Source code snippets for two separate malware samples are shown below: Which of the following describes the most important observation about the two samples?

The correct answer is B. The samples were probably written by the same developer. Both samples share similar naming conventions (knockEmDown, sendC2, toString() usage), structure, and coding style (e.g., address.keepAlive("paranoid"), target.toShell(e), etc.), suggesting a common author or coding template. These stylistic similarities are strong indicators…

Submitted by emma.c· Mar 6, 2026Security Operations

Question

Source code snippets for two separate malware samples are shown below:

Which of the following describes the most important observation about the two samples?

Exhibits

Options

ATelemetry is first buffered and then transmitted in paranoid mode.
BThe samples were probably written by the same developer.
CBoth samples use IP connectivity for command and control.
DSample 1 is the target agent while Sample 2 is the C2 server.

How the community answered

(42 responses)

A
5% (2)
B
67% (28)
C
10% (4)
D
19% (8)

Explanation

Both samples share similar naming conventions (knockEmDown, sendC2, toString() usage), structure, and coding style (e.g., address.keepAlive("paranoid"), target.toShell(e), etc.), suggesting a common author or coding template. These stylistic similarities are strong indicators that they were likely written by the same developer.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice