Tag Info

New answers tagged

1

It depends which malware and what it was designed to do. If the malware author wants so, the malware could either attack other computers on the network (not necessarily Internet, just two computers connected to a network for example to share files) and try some exploits on them, in hopes that one of them isn't patched on the target machine and thus that ...


0

With meterpreter (some) common activities of an attack may include: 1. Process injection/migriation 2. Password dumping 3. Logging keystrokes 4. Loading more malware 4. Opening new ports/services 5. Adding new users Uploading/downloading files Some AV will pick up a plain meterpreter exe dropped on a system, if for example it's sent as part of a ...


2

Different antivirus software packages have different detection capabilities and mechanisms. Virtually all support what is called a signature-based mechanism, where a particular series of bytes serves as a fingerprint that triggers a positive detection. It's important to understand this use of the word "signature" is completely different than a digital ...


5

Yes - this example is pretty old, but Magic Lantern was a spyware program written by the FBI that some antivirus vendors initially decided to whitelist. Wikipedia The public disclosure of the existence of Magic Lantern sparked a debate as to whether anti-virus companies could or should detect the FBI's keystroke logger. Concerns include ...


44

Yes. There are a number of ways: Directly patch Task Manager's process at runtime so that its enumeration code skips over your process. Run "processless", by loading a DLL into a process (e.g. via AppInit_DLLs) or injecting code into process memory and starting a thread (via VirtualAllocEx / WriteProcessMemory / CreateRemoteThread). Hook the Process32First ...


4

Certainly - there are several ways of hiding from the task manager. The simplest is to hide in plain sight with the process named something innocuous. Another option is to hide as a sub-process which then doesn't show up. It could also install as a service, again with an innocent name. It would show in the list of services but wouldn't be shown separately ...


1

A 'mail scanner' is not necessary with most modern webmail providers. Most modern webmail providers will scan your email and remove any malware. In addition if the user has a standard Antivirus installed it should catch anything else (download links, etc) when the file is downloaded and created. You can test this by sending your user a EICAR test file: ...



Top 50 recent answers are included