CySA+ Test Malware Analysis Flashcards

Which term describes malware that operates entirely in memory without writing files to disk, making detection by traditional AV difficult?

Answer: Fileless malware

Fileless malware resides in RAM and leverages native tools like PowerShell or WMI, leaving no file-based artifacts on disk.

An analyst identifies malware that changes its code on each infection cycle to evade signature detection. Which technique is this?

Answer: Polymorphism

Polymorphic malware mutates its code or signature with each replication while maintaining its original functionality.

Which CySA+ concept refers to indicators that describe malware behavior patterns rather than static file hashes?

Answer: TTP (Tactics, Techniques, and Procedures)

TTPs describe the behavioral patterns attackers use, making them more resilient indicators than static hashes that change with each malware variant.

A malware sample is found to replace a legitimate Windows process in memory with malicious code. Which technique is this?

Answer: Process hollowing

Process hollowing unmaps a legitimate process's code from memory and replaces it with malicious code while keeping the trusted process shell intact.

Which framework maps malware behaviors and attacker techniques to specific tactics, helping analysts classify malware activity?

Answer: MITRE ATT&CK

MITRE ATT&CK provides a comprehensive knowledge base of adversary tactics and techniques observable in malware analysis.

During malware analysis, an analyst observes periodic outbound connections at fixed intervals. Which behavior does this describe?

Answer: Beaconing

Beaconing is when malware sends regular, timed check-in signals to a C2 server, indicating an active infection awaiting commands.