During an incident triage session, security analysts isolate four distinct technical telemetry artifacts collected from host and network sensors. Match each observed technical indicator on the left with its primary malware classification on the right.
- An EDR alert indicates an unapproved binary disguised as a system management utility that opens an outbound port to accept administrative control commands.Remote Access Trojan (RAT)
- Network security monitoring logs reveal automated, high-volume SMB traffic scanning adjacent subnets to exploit vulnerabilities without user interaction.Self-Propagating Worm
- Memory forensics reveals shellcode executing dynamically within hijacked system process RAM spaces with no compiled executable written to disk.Fileless Malware
- Low-level system integrity monitoring detects unauthorized modifications to sector 0 of the primary disk to execute payload code before the operating system kernel initializes.Bootkit
Cevap
The technical indicators match their malware classifications as follows: The rogue binary establishing backdoor control matches Remote Access Trojan (RAT); automated network scanning and vulnerability exploitation across subnets matches Self-Propagating Worm; memory-only shellcode execution without disk artifacts matches Fileless Malware; and disk sector 0 modification pre-OS boot matches Bootkit.
The disguised administrative access binary matches the Remote Access Trojan because it masquerades as a benign utility while providing covert remote command capability. The network scanning activity targeting port 445 matches the Self-Propagating Worm due to its autonomous spreading nature without victim interaction. The RAM-resident shellcode execution matches Fileless Malware as it avoids traditional disk-based detection. The sector 0 modification matches Bootkit because it alters the storage boot loader to execute code prior to kernel loading.
Adım Adım Çözüm
Anahtar Kavram
Malware Types and Indicators of Compromise