nerdexam
GIAC

GCIH · Question #21

Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?

The correct answer is C. Win32/Conflicker. Win32/Conficker is a network worm that specifically targets the MS08-067 vulnerability in the Windows RPC subsystem to propagate across networks automatically.

Malware Analysis & Advanced Persistent Threats

Question

Which of the following is a network worm that exploits the RPC sub-system vulnerability present in the Microsoft Windows operating system?

Options

  • AWin32/Agent
  • BWMA/TrojanDownloader.GetCodec
  • CWin32/Conflicker
  • DWin32/PSW.OnLineGames

How the community answered

(61 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    93% (57)
  • D
    3% (2)

Why each option

Win32/Conficker is a network worm that specifically targets the MS08-067 vulnerability in the Windows RPC subsystem to propagate across networks automatically.

AWin32/Agent

Win32/Agent is a generic trojan family that performs actions such as downloading additional malware, but does not exploit the RPC sub-system vulnerability for network worm propagation.

BWMA/TrojanDownloader.GetCodec

WMA/TrojanDownloader.GetCodec is a trojan downloader that disguises itself as a media codec to trick users into installing malware, and is not a network worm exploiting RPC vulnerabilities.

CWin32/ConflickerCorrect

Win32/Conficker exploits the MS08-067 vulnerability in the Windows Server Service RPC subsystem, enabling remote code execution and self-propagation across networks without user interaction. It was discovered in 2008 and infected millions of Windows systems by spreading via the RPC exploit, network shares, and removable drives. Its defining characteristic as a network worm is this automated propagation through the RPC vulnerability.

DWin32/PSW.OnLineGames

Win32/PSW.OnLineGames is a password-stealing trojan designed to harvest credentials from online games, not a network worm that exploits RPC sub-system vulnerabilities.

Concept tested: Identifying Win32/Conficker as an RPC-exploiting worm

Source: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FConficker

Topics

#Conficker worm#RPC vulnerability#network worm#Windows exploit

Community Discussion

No community discussion yet for this question.

Full GCIH Practice