GCIH · Question #193
Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and…
The correct answer is D. Back Orifice. Port 31337 in the netstat UDP output is the default communication port of Back Orifice, a remote access Trojan that matches all described characteristics including the file size increase from joining the Trojan to chess.exe.
Question
Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it to chess.exe. The size of chess.exe was 526,895 bytes originally, and after joining this chess file to the Trojan, the file size increased to 651,823 bytes. When he gives you this new game, you install the infected chess.exe file on your computer. He now performs various malicious tasks on your computer remotely. But you suspect that someone has installed a Trojan on your computer and begin to investigate it. When you enter the netstat command in the command prompt, you get the following results:
C:\WINDOWS>netstat -an | find "UDP" UDP IP_Address:31337 : Now you check the following registry address:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices In the above address, you notice a 'default' key in the 'Name' field having " .exe" value in the corresponding 'Data' field. Which of the following Trojans do you think your friend may have installed on your computer on the basis of the above evidence?
Options
- AQaz
- BDonald Dick
- CTini
- DBack Orifice
How the community answered
(25 responses)- A4% (1)
- C4% (1)
- D92% (23)
Why each option
Port 31337 in the netstat UDP output is the default communication port of Back Orifice, a remote access Trojan that matches all described characteristics including the file size increase from joining the Trojan to chess.exe.
Qaz is a worm that replaces notepad.exe and uses TCP port 7597 for communication, not UDP port 31337.
Donald Dick is a remote access Trojan that uses TCP-based communication on different ports and does not use UDP port 31337 as its default channel.
Tini is a minimal backdoor Trojan that listens on TCP port 7777, not UDP port 31337.
Back Orifice is a remote administration Trojan developed by the Cult of the Dead Cow that listens on UDP port 31337 by default - the exact port shown in the netstat output. It allows full remote control of infected Windows systems and is commonly spread by binding it to legitimate executables, which explains the file size increase from 526,895 to 651,823 bytes.
Concept tested: Identifying Back Orifice Trojan via port 31337
Topics
Community Discussion
No community discussion yet for this question.