System Hacking Phases and Attack Techniques · Topic 6 of 6
Viruses, Worms, Fileless Malware, Analysis and Anti-Malware
Learn virus types and life cycle, worms, fileless malware, static and dynamic malware analysis, malware countermeasures and anti-malware detection methods.
- 5 min
- The virus life cycle: design, replication, launch, detection, incorporation, elimination.
- Polymorphic changes the decryptor or code, metamorphic rewrites the whole body.
- A worm spreads by itself, a virus needs a host and a user action.
What it is
Viruses and worms are self-replicating malware that differ in how they spread. Fileless malware avoids writing a program to disk, which makes it harder to find.
Malware analysis is the study of a sample to learn what it does, and anti-malware software and other countermeasures are the defenses.
How it works
Virus concepts
A virus attaches itself to a host file or program and needs a user action to run. It replicates by infecting other files.
The virus life cycle has six stages.
A virus is designed, replicates in a target, launches when the host runs, is detected by users or defenders, is added to anti-virus databases (incorporation) and is finally removed (elimination).
| Virus type | Description |
|---|---|
| Boot sector | Infects the start-up area of a disk |
| File | Infects executable files |
| Macro | Written in the macro language of a document or spreadsheet |
| Multipartite | Infects both boot areas and files |
| Polymorphic | Changes its own code at each infection to avoid signatures |
| Metamorphic | Rewrites its whole body each generation |
| Stealth | Hides changes by intercepting system calls |
| Encryption | Encrypts its body with a changing key |
| Companion | Creates a separate file that runs in place of the original |
Worm concepts
A worm is a standalone program that spreads across networks by itself, using vulnerable services, email or shared folders. It needs no host file and no user action once started.
| Feature | Virus | Worm |
|---|---|---|
| Needs host file | Yes | No |
| Needs user action | Usually | No |
| Spreads by | Infecting files | Copying itself over networks |
| Main effect | Corrupts files and programs | Consumes bandwidth, installs payloads |
Worms spread fast, and one flaw in a network service can infect large numbers of unpatched machines in hours. WannaCry in 2017 is a well-known example of a ransomware worm that used a Windows file sharing flaw.
Fileless malware concepts
Fileless malware does not leave an executable on disk, so signature-based scanning has little to examine. It runs in memory, or it lives in places such as the registry, and it uses trusted tools already on the system, an approach called living off the land.
| Form | Example |
|---|---|
| Memory-only | Code injected into a running process |
| Script-based | PowerShell or other scripts started from a macro or link |
| Registry-resident | Code stored in a registry value and started at login |
Detection depends on behavior. Defenders log script execution, restrict scripting tools, use endpoint detection and response and watch for unusual child processes of Office programs and browsers. Restarting clears memory-only code, but persistence methods may bring it back.
Malware analysis
Analysts study a sample in an isolated environment, usually a virtual machine with snapshots and no connection to production networks.
| Approach | What it does | Examples |
|---|---|---|
| Static analysis | Examines the file without running it | Hashes, readable strings, file headers, packer detection, disassemblers such as IDA and Ghidra |
| Dynamic analysis | Runs the sample and watches behavior | Sandboxes such as Cuckoo, Process Monitor, Regshot, Wireshark |
| Behavioral analysis | Looks at what the sample changes and contacts | Files, registry, processes, network connections |
A hash of the sample can be looked up on services such as VirusTotal. Static analysis is safer but can be blocked by packing and obfuscation. Dynamic analysis shows real behavior, but some malware detects virtual machines and sandboxes and stays quiet.
The analysis ends with indicators of compromise: file hashes, domains, addresses, registry keys and mutex names, which are used for detection rules.
Malware countermeasures
- Keep operating systems and applications patched.
- Use anti-malware software with automatic updates.
- Block macros and risky attachment types, and filter email and web content.
- Apply least privilege and application allow lists.
- Segment the network so that worms cannot spread freely.
- Back up data offline and test restoration, which defeats ransomware.
- Train users about phishing and unknown downloads.
- Monitor network traffic and logs, and keep an incident response plan.
Anti-malware software
| Detection method | How it works | Weakness |
|---|---|---|
| Signature-based | Compares files with a database of known patterns | Misses new and polymorphic malware |
| Heuristic | Looks for suspicious code traits | More false positives |
| Behavior-based | Watches actions at run time | Can be late if damage is quick |
| Sandboxing | Runs files in a safe environment | Can be evaded by sandbox-aware malware |
| EDR and XDR | Records endpoint activity for detection and response | Needs tuning and skilled staff |
A worked example
A finance user opens a spreadsheet and a script runs in memory. No file is dropped and the antivirus is silent, but the endpoint tool alerts that a spreadsheet program started PowerShell with an encoded command. The team isolates the host, collects the script, and finds a registry value that restarts it at login.
How the exam asks about this
- "Which virus changes its own code at each infection?" -> A polymorphic virus.
- "Which type of analysis runs the sample and watches what it does?" -> Dynamic analysis.
- "Which malware leaves no file on disk and uses legitimate tools?" -> Fileless malware.
What to remember for the exam
- The virus life cycle: design, replication, launch, detection, incorporation, elimination.
- Polymorphic changes the decryptor or code, metamorphic rewrites the whole body.
- A worm spreads by itself, a virus needs a host and a user action.
- Static analysis does not run the sample, and dynamic analysis does.
- Signature-based detection misses new malware, while behavior and heuristic methods find it.
Always run suspicious samples in an isolated lab with no path to production networks.
Common mistakes
Treating polymorphic and metamorphic as the same. Metamorphic malware rewrites itself entirely, while polymorphic mainly changes its encryption and form.
Relying on signatures alone. New and fileless malware has no signature.
Analyzing on a connected machine. An analysis environment must be isolated and restorable.
Check yourself
What is the main difference between a virus and a worm?
A virus needs a host file and usually a user action, while a worm spreads on its own across networks.
Why is fileless malware hard to detect?
It leaves no file on disk, so signature scanning has little to inspect, and it uses trusted system tools.
Name one benefit of dynamic analysis.
It shows what the sample actually does, such as files changed and network connections made.
Topic 6 of 6 in System Hacking Phases and Attack Techniques
Test yourself on System Hacking Phases and Attack Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.