Generally, all malware of the same type share the same needs, regardless of the platform:
- It needs to get into the target system.
- In many cases, it needs to achieve persistence in order to survive the reboot.
- It may need to get a higher level of privileges, for example, to achieve the system-wide persistence or to get access to the valuable data.
- In many cases, it needs to communicate with the remote system (C&C) in order to do the following:
- Get commands
- Get new configuration
-
- Get self-updates, as well as additional payloads
- Upload responses, collected information, and files of interest
- Some malware families behave like worms, aiming to penetrate deeper into reached networks; this activity is commonly called a lateral movement.
The implementation depends on the target systems as they may use different default tools and file...
