Every malware out there in the jungle has a job to do. Whether it is to choke up your network or steal your money, malware is designed with an objective. This objective is known as its payload. This is the damage the malware causes to our systems or network. From a network forensic investigation perspective, it is very important for us to understand what the payload of the malware is. This helps us in identifying the extent of damage caused by the malware and figuring out how to contain, counter, or prevent the damage caused.
These payloads can be any of the following:
- Destructive
- Theft of identity
- Espionage
- Financial fraud
- Theft of data
- Misuse of resources
Let's take a brief look at each of these.
While most payloads are destructive in one way or another, some malware specialize in carrying out focused destructive activity.
In a number of cases, destructive payloads can be easy to identify and can include crashing the infected system or device. This could also involve data corruption, modification or deletion of files, even the formatting of media, and destruction of all contents.
Some malware are designed to spread themselves across the network. Other than the self-propagation angle, this can cause a major degradation in the network's performance.
Malware has also been known to destroy hardware and make computers totally non-functional. One such early computer killer was the CIH virus that affected the BIOS on certain motherboards.
A very common objective of malware is identity theft. Malicious spyware monitors all the activity with the intention of grabbing information related to your identity.
The malware focuses stealing information related to the following:
Malware has been employed at the forefront of espionage by both good and bad guys. Where state players have used malware to gather information on friends and foes alike, criminals have successfully used malware for the purposes of gathering information on potential targets. Malware has also been successfully employed to conduct industrial espionage.
In fact, malicious software such as Dino and Regin are indicative of the sophistication of the cyber weapons that have been developed for the purpose of espionage. The structure of these malware displays a degree of customizability, which allows the controllers to use them for mass surveillance and targeted spying.
The degree of technical competence and sophistication that these weapons show are indicative of the considerable resources expended on their development. The expense of building such formidable cyber weapons seems to indicate the involvement of state-level actors.
As a digital 007, it becomes very important for us to understand, detect, and identify espionage malware and its actions.
A common piece of investigative wisdom in the forensics industry is follow the money. Unfortunately, this is exactly what cyber criminals like to do. Some very sophisticated malware is targeted towards electronic financial transactions as well as extracting funds with electronic blackmail.
A fairly common use is identifying people in international trade and monitoring their interactions with buyers or suppliers. As soon as the goods are shipped, cyber criminals step in and while impersonating the shipper, ask the buyer to deposit the due funds in another account. Once the money is transferred, the funds are quickly withdrawn or moved so that the money cannot be easily traced or recovered.
A currently prevalent malware specializes in encrypting data on systems and then demands a ransom for decrypting it. In case the ransom is not paid, the criminals threaten to leak the decrypted data on the Web. While people may be able to put up with the loss of their data, they are less likely to accept the idea of having their confidential data suddenly appearing online.
If there is one thing that is common across the board, it is data theft. In most cases of malware use (except some of the ones earlier mentioned), monetization of the malware happens in conjunction with data theft. Some malware focus on user credentials and financial details, some focus on images and videos, and others harvest documents and communications. Theft of trade secrets is also fairly common.
Most malware tends to establish itself in a compromised system and then moves on to the (mis)use the resources that are available for the system. Malware can assimilate a computer as part of a botnet. It can be used to automate spam or carry out distributed denial-of-service attacks. Compromised computers can also be used for mining crypto currencies such as Bitcoin. Such computers are also used to attack, infect, or recruit other computers or devices for the criminal's nefarious purposes. They have also been known to be used for spying, surveillance, and stalking of targets.