Examkin

Question

Difficulty: EasyMalware Types and Indicators of Compromise

Match each malware type on the left with its corresponding technical indicator of compromise (IoC) on the right.

  • RansomwareMass file encryption accompanied by a text file instructing the user to make a payment for decryption
  • KeyloggerInterception and recording of physical or virtual user keystrokes sent to an unauthorized remote host
  • Logic BombDormant code that executes automatically when specific logical conditions or time dates are met
  • RootkitKernel-level system modifications designed to hide processes, files, and network connections from administrative tools

Answer

Ransomware pairs with mass file encryption and payment demand; Keylogger pairs with keystroke interception and recording; Logic Bomb pairs with dormant code triggered by specific events; Rootkit pairs with kernel-level modifications hiding processes.
Each malware type directly matches its signature telemetry: Ransomware performs bulk file encryption for extortion; Keyloggers record user input; Logic bombs execute based on predefined system triggers; Rootkits alter kernel structures to maintain stealth.

Step-by-Step Solution

1
Examine the operational objective of each listed malware classification.
Identified key goals: extortion for Ransomware, credential harvesting for Keyloggers, conditional malicious execution for Logic Bombs, and deep OS evasion for Rootkits.
Understanding malware objectives reveals their corresponding technical telemetry.
2
Map each malware category to its distinct primary indicator of compromise (IoC).
Ransomware matches file encryption/ransom instructions; Keylogger matches recorded keystrokes; Logic Bomb matches event/time trigger; Rootkit matches kernel obfuscation.
Correlating telemetry traits enables security analysts to correctly identify and mitigate threats.

Key Concept

Malware Classifications and Technical IoCs
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic