Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A security analyst conducts incident triage on an enterprise server and uncovers two distinct anomalous indicators:

1. The standard administrative utility binary on disk was replaced with a compromised version that allows unauthorized access using a hardcoded master key.
2. A loadable kernel module is actively intercepting system calls to modify process listings, effectively hiding malicious processes and network sockets from diagnostic commands.

Which of the following malware classifications or mechanisms are directly demonstrated by these forensic findings? (Select TWO)

  1. Trojan execution via system binary replacementAnswer
  2. Rootkit functionality through kernel-level hook interceptionAnswer
  3. C
    Self-propagating worm capabilities operating over open socket connections
  4. D
    Logic bomb activation based on preconfigured system environment triggers

Answer

The correct selections are Trojan execution via system binary replacement and Rootkit functionality through kernel-level hook interception.
The scenario demonstrates Trojan malware because a legitimate utility executable was modified to include an unauthorized backdoor. Additionally, rootkit functionality is present because a loadable kernel module subverts system call outputs to hide processes and network connections from administrators.

Step-by-Step Solution

1
Analyze Indicator 1 (Replacing a legitimate administrative utility with a malicious version that includes a master key).
Identify that disguising malicious functionality within legitimate system binaries corresponds to Trojan malware.
Trojans masquerade as or overwrite benign software components to establish unauthorized administrative access.
2
Analyze Indicator 2 (Utilizing a kernel module to intercept system calls and hide running processes/sockets).
Identify that low-level stealth techniques modifying kernel system calls to conceal system state correspond to Rootkits.
Rootkits operate at deep system levels (such as kernel space) to subvert operating system reporting tools and evade detection.
3
Evaluate remaining choices against observed telemetry.
Exclude self-propagating worms and logic bombs because no autonomous network replication or logical execution triggers are indicated.
Worms focus on spreading automatically across networks, while logic bombs require specific event conditions to launch.

Key Concept

Malware Indicators of Compromise (Trojans vs Rootkits)
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic