GREM GREM Network Traffic Analysis & C2 Communication 2

Question 1

What is a Domain Generation Algorithm (DGA) and why do malware authors use it?

Accepted Answer

A technique that generates large numbers of pseudo-random domain names for C2 resilience

Answer

DGA malware generates many pseudo-random domain names per day so that blocklisting all potential C2 domains is computationally infeasible for defenders.

Question 2

Which HTTP header is a primary detection point for malware because it is often hardcoded to an unusual value?

Accepted Answer

User-Agent

Answer

The User-Agent header identifies the client application and is frequently hardcoded in malware to a non-browser string, making it a reliable network-based indicator.

Question 3

What is a 'dead drop resolver' in malware C2 terminology?

Accepted Answer

A public platform like Pastebin where malware retrieves its actual C2 IP address

Answer

A dead drop resolver uses a legitimate public platform to host the actual C2 address, letting malware retrieve it without generating directly suspicious traffic.

Question 4

Why do many modern RATs use TLS on port 443 for C2 communication?

Accepted Answer

It blends malicious traffic with legitimate HTTPS web traffic to evade detection

Answer

Using TLS on port 443 lets malware blend C2 traffic with normal HTTPS web browsing, making it difficult for network monitoring tools to distinguish from legitimate traffic.

Question 5

What network artifact strongly suggests HTTP-based C2 using a custom protocol?

Accepted Answer

Non-standard or misspelled HTTP headers combined with unusual URI patterns

Answer

Bespoke malware C2 protocols often reveal themselves through custom, misspelled, or absent HTTP headers and unusual URI structures that differ from legitimate browser traffic.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM GREM Network Traffic Analysis & C2 Communication 2