Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:

C:\WINDOWS>netstat -an | find "UDP" UDP IP_Address:31337 : Now you check the following registry address:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices In the above address, you notice a 'default' key in the 'Name' field having " .exe" value in the corresponding 'Data' field. Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?

Question

Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:

C:\WINDOWS>netstat -an | find "UDP" UDP IP_Address:31337 : Now you check the following registry address:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices In the above address, you notice a 'default' key in the 'Name' field having " .exe" value in the corresponding 'Data' field. Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?

Accepted Answer

D. Back Orifice Back Orifice listens by default on UDP port 31337, a deliberate reference to 'elite' hacker slang ('leet'), making the netstat output a classic indicator of infection. It allows an attacker to remotely control a Windows system - performing file operations, capturing keystrokes, and executing commands - which matches the remote malicious activity described in the scenario. The file size increase after joining chess.exe to the Trojan is also consistent with how Back Orifice was distributed as a bundled payload.

Answer

A. Tini Tini is a simple backdoor Trojan that listens on TCP port 7777, not UDP port 31337.

Answer

B. Qaz Qaz is a worm/Trojan that uses TCP port 7597 and spreads by infecting notepad.exe, which does not match the port or the chess.exe infection vector described.

Answer

C. Donald Dick Donald Dick is a remote administration Trojan that uses ports 23476 and 23477, not UDP port 31337.

Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and…

Question

Options

How the community answered

Why each option

Topics

Community Discussion