nerdexam
GIAC

GCIH · Question #285

Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and…

The correct answer is A. NetBus C. Yet Another Binder D. Chess.exe. Binding a Trojan to a legitimate file requires three components: the Trojan payload itself, a file binder utility to merge the two executables, and the legitimate host file used as the carrier.

Malware Analysis & Advanced Persistent Threats

Question

Your friend plans to install a Trojan on your computer. He knows that if he gives you a new version of chess.exe, you will definitely install the game on your computer. He picks up a Trojan and joins it with chess.exe. Which of the following tools are required in such a scenario? Each correct answer represents a part of the solution. Choose three.

Options

  • ANetBus
  • BAbsinthe
  • CYet Another Binder
  • DChess.exe

How the community answered

(31 responses)
  • A
    90% (28)
  • B
    10% (3)

Why each option

Binding a Trojan to a legitimate file requires three components: the Trojan payload itself, a file binder utility to merge the two executables, and the legitimate host file used as the carrier.

ANetBusCorrect

NetBus is a Remote Access Trojan that provides the attacker with covert backdoor control of the victim's machine once executed, serving as the malicious payload in this binding scenario.

BAbsinthe

Absinthe is an automated blind SQL injection exploitation tool used against databases and plays no role in binding or delivering Trojan payloads via file bundling.

CYet Another BinderCorrect

Yet Another Binder (YAB) is a file-binding tool designed specifically to combine two or more executables into a single file, enabling the Trojan to be silently embedded inside chess.exe.

DChess.exeCorrect

chess.exe is the legitimate carrier file; it is required because it acts as the decoy that motivates the victim to willingly execute the combined file, unknowingly triggering the embedded Trojan.

Concept tested: Trojan delivery via file binding with a legitimate executable

Topics

#Trojan horse#file binder#NetBus#malware bundling

Community Discussion

No community discussion yet for this question.

Full GCIH Practice