Generally, all malware of the same type share the same needs, regardless of the platform:
- It needs to get into the target system.
- In many cases, it needs to achieve persistence in order to survive the reboot.
- It may need to get a higher level of privileges, for example, to achieve the system-wide persistence or to get access to the valuable data.
- In many cases, it needs to communicate with the remote system (C&C) in order to do the following:
- Get commands
- Get new configuration
-
- Get self-updates, as well as additional payloads
- Upload responses, collected information, and files of interest
- Some malware families behave like worms, aiming to penetrate deeper into reached networks; this activity is commonly called a lateral movement.
The implementation depends on the target systems as they may use different default tools and file paths. In this section, we will go through common attack stages and provide examples of actual implementations...