350-201 Question 187
Single answerA security analyst has been tasked with performing reverse engineering on a suspicious executable file that was flagged by the organization's Intrusion Detection System (IDS). The analyst uses a disassembler tool to analyze the file. During the process, they observe the following: the presence of obfuscated strings, references to a network socket, and suspicious API calls such as 'CreateRemoteThread' and 'VirtualAllocEx'. Based on these findings, what is the most likely purpose of the executable?
- A
It is a legitimate system utility.
- B
It is a ransomware payload designed to encrypt files.
- C
It is a keylogger designed to capture user inputs.
- D
It is a remote access trojan (RAT) designed for unauthorized control of the victim's system.
Show answer and explanation
Correct answer: D
Explanation
The combination of observed behaviors, obfuscated strings, network socket references, and suspicious API calls like 'CreateRemoteThread' and 'VirtualAllocEx', strongly indicates that the executable is a remote access trojan (RAT). These characteristics align with typical RAT functionality, which includes evading detection, communicating over a network, and injecting code into other processes for unauthorized system control.
- A. Incorrect.
Legitimate system utilities do not typically use obfuscation or suspicious API calls like 'CreateRemoteThread' and 'VirtualAllocEx'.
- B. Incorrect.
While ransomware may use obfuscation, it typically includes file system activity, encryption routines, and specific APIs for cryptographic functions, which are not mentioned in this scenario.
- C. Incorrect.
Keyloggers focus on capturing user inputs and are less likely to use API calls such as 'CreateRemoteThread' or 'VirtualAllocEx', which are more indicative of process injection or remote control.
- D. Correct.
Remote access trojans (RATs) commonly use obfuscation to evade detection, network socket references for communication, and APIs like 'CreateRemoteThread' and 'VirtualAllocEx' for process injection or establishing remote control.