Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

A system administrator notices that several virtualized database servers are experiencing sustained 100% CPU utilization during off-peak hours. Outbound network logs show persistent, encrypted connections on TCP port 3333 transmitting data structured with the Stratum communication protocol. An endpoint inspection reveals an unauthorized process masquerading as a system executable (`svchost.exe`) running under a compromised service account. Which of the following malware types is most likely responsible for this activity?

  1. CryptominerAnswer
  2. B
    Ransomware
  3. C
    Keylogger
  4. D
    Logic bomb

Answer

Cryptominer
The combination of sustained maximum CPU utilization, process disguise via spoofed system executable names (`svchost.exe`), and outbound network traffic using the Stratum mining protocol specifically defines cryptomining malware (cryptojacking).

Step-by-Step Solution

1
Analyze resource utilization indicators
Identify sustained 100% CPU usage during off-peak hours, pointing to intensive processing tasks.
Cryptocurrency mining algorithms rely heavily on system hardware resource consumption.
2
Evaluate network telemetry protocol artifacts
Confirm outbound traffic using the Stratum mining protocol on TCP port 3333.
Stratum is the standard protocol for mining pool communication.
3
Synthesize indicators to classify malware type
Match high CPU load and Stratum pool communications to a unauthorized cryptominer masquerading as a legitimate Windows system process.
Cryptojacking malware frequently hides behind system process names while consuming hardware resources.

Key Concept

Cryptominer / Cryptojacking Indicators of Compromise
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic