nerdexam
GIAC

GCIH · Question #214

John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux-based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company…

The correct answer is B. Ramen. The Ramen worm specifically targeted Red Hat Linux 6.2 and 7.0 systems, using the synscan tool to generate random IP addresses and leaving tar.gz packages on compromised hosts.

Malware Analysis & Advanced Persistent Threats

Question

John works as a Professional Ethical Hacker for NetPerfect Inc. The company has a Linux-based network. All client computers are running on Red Hat 7.0 Linux. The Sales Manager of the company complains to John that his system contains an unknown package named as tar.gz and his documents are exploited. To resolve the problem, John uses a Port scanner to enquire about the open ports and finds out that the HTTP server service port on 27374 is open. He suspects that the other computers on the network are also facing the same problem. John discovers that a malicious application is using the synscan tool to randomly generate IP addresses. Which of the following worms has attacked the computer?

Options

  • ACode red
  • BRamen
  • CLoveLetter
  • DNimda

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    81% (26)
  • C
    9% (3)
  • D
    3% (1)

Why each option

The Ramen worm specifically targeted Red Hat Linux 6.2 and 7.0 systems, using the synscan tool to generate random IP addresses and leaving tar.gz packages on compromised hosts.

ACode red

Code Red targeted Microsoft IIS web servers running on Windows platforms, not Linux-based systems.

BRamenCorrect

The Ramen worm targeted Red Hat Linux 6.2 and 7.0 by exploiting vulnerabilities in wu-ftpd, rpc.statd, and LPRng services, dropped tar.gz-named files on infected systems, opened port 27374 as a backdoor, and used the synscan tool to randomly generate and scan IP addresses for further propagation - matching every indicator described in the scenario.

CLoveLetter

LoveLetter (ILOVEYOU) was a VBScript email worm that spread through Windows systems via email attachments, not Linux environments.

DNimda

Nimda was a multi-vector worm targeting Windows systems through email, network shares, and IIS vulnerabilities, not Linux.

Concept tested: Linux worm identification by behavioral indicators

Topics

#Ramen worm#Linux malware#synscan#worm identification

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice