calls to hide malicious processes and registry modifications from traditional antivirus scanners.
  • Spyware and keyloggers covertly monitor keystrokes and capture sensitive data to transmit back to command-and-control servers.
  • Spyware covertly monitors user activities, keystrokes, browsing habits, and personal credentials, transmitting the captured data to remote unauthorized servers.
  • A rootkit is a collection of stealthy malicious software tools that grants privileged root or administrator-level access to a system while hiding its own presence and active processes.
  • A Botnet is a coordinated network of internet-connected compromised computers (zombies) controlled remotely by a botmaster to execute massive Distributed Denial of Service (DDoS) attacks.
  • The WannaCry ransomware attack of May 2017 infected over 200,000 computers globally across 150 countries by exploiting the EternalBlue SMB vulnerability in unpatched Windows operating systems.
  • Zero-day vulnerabilities are undisclosed software security flaws unknown to the software vendor for which no official security patch is yet available, leaving systems open to exploitation.
  • Keyloggers are hardware or software surveillance tools that record every keystroke entered by a user on a keyboard, capturing usernames, passwords, and sensitive financial credentials.
  • Polymorphic malware dynamically alters its identifiable code features and digital signatures with each replication cycle to evade traditional signature-based antivirus detection.
  • A computer virus is a malicious program that attaches itself to a legitimate host executable file and requires human action (such as executing the infected file) to replicate and spread.
  • A Trojan horse is deceptive malware disguised as legitimate software (such as utility tools or games) that tricks users into executing it, creating covert backdoors into the operating system.
  • Ransomware as a Service (RaaS) is a subscription-based cybercrime business model where malware developers lease ransomware strains to affiliates who execute attacks and share ransom profits.
  • Double extortion ransomware not only encrypts the victim's data files but also exfiltrates sensitive proprietary documents, threatening public publication on dark web leak sites if the ransom is unpaid.
  • Command and Control (C2) servers are centralized servers used by cybercriminals to send remote commands and receive stolen exfiltrated data from infected botnet devices.
  • Stuxnet, discovered in 2010, was a sophisticated cyber weapon designed to target Siemens industrial programmable logic controllers (PLCs), sabotaging uranium enrichment centrifuges at Natanz, Iran.
  • Fileless malware executes directly in a computer's volatile RAM memory using native administrative operating system tools (such as PowerShell and WMI) without dropping executable files on the hard disk.
  • Adware is software that automatically generates unwanted advertisements and banners, frequently bundled with freeware downloads to collect user browsing habits without informed consent.
  • Logic bombs are malicious code snippets deliberately inserted into software that remain dormant until triggered by a specific event or condition, such as a date or employee termination.
  • Man-in-the-Middle (MitM) attacks occur when an adversary intercepts and potentially alters communication between two legitimate parties who believe they are communicating directly with each other.
  • Endpoint Detection and Response (EDR) tools continuously monitor endpoint behaviors, analyze system logs, and execute automated response playbooks to isolate infected hosts upon detecting malware.
  • Sandboxing is an isolated virtual security environment where suspicious files, email attachments, and unknown code are executed and analyzed safely to observe malicious behavior without risking production systems.
  • Cryptojacking is the unauthorized hijacking and use of a victim's computing hardware (CPU/GPU) resources to mine cryptocurrencies like Monero in the background.
  • Metamorphic malware completely rewrites and restructures its internal code engine with every replication, making heuristic and pattern-matching detection significantly more difficult than simple encryption.
  • A computer virus consists of an infection mechanism (which spreads the code), a trigger (which initiates execution), and a payload (which delivers the malicious damage).
  • Macro viruses are written in application scripting languages (such as Visual Basic for Applications, VBA) and infect documents, spreadsheets, and templates in productivity suites.
  • Boot sector viruses infect the Master Boot Record (MBR) or volume boot record of storage drives, executing before the operating system initializes during the boot process.
  • A worm contains autonomous self-propagating code that scans networks for vulnerable unpatched ports and services (such as EternalBlue exploiting SMBv1), replicating without host files.
  • The Morris Worm, released in November 1988 by Robert Tappan Morris, was the first recognized computer worm distributed across the ARPANET, infecting roughly 10% of connected systems.
  • The ILOVEYOU worm, released in May 2000, infected millions of Windows computers worldwide via a malicious VBScript attachment distributed through Outlook email address books.
  • The SQL Slammer worm in 2003 exploited a buffer overflow vulnerability in Microsoft SQL Server, infecting over 75,000 servers within 10 minutes via UDP port 1434.
  • A Remote Access Trojan (RAT) is malware that grants an attacker full interactive graphical or command-line administrative control over a compromised victim device.
  • Banking Trojans (such as Zeus, Emotet, and TrickBot) use web injection and man-in-the-browser (MitB) techniques to steal online banking credentials and bypass two-factor authentication.
  • Information stealers (Infostealers, such as RedLine, Raccoon, and Vidar) are lightweight malware programs designed to harvest saved browser passwords, session cookies, and crypto wallets.
  • Keyloggers can be software-based (using API hooks like SetWindowsHookEx) or hardware-based (physical dongles plugged between keyboards and USB ports).
  • Ransomware typically encrypts user data files with strong symmetric encryption (AES-256 or ChaCha20) and encrypts the symmetric decryption key using an asymmetric public key (RSA-2048 or Curve25519).
  • Triple extortion ransomware combines data encryption and data theft with Distributed Denial of Service (DDoS) attacks and direct harassment of the victim's customers and partners.
  • NotPetya, deployed in June 2017, was a destructive wiper malware disguised as ransomware that exploited EternalBlue to wipe MBRs and permanently destroy data across multinational firms.
  • Wiper malware (such as HermeticWiper and Shamoon) is designed solely to corrupt, overwrite, and permanently destroy hard drive partition tables and data without providing decryption options.
  • Stuxnet utilized four zero-day vulnerabilities and stolen digital certificates to manipulate the rotational frequency of centrifuge frequency converter drives at Natanz nuclear facility.
  • Kernel-level rootkits (Ring 0 rootkits) execute with the highest operating system privileges, allowing them to hook SSDT (System Service Descriptor Table) functions and hide from antivirus tools.
  • Hypervisor rootkits (Ring -1 rootkits) virtualize the underlying hardware and run the host operating system inside an unauthorized virtual machine to evade all kernel-level security monitoring.
  • Fileless malware uses 'Living-off-the-Land' binaries (LOLBins, such as powershell.exe, certutil.exe, and mshta.exe) to execute malicious memory payloads without triggering file scans.
  • Drive-by downloads occur when a user visits a compromised website and malicious scripts exploit browser vulnerabilities to silently download and execute malware without user consent.
  • Malvertising is the injection of malicious advertisements into legitimate online advertising networks to redirect users to exploit kits or drop malware payloads.
  • A cryptominer (cryptojacker) utilizes CPU and GPU compute resources to solve cryptographic proof-of-work hashes for cryptocurrencies like Monero, causing hardware overheating and system slowdowns.
  • Signature-based antivirus detection relies on matching static byte sequences and cryptographic hashes (MD5, SHA-256) of files against known malware databases.
  • Heuristic analysis and behavioral monitoring in modern antivirus scanners detect novel zero-day malware by identifying suspicious execution patterns, unauthorized process injections, and registry modifications.
  • Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms collect telemetry across endpoints, networks, and cloud logs to detect and isolate cyber threats in real time.
Curriculum & Reference Sources: Indian Computer Emergency Response Team (CERT-In), NIST Cybersecurity Framework, CISA Malware Analysis

Sample Solved Questions & Concept Explanations

8 Verified Concept Questions
Q1.MEDIUM

Which category of malicious software encrypts a victim's files and demands payment in cryptocurrency before providing a decryption key?

Q2.EASY

What distinguishes a computer Worm from a traditional computer Virus?

Q3.EASY

What type of malware is disguised as legitimate, useful software (like a game or utility) but secretly installs a backdoor for malicious access?

Q4.EASY

Which category of spyware secretly logs every key pressed on a keyboard to capture sensitive passwords, credit card numbers, and messages?

Q5.EASY

What term describes software that automatically renders unwanted pop-ups, banners, and promotional adverts on a computer screen, often tracking search habits?

Q6.EASY

What stealth malware grants an attacker persistent administrator or root-level privileges on an operating system while actively concealing its presence from antivirus scanners?

Q7.EASY

What is a network of hijacked internet-connected computers and IoT devices controlled remotely by a cybercriminal Command-and-Control (C2) server called?

Q8.EASY

What security software analysis method examines program code structure and behavioral characteristics rather than matching known static byte hashes?