Examkin

Question

Difficulty: MediumMalware Types and Indicators of Compromise

Network monitoring alerts show that a malicious binary on an infected host is actively scanning neighboring subnets over TCP port 445 and automatically exploiting a remote code execution vulnerability on adjacent systems. The malware spreads from machine to machine across the network without requiring any user action, social engineering, or credential theft, after which it encrypts local files and issues a ransom prompt. Which of the following malware classifications best describes this threat?

  1. WormAnswer
  2. B
    Trojan
  3. C
    Rootkit
  4. D
    Logic bomb

Answer

The threat is best classified as a Worm because it self-propagates across subnets via network vulnerabilities without requiring user intervention.
The correct answer identifies the malware as a worm because the primary indicator of compromise is autonomous, network-wide self-propagation via unpatched vulnerability exploitation without requiring user interaction.

Step-by-Step Solution

1
Analyze the primary propagation mechanism described in the telemetry.
The payload autonomously scans subnets and exploits network ports to infect remote machines without human assistance.
Propagation characteristics distinguish self-replicating malware from user-assisted malicious code.
2
Compare the observed network behavior against standard malware definitions.
Autonomous network spreading across vulnerabilities matches the core definition of a worm (even when combined with ransomware payloads).
Trojans, rootkits, and logic bombs rely on execution triggers, user interaction, or stealth concealment rather than automated network replication.

Key Concept

Worm propagation vs Trojan and fileless delivery mechanisms
Rate this question

Topics

Malware Types and Indicators of Compromise

More questions from this topic