MODULE 7 — MALWARE THREATS

About This Handbook

This handbook provides a structured CEH v13 guide to malware threats, covering Trojans,
viruses, worms, ransomware, malware analysis, anti-malware tools, and defensive
countermeasures. The module focuses on understanding malware behaviour, infection
techniques, detection methods, and practical security response workflows used in modern
cybersecurity environments.

Module Contents at a Glance

# Section Key Focus Areas

1 Malware Concepts Types, infection vectors, malware ecosystem,

propagation

2 Trojan Concepts RATs, droppers, wrappers, Trojan deployment workflow

3 Virus and Worm Concepts Virus lifecycle, ransomware, worm propagation

4 Malware Analysis Static analysis, dynamic analysis, sandboxing, tools

5 Malware Countermeasures Defensive strategies, awareness, patching, backups

6 Anti Malware Software Detection methods, AV tools, behavioural analysis

7 Malware Penetration Testing Ports, processes, registry, drivers, workflows

8 Examination Quick Reference Critical definitions, tools, high-priority facts

9 Summary and Conclusion Core malware concepts and future learning direction
 Section 1 — Malware Concepts

DEFINITION: Malware
Malware is any software intentionally designed to cause damage to a computer, server, client, or
computer network.
It encompasses programs that differ in their propagation method, payload, persistence
mechanisms, and ultimate purpose.

1.1 What Is Malware?

Malware is any software intentionally designed to cause damage to a computer, server, client, or computer
network. The word itself is a portmanteau of 'malicious' and 'software', and it encompasses an enormous range
of programs that differ in their method of propagation, their payload, their persistence mechanisms, and their
ultimate purpose. At its core, malware damages or disables computer systems and gives limited or full control of
those systems to the malware creator for the purpose of theft, fraud, espionage, or disruption.
Understanding malware from the perspective of an ethical hacker means understanding it from both sides of the
attack surface. A penetration tester must know how malware enters systems, how it hides itself, how it
communicates with attacker-controlled infrastructure, and how defensive tools detect and remove it. Without this
dual perspective, security assessments are incomplete and organisations remain exposed.

1.2 The Malware Ecosystem — Major Categories

Modern malware exists within a rich and interconnected ecosystem. The following categories represent the
primary families of malicious code you must understand for the CEH examination and for real-world security
practice.

1.2.1 Trojan Horse

A Trojan Horse is a program in which malicious or harmful code is hidden inside apparently legitimate
programming or data. Unlike viruses, Trojans do not self-replicate — they rely on the user to execute them,
typically by masquerading as a useful application, a game, a software update, or a document. Once executed,
the Trojan delivers its payload, which may include creating a backdoor, stealing credentials, encrypting files, or
installing additional malware.

1.2.2 Backdoor
A backdoor is a method of bypassing normal authentication mechanisms in a system. Backdoors can be
intentionally placed by developers (for maintenance purposes) or installed by attackers after gaining initial
access. They give the attacker persistent, covert access to the compromised system, often surviving reboots
and software updates.

1.2.3 Rootkit
A rootkit is a collection of tools that enable administrator-level access to a computer while actively hiding its
presence from system administrators, security software, and the operating system itself. Rootkits operate at
multiple levels — from user-space rootkits that manipulate application outputs, to kernel-level rootkits that modify
the operating system kernel, to hypervisor rootkits that sit beneath the entire operating system.

1.2.4 Ransomware
Ransomware is a type of malware that restricts access to the computer system's files and folders and demands
an online ransom payment to the malware creator in order to remove the restrictions. Modern ransomware
typically uses strong asymmetric encryption to lock victims' files. Variants such as Locky, WannaCry,
CryptoLocker, CTB-Locker, and REvil have caused billions of dollars in damages globally.

1.2.5 Adware
© 2026 ASD Academy · CEH Malware Threats Student Guide 3
Adware is software that automatically displays or downloads advertising material to a computer when a user is
online. While not always overtly malicious, adware can degrade system performance, compromise user privacy
by tracking browsing behaviour, and serve as a delivery mechanism for more harmful payloads.

1.2.6 Spyware
Spyware is software that secretly monitors and collects information about a user's activities and transmits it to an
external party without the user's knowledge or consent. Spyware can capture keystrokes, take screenshots,
record audio and video, harvest stored passwords, track location, and intercept communications.

1.2.7 Worm
A worm is a self-replicating program that propagates itself across networks without requiring user action or a
host program to attach to. Because worms consume network bandwidth and system resources through rapid
self-replication, they can cause significant degradation of network performance even before their payload is
delivered. Famous worms include Morris (1988), ILOVEYOU (2000), Code Red (2001), and WannaCry (2017).

1.2.8 Botnet
A botnet is a network of infected computers — called 'bots' or 'zombies' — that are controlled remotely by an
attacker through a command-and-control (C2) server or peer-to-peer network. Botnets are used to launch DDoS
attacks, send spam, conduct click fraud, mine cryptocurrency, and distribute other malware.

1.2.9 Crypter
A crypter is a software tool used by malware developers to encrypt, obfuscate, and pack malicious code so that
antivirus software cannot detect it using signature-based detection. Crypters are classified as either 'fully
undetectable' (FUD) or 'partially undetectable' (PUD) if they evade some but not all security tools.

1.3 Ways Malware Enters a System

Malware does not appear spontaneously — it must find a pathway into the target system. The CEH curriculum
identifies the following primary infection vectors:
• Instant Messenger Applications: Chat applications can be exploited to distribute malicious links or
files directly to a large number of contacts simultaneously.
• Portable Hardware Media and Removable Devices: USB drives, external hard drives, SD cards, and
other removable media can carry malware that executes automatically when connected.
• Browser and Email Software Bugs: Vulnerabilities in web browsers, browser plugins, and email clients
can be exploited to download and execute malware without any explicit user action.

© 2026 ASD Academy · CEH Malware Threats Student Guide 4

 • Insecure Patch Management: Systems that are not regularly updated with security patches remain
vulnerable to publicly known exploits.
• Rogue or Decoy Applications: Malware is frequently bundled with legitimate-appearing applications
distributed through unofficial channels.
• Untrusted Sites and Freeware: Downloading software from untrusted websites, freeware platforms, or
peer-to-peer networks significantly increases the risk.
• Email Attachments: Malicious email attachments remain one of the most effective and widely used
malware delivery mechanisms.
• Network Propagation: Once inside a network, many malware types spread laterally by exploiting
network shares, weak credentials, and unpatched services.
• Installation by Other Malware: Malware frequently serves as a dropper or downloader for additional
malware — a simple Trojan may download a keylogger, rootkit, and ransomware in sequence.
• Bluetooth and Wireless Networks: Bluetooth-enabled devices and wireless network connections can
be exploited to deliver malware.

KEY POINTS TO REMEMBER

Malware = malicious software designed to damage systems and give control to the creator
Major categories: Trojans, Backdoors, Rootkits, Ransomware, Adware, Spyware, Worms, Botnets, Crypters
Trojans do NOT self-replicate — they rely on user execution
Worms ARE self-replicating and propagate without user action
Primary vectors: email attachments, removable media, malicious downloads, network propagation

© 2026 ASD Academy · CEH Malware Threats Student Guide 5

 Section 2 — Trojan Concepts

2.1 Understanding the Trojan Horse

The Trojan Horse occupies a central position in the malware landscape precisely because of its psychological
rather than purely technical nature. A Trojan exploits trust — trust in a software vendor, trust in a friend who
sends a file, or trust in an operating system prompt that asks for permission.
Formally defined: A Trojan is a program in which malicious or harmful code is contained inside apparently
harmless programming or data in such a way that it can gain control and cause damage.

2.2 How Attackers Deploy Trojans — The Infection Workflow

The deployment of a Trojan follows a structured workflow that begins with the creation of the malicious code and
ends with the attacker gaining control over the victim's system. The CEH curriculum documents this workflow in
six stages:
• Create the Trojan Packet: The attacker uses a Trojan Horse Construction Kit to configure the malware
payload, select target operating systems, and customise behaviour.
• Create a Dropper: The dropper installs the malicious code on the target system, establishes
persistence via a registry run key, and optionally deletes itself after execution.
• Create a Wrapper: A wrapper tool binds the Trojan executable with an innocent-looking executable
such as a game, screensaver, or office application. Also known as binders or joiners.
• Propagate the Trojan: The attacker distributes the wrapped Trojan through phishing emails, malicious
websites, social media, or file-sharing platforms.
• Execute the Dropper: When the victim runs the wrapped executable, the dropper silently installs the
Trojan while the legitimate application component may function normally.
• Execute the Damage Routine: The attacker executes the malicious payload — opening a backdoor,
exfiltrating data, encrypting files, or taking any other configured action.

2.3 Types of Trojans

Trojans are classified by the type of access or capability they provide to the attacker. Understanding these
categories is essential for both the CEH exam and for recognising Trojan behaviour during incident response.

2.3.1 Remote Access Trojans (RATs)

Remote Access Trojans are the most powerful and widely used category of Trojan. A RAT functions like a
remote desktop access application, giving the attacker complete GUI access to the remote system — seeing the

© 2026 ASD Academy · CEH Malware Threats Student Guide 6

victim's screen, operating the mouse and keyboard, browsing the file system, capturing the webcam and
microphone, logging keystrokes, and executing arbitrary commands in real time.
RATs typically operate using a reverse connection model to bypass firewalls. The Trojan on the victim machine
initiates an outbound connection to the attacker's server on Port 80 (HTTP) or Port 443 (HTTPS), appearing
indistinguishable from normal web traffic. Well-known RAT families include: DarkComet, Poison Ivy, njRAT,
XtremeRAT, and AndroRAT.

2.3.2 Backdoor Trojans

Backdoor Trojans create a persistent, covert remote access channel into the compromised system. Unlike full-
featured RATs, backdoors may provide only command-line shell access. They frequently modify system files,
registry entries, or scheduled tasks to survive reboots.

2.3.3 Botnet Trojans

Botnet Trojans enroll the victim machine into a botnet. Once part of the botnet, the victim machine can be
commanded to participate in DDoS attacks, send spam email, mine cryptocurrency, or serve as a proxy for other
attacks.

2.3.4 Proxy Trojans

Proxy Trojans configure the victim machine as a proxy server, routing the attacker's internet traffic through the
victim's IP address for anonymisation and further attacks.

2.3.5 FTP Trojans

FTP Trojans open an FTP server on the victim's machine, giving the attacker a file transfer channel to upload
tools or download stolen data.

2.3.6 VNC Trojans

Virtual Network Computing (VNC) Trojans start a VNC server daemon on the infected machine. The attacker
connects using any standard VNC viewer client to gain full graphical access to the victim's desktop. Because
VNC is a legitimate technology used in enterprise environments, VNC traffic is often allowed through firewalls.

2.3.7 HTTP and HTTPS Trojans

HTTP and HTTPS Trojans exploit the ubiquity of web traffic to conceal their communications. HTTP Trojans
bypass firewalls by operating through an HTTP tunnel. HTTPS Trojans use encrypted communications to further
conceal their activity, making detection by deep-packet inspection tools much more difficult.

2.3.8 Destructive Trojans

Destructive Trojans are designed to cause direct damage to the victim's system — deleting files, corrupting the
master boot record, formatting drives, or rendering the system unbootable.

2.4 Common Ports Used by Trojans

Port(s) Trojan(s)
2 Death
20 / 21 Senna Spy, Blade Runner, Doly Trojan, Invisible FTP
22 Shaft, SSH RAT
25 Antigen, Email Password Sender, WinSpy
80 Necurs, NetWire, Poison Ivy, Ismdoor
445 WannaCry, Petya
1234 Ultors Trojan
1243 SubSeven 1.0-1.8

© 2026 ASD Academy · CEH Malware Threats Student Guide 7

 Port(s) Trojan(s)
1604 DarkComet RAT, Pandora RAT, Hid!Spy RAT
1863 XtremeRAT
3000 SpyGate RAT, Punisher RAT
4590 ICQTrojan
5400-5401 Blade Runner
6666 KilerRat, Houdini RAT
6969 GateCrasher, Priority
8080 Zeus
8787 BackOffice 2000
12345-12348 GabanBus, NetBus
31337-31338 Back Orifice, DeepBO
65000 Devil

KEY POINTS TO REMEMBER

Trojans exploit trust — they do NOT self-replicate
RATs use reverse connections on port 80/443 to bypass firewalls
Wrapper/Binder = tool that combines a Trojan with a legitimate-appearing application
Dropper = component responsible for installing the Trojan payload
Key RAT families: DarkComet (1604), Poison Ivy (80), XtremeRAT (1863), Back Orifice (31337)

© 2026 ASD Academy · CEH Malware Threats Student Guide 8

 Section 3 — Virus and Worm Concepts

DEFINITION: Computer Virus

A computer virus is a self-replicating program that produces its own copy by attaching itself to
another program, computer boot sector, or document.
Viruses are generally transmitted through file downloads, infected disk and flash drives, and email
attachments.

3.1 Characteristics of Viruses

A well-crafted virus exhibits several key characteristics that help it survive, spread, and evade detection:
• Infects other programs: The virus attaches its code to executable files, scripting files, or documents
containing executable macros.
• Transforms itself: Polymorphic viruses change their own code with each replication cycle.
Metamorphic viruses go further by completely rewriting their code.
• Encrypts itself: Many viruses encrypt their payload to avoid detection by antivirus scanners that look
for known byte patterns.
• Alters data: Viruses may modify, corrupt, or delete data on infected systems as part of their destructive
payload.
• Self-replication: The defining characteristic — a virus continuously copies itself to new hosts across the
local system and connected network resources.

3.2 The Stages of Virus Life

Stage 1 — Design
The virus is developed using programming languages such as C, C++, assembly language, or scripting
languages, or by using virus construction kits. The attacker makes decisions about what the virus will infect, how
it will spread, when it will activate, and what its payload will be.

Stage 2 — Replication
The virus replicates itself for a period of time within the initial target system, attaching copies of itself to program
files, documents, boot records, or other executable content. During replication, the virus may attempt to remain
dormant to avoid detection.

Stage 3 — Launch
The virus becomes active when a user performs a certain action that triggers its execution — such as running an
infected program, opening an infected document, or reaching a specific date or time condition (a time bomb).

Stage 4 — Detection
The virus is identified by a security researcher, antivirus vendor, or system administrator. Detection may occur
through signature-based scanning, behavioural analysis, or incident reports from affected users.

Stage 5 — Incorporation
Antivirus software developers analyse the identified virus and incorporate detection signatures, heuristics, or
behavioural rules into their antivirus databases to enable detection and removal.

Stage 6 — Execute the Damage Routine and Elimination

© 2026 ASD Academy · CEH Malware Threats Student Guide 9

As antivirus updates are pushed to endpoints globally, users gain the ability to detect and remove the virus.
However, polymorphic and metamorphic variants may survive longer by changing their signatures to evade new
detection rules.

3.3 Indications of a Virus Attack

The following behavioural indicators suggest that a system may be compromised by a virus:
• Processes take more system resources and time than normal — CPU consistently running at high
utilisation
• The computer emits error beeps with no display on screen — hardware initialisation failure indicating
boot sector corruption
• Drive labels change unexpectedly — a virus has modified volume information
• The operating system fails to load — possible master boot record or boot sector infection
• Constant and recurring antivirus alerts are generated — even after the antivirus reports removing a
detected threat
• Files and folders go missing or become inaccessible
• Suspicious hard drive activity occurs — the drive light is continuously active even when no user
applications are running
• Unwanted advertisements and pop-up windows appear persistently

3.4 Ransomware — A Deep Dive

Ransomware deserves special attention because it has become the dominant financially motivated malware
threat facing organisations today. Upon execution, the ransomware generates a symmetric encryption key
unique to the victim, uses it to encrypt the victim's files with AES-256, then encrypts the symmetric key with the
attacker's RSA public key. Without the attacker's RSA private key, decrypting the victim's files is computationally
infeasible.
The ransomware family Locky is specifically documented in the CEH curriculum as a particularly destructive
variant. Locky not only infects the local computer system but also has the ability to corrupt data on unmapped
network shares. Other CEH-documented families include Cerber, CTB-Locker, Scatter, Cryakl, Cryptorbit,
CryptoLocker, Crypto Defense, and Crypto Wall.

3.5 Computer Worms

A computer worm differs from a virus fundamentally: a worm is self-contained and does not need to attach itself
to an existing program or file to propagate. Worms exploit network services, shared resources, email systems, or
software vulnerabilities to copy themselves from system to system without any user interaction.

3.6 Fake Antivirus Software

Fake antivirus software — also known as rogue antivirus or scareware — masquerades as legitimate security
software to deceive users. It presents fake scan results showing numerous 'detected threats' and encourages
users to purchase a 'full version' to remove them. Historical examples include ScanGuard, Antivirus 10, TotalAV,
and SpeedUpMyPC 2016.

KEY POINTS TO REMEMBER

Virus = self-replicating; requires host file to attach to — attaches itself to programs/documents

© 2026 ASD Academy · CEH Malware Threats Student Guide 10

 Worm = self-contained; propagates across networks WITHOUT attaching to a host program
Ransomware uses AES-256 encryption; key is encrypted with attacker's RSA public key
Locky ransomware specifically corrupts data on UNMAPPED network shares
Stages of virus life: Design → Replication → Launch → Detection → Incorporation → Elimination

© 2026 ASD Academy · CEH Malware Threats Student Guide 11

 Section 4 — Malware Analysis

DEFINITION: Malware Analysis

Malware analysis is the process of reverse engineering a specific piece of malware to determine its
origin, functionality, and potential impact on infected systems.
It sits at the intersection of forensics, software engineering, network analysis, and threat
intelligence.

4.1 Why Conduct Malware Analysis?

The motivations for performing malware analysis apply across incident response, threat intelligence, and
penetration testing contexts:
• To determine exactly what happened during a security incident — reconstruct the attack timeline
• To identify Indicators of Compromise (IOCs) that can be used to detect the same malware on other
systems
• To assess the technical sophistication and capabilities of the attacker who deployed the malware
• To identify the specific vulnerability that was exploited to deliver the malware payload
• To quantify the extent of damage — what data was accessed, modified, or exfiltrated
• To build a legal case by establishing forensic evidence needed to hold perpetrators accountable

4.2 Types of Malware Analysis

4.2.1 Static Malware Analysis

Static malware analysis — also known as code analysis — involves examining the malware's binary code,
imports, strings, and structure without actually executing the malware. This approach is safe because the
malware cannot cause any harm if it is never run. However, sophisticated malware uses obfuscation, packing,
and encryption to make static analysis more difficult.
Static analysis techniques include: examining file metadata and hash values, extracting human-readable strings
(URLs, IP addresses, file paths, registry keys), examining the PE (Portable Executable) header, scanning with
multiple antivirus engines, and disassembling the binary into assembly language.
Local and Online Malware Scanning
Analysts scan the binary using well-known antivirus software locally, or upload suspicious samples to online
scanning services such as VirusTotal — which submits the file to dozens of different antivirus engines
simultaneously. Other online scanning resources include Jotti, Metadefender, Online Virus Scanner
(FortiGuard), IObit Cloud, and ThreatExpert.
Malware Disassembly
Disassembly tools convert binary machine code back into human-readable assembly language instructions,
giving the analyst insight into the program's logic, algorithms, and behaviour. Tools used include IDA Pro — a
multi-processor disassembler and debugger — as well as OllyDbg, WinDbg, ProcDump, CDB, and the KD
kernel debugger.

4.2.2 Dynamic Malware Analysis

Dynamic malware analysis — also known as behavioural analysis — involves actually executing the malware in
a controlled environment and observing its behaviour. This approach reveals what the malware does in practice:
registry keys created or modified, files created or deleted, network connections attempted, and OS interactions.
Dynamic analysis requires a virtual machine or sandbox to isolate the malware.
System Baselining
© 2026 ASD Academy · CEH Malware Threats Student Guide 12
System baselining refers to taking a detailed snapshot of the analysis system's state BEFORE the malware is
executed. The baseline captures the complete state of the file system, Windows registry, running processes,
open network ports, active network connections, and loaded drivers. Any difference between the baseline and
post-execution snapshot represents an action taken by the malware.
Host Integrity Monitoring
Host integrity monitoring involves taking a second snapshot AFTER malware execution, then comparing it to the
pre-execution baseline. It covers: port monitoring, process monitoring, registry monitoring, Windows services
monitoring, startup programs monitoring, event logs monitoring, installation monitoring, files and folder
monitoring, device drivers monitoring, network traffic monitoring, DNS monitoring, and API calls monitoring.

4.3 Preparing the Malware Analysis Testbed

Before any malware specimen is executed, the analyst must prepare an appropriate laboratory environment:
• Allocate a dedicated physical system — do not use a production machine
• Install a virtual machine platform such as VMware Workstation, Hyper-V, or VirtualBox
• Configure the virtual machine NIC in 'host only' mode to prevent network traffic from reaching the real
network
• Simulate internet services using tools such as iNetSim to create a fake internet environment inside the
isolated laboratory
• Disable 'shared folders' and 'guest isolation' features of the virtual machine
• Generate cryptographic hash values of the OS and each analysis tool to establish a verified clean
baseline

© 2026 ASD Academy · CEH Malware Threats Student Guide 13

4.4 The Sheep Dip Computer
A 'sheep dip' computer is installed with port monitors, file monitors, network monitors, and antivirus software. It is
used to analyse suspect files, incoming messages, external media, and other potentially dangerous inputs for
malware BEFORE they are introduced into the production network. The process involves running user/group
permission monitors, port and network monitors, device driver and file monitors, and registry and kernel
monitors.

4.5 Dynamic Analysis Tools

Category Tool Purpose

Port Monitoring netstat / TCPView Identify suspicious open ports and
connections to external IPs
Port Monitoring CurrPorts, PortExpert Advanced port monitoring and connection
analysis
Process Monitoring Process Monitor (ProcMon) Real-time file system, registry, and process
activity
Process Monitoring Process Explorer Advanced task manager showing process
tree and detail
Process Monitoring ESET SysInspector Comprehensive system state analysis
Startup Monitoring Autoruns for Windows All startup locations across all persistence
mechanisms
Startup Monitoring WinPatrol Startup program monitoring and alerting
Static Analysis IDA Pro Multi-platform disassembler and debugger
Static Analysis OllyDbg User-mode debugger for Windows
Online Scanning VirusTotal Multi-engine online antivirus scanner
Network Simulation iNetSim Internet services simulator for isolated labs

KEY POINTS TO REMEMBER

Static analysis = examine malware WITHOUT executing (code analysis)
Dynamic analysis = execute malware in sandbox and observe behaviour (behavioural analysis)
System baselining = snapshot BEFORE execution; Host integrity monitoring = compare AFTER execution
Sheep dipping = analysing all external inputs for malware before introducing to production network
IDA Pro is the industry-standard disassembler; VirusTotal scans against dozens of AV engines

© 2026 ASD Academy · CEH Malware Threats Student Guide 14

 Section 5 — Malware Countermeasures

5.1 The Philosophy of Malware Defence

Effective malware defence is not a product you can purchase and deploy — it is a practice, a culture, and a
continuously evolving set of technical and procedural controls. The CEH curriculum emphasises that awareness
and preventive measures are the best defences against Trojans and viruses. An educated user is a more
effective security control than many technical solutions.

5.2 Trojan Countermeasures

Defending against Trojan infections requires a combination of technical controls, administrative policies, and
user education:
• Avoid opening email attachments from unknown senders: Email remains the primary delivery
channel for Trojan payloads. Even attachments from known contacts should be treated with caution if
unexpected.
• Block all unnecessary ports at the host and firewall level: Trojans communicate through specific
ports. Restricting outbound connections to only required ports significantly limits Trojan C2 channels.
• Avoid accepting programs transferred by instant messaging: IM applications are frequently used to
spread Trojans, particularly when an attacker has compromised a victim's contact.
• Harden default configuration settings: Disable unused services, protocols, and features to reduce the
attack surface available to malware.
• Monitor internal network traffic for odd ports: Trojan communication often uses non-standard ports
or tunnels through standard protocols in unusual ways.
• Avoid downloading applications from untrusted sources: Software should only be obtained from
official vendor websites or verified distribution channels.
• Install patches and security updates promptly: Many Trojans exploit software vulnerabilities to install
themselves without user interaction.
• Scan all external USB drives and DVDs: All external media should be scanned with antivirus software
before use.
• Restrict desktop permissions: Running users with standard privileges prevents most Trojans from
installing themselves into system directories.

5.3 Virus and Worm Countermeasures

• Install antivirus software and update it regularly: Keeping antivirus definitions current is critical, as
new virus signatures are released continuously.
• Generate an antivirus policy for safe computing: A documented security policy provides the
administrative framework for a virus-resistant computing environment.
• Schedule regular scans for all drives: Scheduled scans catch infections that real-time protection may
have missed.
• Regularly maintain data backups: Follow the 3-2-1 rule: three copies of data, on two different media
types, with one copy stored off-site.
• Do not open files with more than one file type extension: The double extension trick
('[Link]') is a common technique used to disguise malware as a document.
• Run anti-spyware and anti-adware tools regularly: Dedicated tools catch categories of malware that
traditional antivirus may not effectively address.

© 2026 ASD Academy · CEH Malware Threats Student Guide 15

 • Restrict desktop permissions: Prevents viruses from writing to system directories or modifying critical
system settings.

KEY POINTS TO REMEMBER

Awareness and preventive measures are the BEST defences against Trojans and viruses
3-2-1 backup rule: 3 copies, 2 different media types, 1 off-site — critical against ransomware
Block unnecessary ports to limit Trojan command and control communication channels
Never open files with double extensions (e.g., [Link])
Patch management eliminates vulnerabilities exploited by drive-by and auto-install Trojans

© 2026 ASD Academy · CEH Malware Threats Student Guide 16

 Section 6 — Anti-Malware Software

6.1 The Role of Anti-Malware Software

Anti-malware software is the primary technical control deployed on endpoints and servers to detect, block,
quarantine, and remove malicious software. Modern anti-malware solutions have evolved far beyond simple
signature-based virus scanners — they incorporate machine learning models, behavioural analysis engines,
cloud-based threat intelligence, sandboxing capabilities, and real-time process monitoring.

6.2 Anti-Trojan and Anti-Malware Software Solutions

Tool Key Capabilities

Kaspersky Internet Security Comprehensive protection including Trojan, virus, spyware,
ransomware, and phishing defence
McAfee LiveSafe Multi-device protection with real-time threat intelligence
Symantec Norton Security Premium Layered endpoint protection with identity theft safeguards
Bitdefender Internet Security Advanced threat defence with behavioural detection engine
HitmanPro Cloud-assisted second-opinion malware scanner
Malwarebytes Specialised anti-malware complementing traditional antivirus
Zemana Antimalware Lightweight cloud-based malware detection
Emsisoft Anti-Malware Dual-engine scanning with real-time protection
Microsoft Malicious Software Removal Tool Microsoft's built-in malware remediation tool
SUPERAntiSpyware Specialist spyware and adware removal tool

6.3 Detection Methods Used by Anti-Malware Software

Signature-Based Detection
Compares files and memory content against a database of known malware signatures — unique byte patterns or
cryptographic hashes that identify specific malware specimens. Highly effective against known malware but
unable to detect novel threats not yet catalogued.

Heuristic Analysis
Attempts to identify malware based on characteristics and behaviours associated with malicious code. A
heuristic engine might flag a file that attempts to modify the master boot record or hook system calls, even
without a known signature. Has a higher false positive rate than signature-based detection.

Behavioural Analysis
Monitors the runtime behaviour of processes to identify malicious activity — what a program does rather than
what it is. Actions such as encrypting large numbers of files rapidly, connecting to known malicious IPs, or
injecting code into other processes trigger behavioural alerts. Particularly effective against zero-day malware.

Cloud-Based Threat Intelligence

Modern anti-malware solutions maintain real-time connections to cloud-based platforms that aggregate threat
data from millions of endpoints globally. When a suspicious file is encountered, the tool queries the cloud
platform which may already have determined that the file is malicious.

Sandboxing
© 2026 ASD Academy · CEH Malware Threats Student Guide 17
Some advanced solutions automatically execute suspicious files in an isolated virtual environment to observe
their behaviour before allowing them to run on the real system. Files that exhibit malicious behaviour in the
sandbox are blocked before they can cause harm.

KEY POINTS TO REMEMBER

Signature-based = compares against known malware hash/pattern database — cannot detect zero-day
Heuristic = detects based on malware-like characteristics — higher false positive rate
Behavioural = monitors what the program DOES at runtime — best against zero-day and advanced threats
Cloud-based intelligence aggregates data from millions of endpoints globally in real-time
Sandboxing = execute suspicious file in isolation and observe before allowing on production system

© 2026 ASD Academy · CEH Malware Threats Student Guide 18

 Section 7 — Malware Penetration Testing

7.1 Overview of Malware Penetration Testing

Malware penetration testing is the authorised, systematic process of assessing an organisation's defences
against malware threats by simulating the actions of an attacker who has already delivered malware to a target
system. The goal is not merely to determine whether malware can be delivered — but to evaluate how
effectively the organisation detects, responds to, and contains a malware infection.

7.2 The Malware Penetration Testing Methodology

Phase 1 — Pre-Engagement and Scoping

Before any testing activity begins, the scope must be clearly defined in a signed Rules of Engagement (ROE)
document specifying which systems are in scope, what types of malware simulation are authorised, what
notification requirements apply, and the testing timeline.

Phase 2 — Scanning for Open Ports

The first active phase involves scanning target systems for suspicious open ports using tools such as TCPView
and netstat. This baseline port scan establishes which ports are open before any simulated malware activity,
enabling identification of ports subsequently opened by malware.

Phase 3 — Scanning for Suspicious Running Processes

Scanning for suspicious running processes using Process Monitor and Process Explorer. Malware processes
are identified by cross-referencing the running process list against known malware names, looking for processes
running from unusual file paths such as temporary directories.

Phase 4 — Scanning for Suspicious Registry Entries

The Windows Registry is the most commonly abused location for malware persistence. Registry analysis tools
such as jv16 Power Tools and Reg Organizer scan all standard persistence locations — including
HKLM\Software\Microsoft\Windows\CurrentVersion\Run and HKCU equivalents.

Phase 5 — Scanning for Suspicious Windows Services

Malware frequently installs itself as a Windows service to achieve persistence and run with elevated privileges.
Tools such as SrvMan and Advance Windows Service Manager allow enumeration of all installed Windows
services to identify any installed after the baseline.

Phase 6 — Scanning for Suspicious Startup Programs

Startup programs are reviewed using Autoruns for Windows and WinPatrol to identify any new entries added to
system startup locations since the baseline was captured.

Phase 7 — Scanning for Event Log Entries

System, security, and application logs are reviewed using tools such as Loggly and SolarWinds LEM. Malware
activity frequently generates distinctive log entries — failed authentication attempts, new service installations,
privilege escalation events, and unusual network connection attempts.

Phase 8 — Scanning for Installed Programs

The system is scanned for programs installed without user consent using tools such as Microsoft Install Monitor
and SysAnalyzer. Malware droppers frequently install additional tools such as remote access clients, credential
dumping utilities, and network scanners.

Phase 9 — Scanning for Suspicious Files and Folders

© 2026 ASD Academy · CEH Malware Threats Student Guide 19

The file system is scanned using tools such as SIGVERIF and Tripwire. SIGVERIF checks that Windows system
files have not been modified or replaced. Tripwire computes cryptographic hash values and compares them
against pre-computed baseline hashes to detect any modifications.

Phase 10 — Scanning for Suspicious Device Drivers

Kernel-level rootkits frequently install malicious device drivers to achieve deep system access and hide their
presence. Tools such as DriverView and Driver Reviver identify newly installed drivers not associated with
legitimate hardware or software vendors.

7.3 Malware Penetration Testing Workflow — Quick Reference

Step Phase Tools

1 Ports — Identify suspicious open ports and connections netstat, TCPView
2 Processes — Identify malware processes Process Monitor, Process Explorer
3 Registry — Find persistence registry entries jv16 Power Tools, Reg Organizer
4 Services — Detect malicious services SrvMan, Advance Windows Service
Manager
5 Startup — Find unauthorised startup entries Autoruns for Windows, WinPatrol
6 Events — Review event logs for malicious activity Loggly, SolarWinds LEM
7 Programs — Detect unauthorised installs Microsoft Install Monitor, SysAnalyzer
8 Files — Verify file integrity and detect malware artefacts SIGVERIF, Tripwire
9 Drivers — Identify malicious kernel drivers DriverView, Driver Reviver

7.4 Response When Malware Is Detected

Step Action
1 — Isolate Immediately disconnect the infected system from the network to prevent
spread
2 — Verify AV Updated Confirm antivirus definitions are current before attempting removal
3 — Sanitise Run updated anti-malware tools to remove the detected malware
4 — Alternative Tool If primary tool fails, use an alternative anti-malware solution
5 — Document Record all findings, tools used, and actions taken for the incident report

KEY POINTS TO REMEMBER

Malware pen test workflow: Ports → Processes → Registry → Services → Startup → Events → Programs
→ Files → Drivers
TCPView and netstat for port monitoring; Process Monitor and Process Explorer for processes
jv16 Power Tools and Reg Organizer for registry; Autoruns and WinPatrol for startup
SIGVERIF and Tripwire for file integrity; DriverView and Driver Reviver for kernel drivers
If malware detected: Isolate → Update AV → Sanitise → Document

© 2026 ASD Academy · CEH Malware Threats Student Guide 20

 Section 8 — Examination Quick Reference

8.1 Critical Definitions

Term Definition
Malware Malicious software that damages or disables computer systems and gives
control to the creator for theft or fraud
Trojan Program with malicious code hidden inside apparently harmless
programming that can get control and cause damage
Virus Self-replicating program that attaches itself to another program, boot
sector, or document to spread
Worm Self-contained, self-replicating program that propagates across networks
without user action or a host program
Ransomware Malware that encrypts victim files and demands payment for the
decryption key
RAT Remote Access Trojan — gives attacker full GUI control over victim
machine via a reverse connection
Rootkit Collection of tools that provide admin-level access while actively hiding
their presence from the OS
Botnet Network of compromised machines controlled remotely by an attacker
through C2 infrastructure
Dropper Component that installs the malicious payload on the target system
Wrapper / Binder Tool that combines a legitimate application with a Trojan so both execute
simultaneously
Crypter Tool that encrypts or obfuscates malware to evade antivirus signature
detection
Sheep Dipping Practice of testing suspect files and media for malware before introducing
to production network
Static Analysis Examining malware binary without executing it — also called code
analysis
Dynamic Analysis Executing malware in a controlled environment to observe its behaviour
— also called behavioural analysis
System Baselining Snapshot of system state before malware execution for later comparison
Host Integrity Monitoring Comparing pre- and post-execution system snapshots to detect malware
changes

8.2 Trojan Ports — High-Priority Exam Facts

Port Trojan
Port 2 Death Trojan
Port 22 Shaft, SSH RAT
Port 80 Necurs, NetWire, Poison Ivy — common RAT port (blends with HTTP)
Port 445 WannaCry, Petya
Port 1604 DarkComet RAT, Pandora RAT

© 2026 ASD Academy · CEH Malware Threats Student Guide 21

 Port Trojan
Port 1863 XtremeRAT
Port 4590 ICQTrojan
Port 6666 KilerRat, Houdini RAT
Port 8080 Zeus banking Trojan
Port 12345 NetBus
Port 31337 Back Orifice
Port 65000 Devil Trojan

8.3 Malware Analysis Tools — Quick Reference

Tool Purpose
VirusTotal Online multi-engine AV scanner for static analysis
IDA Pro Industry-standard multi-platform disassembler and debugger
OllyDbg User-mode debugger for Windows — popular for malware
analysis
WinDbg Microsoft kernel and user-mode debugger
Process Monitor (ProcMon) Real-time file system, registry, and process activity monitoring
(Sysinternals)
Process Explorer Advanced task manager showing process tree and detailed
information (Sysinternals)
TCPView Real-time view of all TCP and UDP connections (Sysinternals)
Autoruns for Windows Comprehensive startup location viewer across all persistence
mechanisms (Sysinternals)
SIGVERIF Windows tool to verify integrity of system files
Tripwire File integrity monitoring — detects changes by comparing
against baseline hashes
DriverView Lists all device drivers currently loaded — identifies suspicious
kernel drivers
iNetSim Internet services simulator for isolated malware analysis labs
WinPatrol Startup program monitoring and suspicious activity alerting
Malwarebytes Specialised anti-malware detection and removal tool

© 2026 ASD Academy · CEH Malware Threats Student Guide 22

 Section 9 — Summary and Conclusion

9.1 Module Summary

KEY POINTS TO REMEMBER

Malware is malicious software that damages or disables systems and gives control to the creator for theft or
fraud
Trojans conceal malicious code inside legitimate-appearing programs — they do NOT self-replicate
A wrapper binds a Trojan with an innocent-looking application — when the user runs the app, both execute
RATs provide complete remote GUI access via reverse connections on common ports like 80 and 443
Viruses are self-replicating programs that attach to executable files, documents, or boot sectors
Worms are self-contained and propagate autonomously across networks without user interaction
Ransomware encrypts files and demands payment — 3-2-1 backups are the critical countermeasure
Static analysis examines code without running it; dynamic analysis executes malware in a sandbox
System baselining and host integrity monitoring are the two stages of dynamic analysis
Malware pen testing: Ports → Processes → Registry → Services → Startup → Events → Programs →
Files → Drivers
Awareness and preventive measures are the best defences — technology alone is insufficient

9.2 Looking Ahead

The knowledge and skills covered in this module form the foundation for more advanced topics in the CEH
curriculum. Understanding malware mechanics and analysis techniques is directly applicable to Session
Hijacking (captures authentication tokens), Social Engineering (Trojans delivered by phishing), Denial of Service
attacks (botnets built from malware), Web Application Hacking (web shells and malicious scripts), and
Cryptography (underpins ransomware encryption and encrypted C2 channels).
Malware threats evolve continuously. The specific tools, families, and techniques documented in this guide
represent the state of knowledge at the time of publication. Continuous learning — through threat intelligence
subscriptions, security research publications, and hands-on laboratory practice — is essential to maintaining
current and effective knowledge in this domain.

© 2026 ASD Academy · CEH Module 7 Malware Threats Student Guide

© 2026 ASD Academy · Professional Security Training

© 2026 ASD Academy · CEH Malware Threats Student Guide 23