GREM GREM Network Traffic Analysis & C2 Communication

Question 1

Which tool is the standard choice for capturing and analyzing network packets during a malware sandbox session?

Accepted Answer

Wireshark

Answer

Wireshark is the standard packet capture and analysis tool used by malware analysts to inspect network traffic generated during sandbox execution.

Question 2

In C2 malware communication, what is a 'beacon interval'?

Accepted Answer

The periodic delay between a malware's check-in requests to its C2 server

Answer

A beacon interval is the periodic time delay between successive check-in requests that an infected host sends to its command-and-control server.

Question 3

Which DNS record type is most frequently abused by malware for covert data exfiltration?

Accepted Answer

TXT

Answer

TXT records can carry arbitrary text data and are commonly abused to tunnel C2 traffic or exfiltrate data because many firewalls permit DNS TXT queries.

Question 4

What does the fast-flux DNS technique allow malware C2 infrastructure to do?

Accepted Answer

Rapidly cycle through IP addresses to evade blocklists

Answer

Fast-flux DNS rapidly rotates the IP addresses associated with a C2 domain, making it impractical to block the infrastructure with static IP blocklists.

Question 5

Which FLARE-developed tool simulates DNS, HTTP, and SMTP services during malware analysis to capture outbound requests?

Accepted Answer

FakeNet-NG

Answer

FakeNet-NG intercepts and simulates network services including DNS, HTTP, and SMTP so that malware's network callbacks are captured without requiring real internet access.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM GREM Network Traffic Analysis & C2 Communication