Summary: In this blog, we have outlined some common file types susceptible to malware attacks and other cybercrimes. We have also mentioned types of malware attacks, some symptoms of malware attacks, and possible measures to protect against malicious email attachments.
What is Malware?
Malware stands for “MALicious softWARE.” It is a software file or a code that has been designed, specifically, by an attacker. The main motto of the attacker is to get the malware delivered over a network to gain access to or damage a victim’s computer system. In other words, the malware provides remote access control to the attacker to gain illegal access to the infected machine. Malware is being created to steal sensitive data.
Symptoms of malware attack
The following are the symptoms of a malware attack:
- There will be unexpected and annoying pop-up ads on the computer screen.
- A program might get opened, closed, or modify on its own.
- The victim’s computer system might crash. The screen might freeze or turn blue, which is associated with a fatal error on Windows OS.
- There will be an abrupt increase (and a spike) in the system’s internet activity.
- The browser settings of the victim’s web browser might change. The home page might get changed. Along with this, new toolbars, extensions, and plugins may get automatically installed without the consent of the system admin.
- The antivirus antimalware software will stop working automatically and may not be turned back ON.
- In a ransomware attack, the victim may lose access to the computer system or the entire data files. Ransomware attacks are a result of social engineering.
Social Engineering is a manipulative psychological technique that exploits people’s trust to gain private information and access in an unauthorized or criminal way. For example, social engineering attacks scam victims into clicking on a malicious link, downloading a malicious file, or making a fraudulent payment. The victim’s computer resource utilization will be abnormally high. Due to this reason, the speed of the operating system (OS) will be reduced.
Types of Malware
- Viruses: They are the programs that copy themselves into the entire computer system or a network. Viruses corrupt or delete users’ data. They use the user’s email to spread malicious content and erase everything else on a hard drive. Apart from corrupting and destroying users’ data, their main task is replicating at an exponential rate. This further consumes a significant amount of system resources and network bandwidth. Viruses attach themselves to a file or any document that supports macros. Viruses are inactive unless they are clicked and opened by the user.
- Worms: Unlike viruses, worms do not need host programs or document files to get executed. They don’t corrupt or delete users’ data. Like viruses, worms are also self-replicating programs. Their main task is to replicate at an exponential rate, which consumes system resources and network bandwidth.
- Trojan Horse: A Trojan Horse acts as a vehicle for hidden attackers. Unlike viruses and worms, Trojans do not replicate or copy themselves. Instead, they disguise themselves as legitimate software. Once installed, the Trojan activates itself and installs additional malware if the attacker programs it. Trojan Malware is often spread via email attachments, downloads from malicious websites, or direct messages to the user’s inbox. RATs (Remote Administration Tools) usually carry out Trojan horses. RAT is a software program that gives someone the ability to control another device remotely. Once a Trojan horse is transmitted to the victim machine via RATs, they get enabled automatically, allowing administrative control to the attacker. Following this, the attacker can execute any task on the infected computer.
- Spyware: This malware secretly infiltrates devices, collects statistics about the usage of the infected computer, and communicates that information back to the attacker. Botnets, Adware, Backdoor behavior, Keyloggers, data theft, and networms are all spyware.
- Adware: It is malicious software that collects information from the victim’s computer illegally and provides appropriate advertisements based on the collected data. The adware usually redirects the victim’s browser to unsafe websites. These websites may even contain Trojan horses and spyware. All adware is not malicious, but its significant level slows down the computer system. Adware is different from Malvertising. In the case of Malvertising, online advertising is done to spread malware. It involves injecting malicious code or malware advertisements into legitimate online advertising networks and web pages.
- Botnets: It stands for “robot network”. These are the networks of highly infected computers under the control of a single attacking computer, which controls these infected computers. Botnets are highly versatile and adaptable networks. They use infected computers to relay traffic.
- Polymorphic Viruses: These viruses are also called self-encrypted viruses. These viruses use a variable encryption key. Due to this reason, every new copy of the virus is different from its previous copies. These viruses include variable encryption keys to avoid detection by antivirus software. Let us take an example to understand this. Suppose a user went to some website and downloaded an executable (.exe) file. Then another user visits the same website and downloads the same executable file. Both users visit the same link, but two different .exe files will be downloaded into their host systems. Each of these downloaded .exe files contains the same attack code. Even though the attack code is the same, these executable files are encrypted with different keys each time.
- Metamorphic Viruses: These viruses are also called self-programming viruses. This category of virus translates its code and creates a temporary representation. While creating a temporary representation, it makes specific changes to this temporary file and converts itself back to the standard code. Henceforth, each time this category of virus undergoes a transformation, a new different copy of the virus appears. Unlike polymorphic viruses, these viruses don’t use encryption keys. Such kind of transformation helps these viruses to avoid antivirus programs and scanners.
- Ransomware: It uses malicious software to hold valuable files, data, or information for ransom. After a ransomware attack, the operations of the particular organization under threat get severely affected or shut down entirely. A ransomware attack results when a victim has mistakenly downloaded the malware through email attachments or links from unknown resources. Upon installation, it creates a backdoor for attackers to gain access to the victim’s device. It locks the victims out of their devices and encrypts the files. The attacker then forces the victim to pay a ransom to regain access. Ransomware is also known as crypto-malware.
- Rootkits: They are the programs that get to the root-level access of the victim’s computer without the victim’s knowledge. Rootkits grant the cybercriminals remote admin access to the victim’s computer. Rootkits are designed to remain hidden and often hide in the operating system. They often hijack and bring down the security software. Due to this reason, this type of malware lives in the victim’s computer for a longer time and spies on users’ activity, causing significant damage to it. Like other malware, this type also spreads through email attachments and malicious downloads.
- Fileless Malware: This type of malware is also called Memory-Resident malware. It operates from a victim’s computer memory, not the hard drive’s files. Unlike traditional malware, fileless malware does not require a hacker to control it. Fileless malware does not need to install or download malicious software from a remote website to infect the victim’s machine. Another feature of this malware is that it disappears when the system is rebooted. They leave no footprints for antivirus products to detect. Due to this reason, fileless malware can’t be detected using traditional malware detection practices. Like other malware, this malware uses legitimate software on the victim’s computer to execute. Once the attacker penetrates the system, it gains access to native operating system package utilities such as Windows PowerShell and Windows Management Instrumentation (WMI) to carry out the malicious activities. Because many security technologies trust these utilities, malicious activities easily remain undetected, as most such activities are considered legitimate.
- Net-worms: A net-worm finds new host machines to infect using shared media (such as a hard drive or file server) across the network. The shared media can be accessed by multiple computers on a local area network (LAN), such as a company intranet. The net-worm will usually be planted on that shared media to infect every computer that accesses that media. Once transferred to another victim machine, some net-worms get copied to the startup folders of different users. So, every time a user is logged on to the machine, the net-worm gets activated.
- Exploits are toolkits that exploit vulnerabilities in the victim’s computer system. Exploit kits get executed when a victim visits a compromised webpage. A malicious code, usually hidden on the webpage in the form of Malvertisement, redirects the victim to an exploit kit landing page. If a victim lands on one of these sites, the exploit kit will automatically scan the victim’s computer to find out the operating system the victim is using, which software programs are running, and if there are any vulnerabilities associated with these software packages. Exploits take advantage of these unreported vulnerabilities for which no software patch is available. After that, they attempt to install the malware on the victim’s computer.
- Keyloggers: They are spyware that hides on the victim’s device while recording the keystrokes. By this, they capture and steal the login credentials, credit card numbers, and other sensitive information.
What are Malicious Email Attachments?
Malicious email attachments are becoming a security threat for businesses and organizations. These malicious attachments, concealed as word documents, PDFs, images, video or audio files, etc., are intended to launch an attack on the system of email recipients. If these attachments are opened, they can install viruses, malware, or ransomware on the victim’s computer and delete the entire data. Some malware, such as spyware, are designed to get access to the victim’s computer and steal personal and confidential data, such as login credentials, important files saved on the system, etc. For an organization, it is crucial to identify the threats like malicious email attachments and create awareness about them among the employees.
How to Identify a Malicious Email Attachment?
Identifying a malicious email attachment is easier if you understand the risk levels associated with different file formats. This is because some file formats such as .exe, .adp, .bat, and .com are more susceptible to malware hosts than others. So, being aware of different file types can help you be more careful when you find them as email attachments.
Following are some file extensions that are commonly sent as email attachments:
- .PDF: Portable Document Format or PDF is used to present documents that include text, images, and other visual elements. It’s generally believed to be a safe file format. However, someone can manipulate a PDF file to include malware and send it as an attachment in the email. When it’s opened or downloaded, it can release malware in the receiver’s system.
- .DOC/.DOCX/.PPT/.PPTX/XLS/.XLSX: MS Office documents with formats like .doc and .xls are less safe because they may contain macros that are bits of computer code that can be malicious. However, files with extensions .docx and .xlsx (formats introduced by Microsoft to improve security) are safer as they don’t contain macros.
- .JPG/.JPEG/.PNG: JPG, JPEG, and PNG are three different types of image file formats. Cybercriminals often send malware or other harmful viruses disguised as images in emails. However, if your email program shows the complete file name of an attachment that appears like an image but has a non-image file extension like .exe, you can establish that it is malicious.
- .EXE: Executable files (files ending with extension .exe) are the riskiest as they are executable files and can launch programs or carry out commands when activated. This is why most email services and programs block these attachments automatically. Still, if you receive an attachment with a .exe extension, you must not open it.
- .MP3 and .WAV: MP3 and WAV are audio file formats. Audio files with .MP3 extensions are generally safe, but you should be extra careful with .WAV files as they are uncompressed files. In other words, it’s easy to hide malware in a .WAV file. So, before clicking on an email attachment with a .WAV audio file, check if it comes from an authorized sender.
- .MPG/.AVI/.MOV/.WMV: These are some standard video file formats. Opening video files with these file extensions isn’t recommended as it’s easy to hide malware in video files.
- .HTML: HTML is a language used to create web pages. HTML file attachments can deliver malware through embedded JavaScript, or they may take you to a malicious webpage for phishing. So, strictly avoid downloading .HTML attachments.
- .ZIP and .RAR: Compressed files like .ZIP and .RAR can be highly dangerous for many reasons. Many email virus scanners don’t open these files to scan the contents. Also, some compressed files have absolute paths and can replace an important system file when uncompressed.
Steps for Protection Against Malware Attacks
The Internet and email are the two most common ways malware can access your systems. Hence, you are vulnerable to such attacks if you are connected online.
1. Standard Preventive Measures
While surfing the Internet, stay away from suspicious websites. Set up standard border controls for your organization’s Internet network that can block suspicious emails before they reach employees. These include advanced firewalls, antivirus, and antispam solutions. You can also create a secure virtual environment, also known as a sandbox, where suspicious email attachments can be sent for analysis before they are delivered or deleted.
2. Look for Common Signs of Malicious Emails
The employees can be trained to look for common signs of malicious emails. These include:
- Be careful while opening email attachments.
- Email subjects that have a sense of urgency.
- Generic greetings, salutations, and email body content.
- Unknown senders.
- Puzzling context, like emails with photos of another employee’s vacation, documents of a meeting that never took place, etc.
- Adjust spam filters in such a way that emails containing malicious links or attachments should not land in the inbox.
3. Keep the OS and Software Updated
Install and maintain the excellent quality antivirus-antimalware program. Keeping the operating system and software, up-to-date will ensure they are protected against the latest threats. This is because developers frequently patch their software to fix new vulnerabilities they discover.
4. Deploy an advanced eDiscovery and Email Monitoring Tool
Instead of expecting the employees to be alert and handle emails with caution, you can go one step further – the security operations center team can actively monitor the incoming emails with an email analysis and investigation tool such as Stellar Email Forensic. This tool is an advanced eDiscovery software for email search as it is a pre-emptive measure for administrators as they can review incoming emails for threats by studying the content and message headers. It can also be used as an email forensics tool if and when an attacker launches an attack, for finding the extent of the attack (other emails that contain similar malware attachments), the attack’s origin, etc. Apart from this, Stellar Email Forensic is an excellent tool for bulk emails and deleted email recovery.
These preventive measures can minimize the risk of malware reaching your organization through email.
