Examkin

Question

Difficulty: HardMalware Types and Indicators of Compromise

During a threat hunting exercise on an enterprise web server running Linux, a SOC analyst examines suspicious host telemetry following an alert. The investigation reveals that an external exploit against an HTTP service injected shellcode directly into the heap space of the running `httpd` process. The injected code allocated executable memory regions using `mprotect()` and dynamically resolved socket functions to establish an outbound reverse shell without ever writing any executable files, scripts, or persistent artifacts to the physical disk. Which of the following malware classifications best describes the malicious activity detected on this server?

  1. Fileless malwareAnswer
  2. B
    Trojan
  3. C
    Self-propagating worm
  4. D
    Kernel rootkit

Answer

Fileless malware is the correct classification because the payload executes exclusively in volatile memory without writing binary files to persistent storage.
The correct answer is Fileless malware because the threat actor injected shellcode directly into volatile memory (RAM) allocated by an existing process, executing a reverse shell without storing any files on the host's secondary storage.

Step-by-Step Solution

1
Analyze the telemetry indicators provided in the scenario
Identified that shellcode was injected into heap space via `mprotect()` and executed directly within the memory space of the existing `httpd` process.
Evaluating where and how the payload executes reveals its primary execution architecture.
2
Check for disk-based artifacts or persistence mechanisms
Confirmed zero executable files, scripts, or binaries were written to non-volatile disk storage.
Absence of disk artifacts is the defining characteristic distinguishing fileless/memory-resident payloads from traditional malware.
3
Map the technical observation to the standard malware taxonomy
In-memory shellcode execution without persistent file writes maps directly to fileless malware.
Trojan applications require binary drop/execution, worms require autonomous network replication routines, and rootkits require system-call/kernel interception.

Key Concept

Fileless Malware Execution and In-Memory Payload Analysis
Estimated Time:2m 0s
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic