A security analyst is performing host and network triage following a security incident. Match each technical indicator of compromise (IoC) artifact to the correct malware classification.
- Outbound encrypted command traffic on port 443 originating from an executable launched out of `C:\Users\Public\Downloads\` paired with active reverse RDP tunneling.Remote Access Trojan (RAT)
- Modifications to the Master Boot Record (MBR) executed prior to OS kernel initialization, hiding underlying system process structures from API calls.Bootkit
- An embedded SQL database trigger scheduled to automatically overwrite financial records when an employee ID is removed from the active personnel table.Logic Bomb
- Unscheduled mass file renaming to `.locked` extensions accompanied by rapid CPU utilization spikes and symmetrical encryption key generation in memory.Ransomware
Answer
The telemetry artifacts match their malware classifications as follows: Unauthorized interactive connection and tunneling from abnormal paths corresponds to Remote Access Trojan; pre-boot environment modification and cloaking corresponds to Bootkit; event-triggered malicious database operations correspond to Logic Bomb; and automated bulk file encryption corresponds to Ransomware.
Each artifact presents unambiguous indicators of distinct malware categories: execution from user-writable directories establishing interactive tunnels points to a Remote Access Trojan; pre-kernel boot sector modifications define a Bootkit; condition-triggered malicious database logic represents a Logic Bomb; and automated mass file encryption with appended extensions defines Ransomware.
Step-by-Step Solution
Key Concept
Malware Classifications and Technical Indicators of Compromise (IoC)