Malware: Viruses, Ransomware and Spyware

Malware is short for malicious software: any program made to harm your device, steal data or take control of it.

Types of Malware

How Malware Spreads

• Cracked software and games downloaded from unknown websites
• Fake apps sent as .apk files on WhatsApp ("new wedding card app", "bank update")
• Email attachments, such as a fake invoice in a .zip or a document asking you to "enable macros"
• Infected USB drives passed between computers, for example at a print shop
• Unpatched software with known weaknesses

Signs of an Infected Device

• The device becomes very slow or the battery drains quickly
• Pop-up ads appear even when no browser is open
• New apps or browser toolbars you did not install
• Your friends receive messages you did not send
• Files suddenly have strange extensions and will not open

Checking a File's Hash

Security teams identify known malware by its hash, a unique fingerprint of the file. You can calculate a file's SHA-256 hash and compare it with the one published on the official download page.

On Windows (PowerShell):

Get-FileHash .\setup.exe -Algorithm SHA256

Algorithm   Hash                                                              Path
---------   ----                                                              ----
SHA256      3A7BD3E2360A3D29EEA436FCFB7E44C735D117C42D1C1835420B6B9942DD4F1B  C:\Users\Ali\Downloads\setup.exe

On Linux or macOS:

sha256sum setup.exe

If the hash does not match the one the publisher gives, the file was changed. Do not run it.

Checking a File's Real Type

Attackers rename programs so they look like documents, such as fees-list.pdf.exe. Windows may hide the last part. This Python example checks the first bytes of a file, which reveal its real type:

signatures = {
    b"%PDF": "PDF document",
    b"MZ": "Windows program (.exe)",
    b"PK": "ZIP archive (also .docx, .xlsx, .apk)",
}

with open("fees-list.pdf", "rb") as f:
    start = f.read(4)

for magic, kind in signatures.items():
    if start.startswith(magic):
        print("Real type:", kind)

Real type: Windows program (.exe)

This "PDF" is actually a program. In Windows File Explorer, turn on View > Show > File name extensions to see full names.

Ransomware and Backups

Ransomware is one of the most damaging threats for businesses. The best protection is a good backup. Follow the 3-2-1 rule:

1. Keep 3 copies of important data
2. On 2 different types of storage (for example a laptop and an external drive)
3. With 1 copy kept offline or off-site (a disconnected drive, or cloud backup with version history)

With a clean backup, you can restore files without paying anyone. Paying does not guarantee you will get your files back.

How to Protect Your Devices

• Keep the operating system, browser and apps updated
• Use the built-in antivirus (Microsoft Defender on Windows, Google Play Protect on Android) and keep it on
• Do not open unexpected attachments or install unknown .apk files
• Use a normal (standard) user account on Windows for daily work, not an administrator
• Make regular backups and test that you can restore them

If You Think You Are Infected

1. Disconnect from Wi-Fi and mobile data
2. Run a full antivirus scan
3. Remove unknown apps and browser extensions
4. Change important passwords from a different, clean device
5. If the problem continues, reset the device and restore from a clean backup

Exercise