GREM GREM Network Traffic Analysis & C2 Communication 2

Question 1

What is a Domain Generation Algorithm (DGA) and why do malware authors use it?

Accepted Answer

A technique that generates large numbers of pseudo-random domain names for C2 resilience

Answer

An algorithm that registers new domains automatically

Answer

A method to hijack legitimate DNS servers

Answer

A way to spoof domain ownership records

Question 2

Which HTTP header is a primary detection point for malware because it is often hardcoded to an unusual value?

Accepted Answer

User-Agent

Answer

Content-Type

Answer

Accept-Encoding

Answer

Connection

Question 3

What is a 'dead drop resolver' in malware C2 terminology?

Accepted Answer

A public platform like Pastebin where malware retrieves its actual C2 IP address

Answer

A backup C2 server used when the primary is down

Answer

A DNS sinkhole operated by researchers

Answer

An encrypted configuration file embedded in the binary

Question 4

Why do many modern RATs use TLS on port 443 for C2 communication?

Accepted Answer

It blends malicious traffic with legitimate HTTPS web traffic to evade detection

Answer

TLS on port 443 is faster than other protocols

Answer

Port 443 is the only port allowed through most firewalls

Answer

TLS provides stronger authentication than other options

Question 5

What network artifact strongly suggests HTTP-based C2 using a custom protocol?

Accepted Answer

Non-standard or misspelled HTTP headers combined with unusual URI patterns

Answer

Large ICMP echo packets

Answer

Elevated DNS TTL values on responses

Answer

Fragmented TCP segments

Question 6

What is the purpose of JA3 hash analysis in malware network traffic investigation?

Accepted Answer

To fingerprint TLS client implementations and identify malware families by their unique handshake parameters

Answer

To identify encrypted file attachments in SMTP traffic

Answer

To detect SQL injection attempts in HTTP bodies

Answer

To measure round-trip network latency