312-49V11 · Question #98
Lucas, a forensic investigator, has been tasked with analyzing the behavior of a malware sample that has infected a Linux-based system. After executing the malware, Lucas suspects that the malware…
The correct answer is B. strace. According to the CHFI v11 objectives under Malware Forensics and Linux Memory and System Behavior Analysis, monitoring system calls is a core technique for understanding how malware interacts with the operating system at a low level. On Linux systems, strace is the primary and…
Question
Lucas, a forensic investigator, has been tasked with analyzing the behavior of a malware sample that has infected a Linux-based system. After executing the malware, Lucas suspects that the malware is performing suspicious activities such as modifying system files, accessing restricted resources, and interacting with the kernel. In order to track the malware's interaction with the operating system, Lucas decides to monitor the system calls made by the malware during its execution. To gather this data, which of the following tools should Lucas use to effectively track and analyze the system calls initiated by the malware, providing insights into how the malware communicates with the OS and performs its malicious activities?
Options
- AProcess Explorer
- Bstrace
- CAutoruns
- DRegshot
How the community answered
(23 responses)- A4% (1)
- B78% (18)
- C4% (1)
- D13% (3)
Explanation
According to the CHFI v11 objectives under Malware Forensics and Linux Memory and System Behavior Analysis, monitoring system calls is a core technique for understanding how malware interacts with the operating system at a low level. On Linux systems, strace is the primary and most effective tool for this purpose. Strace intercepts and records system calls made by a process, along with the signals received and return values. Since all interactions between user-space programs and the Linux kernel occur via system calls, tracing them provides deep visibility into malware behavior. Using strace, investigators can observe actions such as file creation or modification (open, write), privilege escalation attempts (setuid), network communications (connect, sendto), process creation (fork, execve), and access to protected system resources. This makes strace indispensable for dynamic malware analysis on Linux, as emphasized in CHFI v11.
Topics
Community Discussion
No community discussion yet for this question.