The 7 Habits of Highly Effective Malware

There are probably several new malware variants out per hour somewhere around the world, but only a small fraction have impact.What distinguishes the truly effective malware from the great unwashed malware masses?

Here, then, are what separates them: The 7 habits of highly-effective malware, the characteristics that make malcode successful. Thanks to Julio Canto of Hispasec Sistemas Lab, operators of the invaluable VirusTotal service for helping with the list.

1. Trick the user. Make them think the program is something they really want to run.


2. Obscure your code. Use packers and other tricks to make the program difficult to analyze.


3. Make it as light as possible in terms of size to make the moment of infection faster.


4. Make it as stealthy as possible so as not to make the user suspect because 'my computer runs slow' or 'what is this process?'


5. Have as many anti-debug and anti-vm tricks as possible, to avoid today's malware analysis automations. In the end, it will be detected but many hours of not being detected means more time to spread unimpeded..


6. Make it as flexible as possible. The more tasks it can do, the more profit you can get (password stealing, spam sending, ddosing, click fraud, etc). Typically, it can even be updated to do different or better tasks.


7. Manage with a bullet-proof Internet infrastructure for handling the malware operation. This is important, and sadly easy. There's more than enough countries and ISPs that don't care very much about people like you and it takes ages to shut down a malware site.