312-50V13 · Question #616
A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly s
The correct answer is D. Metamorphic and Rootkit malware. The malware described, which embeds harmful code into genuine system files and changes its code as it propagates, aligns with the characteristics of metamorphic malware and a rootkit.
Question
Options
- APolymorphic and Metamorphic malware
- BPolymorphic and Macro malware
- CMacro and Rootkit malware
- DMetamorphic and Rootkit malware
How the community answered
(26 responses)- A12% (3)
- B4% (1)
- C19% (5)
- D65% (17)
Why each option
The malware described, which embeds harmful code into genuine system files and changes its code as it propagates, aligns with the characteristics of metamorphic malware and a rootkit.
Polymorphic malware changes its code while retaining the original algorithm, often by encrypting parts of itself with different keys, but it doesn't typically rewrite its entire code or use a mutation engine like metamorphic malware.
Macro malware relies on macros within documents (e.g., Office files) to execute, which does not match the description of embedding into system binaries or changing code propagation.
Macro malware is incorrect as it does not typically embed into system files in the manner described, nor does it inherently change its code as it propagates in a metamorphic fashion.
The description of "embedding its harmful code into the actual binary or executable part of genuine system files" strongly indicates a rootkit, which aims to gain persistent and stealthy control by hiding its presence within the operating system. The characteristic of "changes its code as it propagates, making signature-based detection approaches nearly impossible" directly defines metamorphic malware, which rewrites its own code for each infection, often using a "mutation engine," to create functionally identical but syntactically different variants.
Concept tested: Metamorphic malware and Rootkit characteristics
Source: https://www.microsoft.com/en-us/security/business/security-101/what-is-polymorphic-malware
Topics
Community Discussion
No community discussion yet for this question.