Q:

1. Which networking libraries does the malware use, and what are their advantages?

Q:

2. What source elements are used to construct the networking beacon, and what conditions would cause the beacon to change?

Q:

3. Why might the information embedded in the networking beacon be of interest to the attacker?

Q:

4. Does the malware use standard Base64 encoding? If not, how is the encoding unusual?

Q:

5. What is the overall purpose of this malware?

Q:

6. What elements of the malware’s communication may be effectively detected using a network signature?

Q:

7. What mistakes might analysts make in trying to develop a signature for this malware?

Q:

8. What set of signatures would detect this malware (and future variants)?

Q:

1. What are the advantages or disadvantages of coding malware to use direct IP addresses?

Q:

2. Which networking libraries does this malware use? What are the advantages or disadvantages of using these libraries?

Q:

3. What is the source of the URL that the malware uses for beaconing? What advantages does this source offer?

Q:

4. Which aspect of the HTTP protocol does the malware leverage to achieve its objectives?

Q:

5. What kind of information is communicated in the malware’s initial beacon?

Q:

6. What are some disadvantages in the design of this malware’s communication channels?

Q:

7. Is the malware’s encoding scheme standard?

Q:

8. How is communication terminated?

Q:

9. What is the purpose of this malware, and what role might it play in the attacker’s arsenal?

Q:

1. What hard-coded elements are used in the initial beacon? What elements, if any, would make a good signature?

Q:

2. What elements of the initial beacon may not be conducive to a long-lasting signature?

Q:

3. How does the malware obtain commands? What example from the chapter used a similar methodology? What are the advantages of this technique?

Q:

4. When the malware receives input, what checks are performed on the input to determine whether it is a valid command? How does the attacker hide the list of commands the malware is searching for?

Q:

5. What type of encoding is used for command arguments? How is it different from Base64, and what advantages or disadvantages does it offer?

Q:

6. What commands are available to this malware?

Q:

7. What is the purpose of this malware?

Q:

8. This chapter introduced the idea of targeting different areas of code with independent signatures (where possible) in order to add resiliency to network indicators. What are some distinct areas of code or configuration data that can be targeted by network signatures?

Q:

9. What set of signatures should be used for this malware?