Question

Explain why malware authors find it more advantageous to store malicious code in a DLL, rather than in an .exe file.

Answer 1

The first thing a malware installer (first stage of infection) does when executed on a target system - be it a dropper or downloader - is to install a copy of the malware and its components into their corresponding location in the system. Some popular locations include:

• C:Windows
• C:Program Files
• C:Users/[current user]/AppDataRoamingMicrosoft

However, there are instances wherein the installation of the malware becomes corrupted or incomplete due to the target system's current state at the time of infection. The target system may have a slow connection, causing a malware downloader to incompletely download the malware and its components. In the case of a malware dropper, a busy system may corrupt the files, causing the malware to function improperly. Another instance that may cause corruption is when the target system is shut down, or rebooted by the user before the malware has installed completely. Most users, when they believe their system has a malware infection, react by shutting down. "Unplug it, now!!!", if it's a server or desktop, or "Remove the battery, now!!!", if it's a laptop and you have the capability to remove the battery (most modern laptops no longer allow battery removal). The idea is that the immediate shut down the system in the middle of an infection process will thwart the attack.

Attackers are smart. They know this and have made it one of their use cases when creating new malware installer technologies that avoid any kind of corruption during installation. Their solution? Utilize TMP files and the Microsoft Windows Temp folder.