haadi@portfolio:~$ cat malware-classification.md
Room notes · SOC Level 1 · Malware concepts for SOC
Malware Classification
A taxonomy of malware types: what each does, how to recognize it from behavioral symptoms, real-world examples, and the difference between binary and script-based malware.
What This Room Covers
A taxonomy of malware types: what each does, how to recognize it from behavioral symptoms, real-world examples, and the difference between binary and script-based malware.
Key Concepts Learned
Malware Classification by Behavior
| Type | What It Does | SOC Detection Signal |
|---|---|---|
| Cryptominer | Uses CPU/GPU to mine cryptocurrency | Sustained high CPU usage, unusual process consuming resources |
| Ransomware | Encrypts files and demands payment | Mass file modification events, shadow copy deletion, ransom note creation |
| Adware | Generates unwanted ads | Browser process spawning popups, unusual browser extensions |
| Data Stealer | Exfiltrates credentials and documents | Outbound connections to C2, file access on sensitive directories |
| Keylogger | Records keystrokes | Hook-based process injection, credential theft from memory |
| Spyware | Monitors user activity silently | Persistent background processes, microphone/camera access |
| Wiper | Destroys data rather than encrypting it | Mass file deletion/overwrite, no ransom demand |
| C2 Malware | Provides remote attacker control | Periodic outbound connections (beaconing), reverse shell traffic |
Real-World Malware Families
- Agent Tesla: keylogger and credential stealer, delivered via phishing, very common in Pakistan-targeted campaigns
- Pegasus: zero-click mobile spyware, targets journalists and government officials
- Akira: ransomware that steals data first, then threatens to leak if ransom unpaid (double extortion)
- Shamoon: wiper malware targeting energy sector, overwrites files with junk data
Binary vs Script-Based Malware
Binary malware (.exe, .dll, .bat) leaves identifiable byte patterns that antivirus can signature. Script-based malware (PowerShell, VBScript, JavaScript) runs in memory using trusted interpreters: harder to detect, no file-based signature. PowerShell is the most commonly abused scripting tool for malware delivery.
Task Answers
| Question | Answer |
|---|---|
| High CPU usage malware type | Cryptominer |
| Files encrypted, cryptocurrency demanded | Ransomware |
| Browser popups, no data stolen | Adware |
| Internal documents leaked online | Data stealer |
| Keylogger collecting credentials and screenshots | Agent Tesla |
| Zero-click mobile spyware | Pegasus |
| Ransomware that steals and threatens to leak data | Akira |
| Malware that overwrote files with junk data (energy sector) | Shamoon |
| Command-line tool used by script-based malware to download payloads | PowerShell |
| File extension associated with Windows executables other than .exe | .bat |
| Malware type more likely to leave identifiable byte patterns | Binary |
| Final flag | THM{Malwar3_cl4ss1fication_p4ss3d} |
Key Concepts for SOC Work
Ransomware detection must happen at earliest kill chain stage possible. By the time encryption starts, the damage is already done. The pre-ransomware indicators: shadow copy deletion (vssadmin delete shadows), privilege escalation, large-scale file discovery: are the real detection opportunity. These appear in Sysmon and Windows event logs before any file is touched.
Agent Tesla is directly relevant to Pakistan. It is one of the most commonly deployed malware families in phishing campaigns targeting Pakistani organizations. Recognizing its behavior: credential harvesting, keylogging, periodic C2 communication: is operationally important for PKCERT work.
Originally published on GitHub
view-source