Malware and Antivirus Flashcards

What is a polymorphic virus?

Answer: A virus that changes its code each time it replicates to evade signature-based detection

Polymorphic viruses mutate their code with each replication cycle, producing functionally identical but code-different variants that evade detection by static signature matching.

What role does a sandbox play in malware analysis?

Answer: It provides an isolated virtual environment where suspicious code can be safely executed and observed without risking the host system

A sandbox is a controlled, isolated environment where potentially malicious software can be safely executed and its behavior observed without any risk to the actual system or network.

What is a supply chain attack in the context of malware distribution?

Answer: Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users

Supply chain attacks compromise trusted software vendors, update mechanisms, or development tools to inject malware into legitimate software, affecting all users who install the compromised update.

What is the purpose of endpoint detection and response (EDR) solutions?

Answer: To continuously monitor endpoints for suspicious behavior, detect threats, and enable rapid investigation and response

EDR solutions provide continuous monitoring of endpoint activities, using behavioral analysis to detect suspicious patterns and enabling security teams to investigate and respond to threats in real time.

What is a logic bomb in the context of malware?

Answer: Malicious code that remains dormant until a specific condition or date triggers its execution

A logic bomb is hidden malicious code programmed to activate when specific conditions are met, such as a certain date, a user action, or the deletion of a specific account.

How does ransomware-as-a-service (RaaS) operate?

Answer: Criminal developers create and lease ransomware tools to affiliates who carry out attacks, sharing the ransom profits

RaaS is a criminal business model where ransomware developers create the malware and infrastructure, then recruit affiliates to deploy the ransomware, splitting the ransom payments.