nerdexam
EC-Council

312-50V12 · Question #225

A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly s

The correct answer is D. Metamorphic and Rootkit malware. The described malware exhibits characteristics of a rootkit by embedding its harmful code directly into genuine system binaries for stealth and persistence, and it is metamorphic by changing its code as it propagates to evade signature-based detection.

Submitted by carlos_mx· Mar 4, 2026System Hacking Phases and Attack Techniques

Question

A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly sophisticated techniques to stay undetected and continue its operations. Firstly, the malware was embedding its harmful code into the actual binary or executable part of genuine system files rather than appending or prepending itself to the files. This made it exceptionally difficult to detect and eradicate, as doing so risked damaging the system files themselves. Secondly, the malware exhibited characteristics of a type of malware that changes its code as it propagates, making signature-based detection approaches nearly impossible. On top of these, the malware maintained a persistent presence by installing itself in the registry, making it able to survive system reboots. Given these distinctive characteristics, which two types of malware techniques does this malware most closely embody?

Options

  • APolymorphic and Metamorphic malware
  • BPolymorphic and Macro malware
  • CMacro and Rootkit malware
  • DMetamorphic and Rootkit malware

How the community answered

(45 responses)
  • A
    13% (6)
  • B
    27% (12)
  • C
    4% (2)
  • D
    56% (25)

Why each option

The described malware exhibits characteristics of a rootkit by embedding its harmful code directly into genuine system binaries for stealth and persistence, and it is metamorphic by changing its code as it propagates to evade signature-based detection.

APolymorphic and Metamorphic malware

While metamorphic malware is correctly identified for code alteration, the description of embedding code into system binaries points specifically to a rootkit, which is not included in this option, and polymorphic malware is a less advanced form of code change than metamorphic.

BPolymorphic and Macro malware
CMacro and Rootkit malware
DMetamorphic and Rootkit malwareCorrect

The malware's ability to embed its harmful code into the actual binary or executable part of genuine system files is a defining characteristic of a rootkit, which aims to hide its presence within the operating system by subverting system functions. Furthermore, its capacity to change its code as it propagates to avoid signature-based detection is a hallmark of metamorphic malware, a more advanced form of self-modifying code that rewrites its entire instruction set.

Concept tested: Malware types: Rootkit and Metamorphic characteristics

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/intelligence/rootkits

Topics

#Malware analysis#Rootkit#Metamorphic malware#APT

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 312-50V12 Practice