Identifying Metamorphic and Rootkit Malware Techniques

Malware Threats

A multinational corporation's computer system was infiltrated by an advanced persistent threat (APT). During forensic analysis, it was discovered that the malware was utilizing a blend of two highly sophisticated techniques to stay undetected and continue its operations. Firstly, the malware was embedding its harmful code into the actual binary or executable part of genuine system files rather than appending or prepending itself to the files. This made it exceptionally difficult to detect and eradicate, as doing so risked damaging the system files themselves. Secondly, the malware exhibited characteristics of a type of malware that changes its code as it propagates, making signature-based detection approaches nearly impossible. On top of these, the malware maintained a persistent presence by installing itself in the registry, making it able to survive system reboots. Given these distinctive characteristics, which two types of malware techniques does this malware most closely embody?

Polymorphic and Metamorphic malware
Polymorphic and Macro malware
Macro and Rootkit malware
Metamorphic and Rootkit malware Correct Answer

Answer Correct answer: D — The malware embodies Metamorphic techniques by restructuring its code to evade detection and Rootkit techniques by installing in the registry for persistent survival.

Community Votes

60%

40%

60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the ability to distinguish between polymorphic and metamorphic malware based on code rewriting methods, while identifying rootkits by their persistence and evasion tactics.

This question examines the identification of advanced malware characteristics, specifically metamorphic code alteration and rootkit persistence mechanisms. It establishes that embedding in binary files and registry installation are key indicators of these specific threat types.

Candidates often select Polymorphic malware because they associate 'changing code' with encryption keys, missing the explicit detail that the malware rewrites its own structure (metamorphic). Others miss the rootkit aspect, focusing only on the evasion.

Community Discussion (8 comments)

agelbahri 👍 1 Selected: A

the key focus of the question lies in its advanced evasion methods through code alteration. Rootkits don't inherently alter their code like Polymorphic or Metamorphic malware do.

skorek31 👍 1 Selected: D

Metamorphic → evades detection by rewriting its own code with every iteration, making it new and unique from its previous code. This malware doesn`t use any encryption keys Polymorphic → continually changes its features using dynamic encryption keys, making each iteration appear different, malware in the question doesn’t use encryption keys

49f4430 👍 1 Selected: A

For mw chat GPT say A, i will go for A

LordXander 👍 2 Selected: A

Guys...it's A for the following reasons: Polymorphic as it hides as a genuine executable (polymorphic capabilities) Metamorphic - the malware changes it's code. It could've been C if it mentioned that it was not seen by antivirus solutions as rootkits would run at a lower lever (higher priveleges) than antivirus and would be undetectable.

anarchyeagle 👍 1

ChatGPT Why not D: D. Metamorphic and Rootkit malware: While the malware does exhibit metamorphic characteristics, and its persistence could be seen as rootkit-like, the description focuses more on the malware's ability to change its code and embed itself in system files, which are hallmarks of polymorphic and metamorphic malware. Rootkits primarily focus on hiding the presence of malware, which, while possibly a feature of this malware, is not explicitly described in the scenario.

qwerty100 👍 4 Selected: D

D. Metamorphic and Rootkit malware

xbsumz 👍 2

Ethical hacking experts can you verify this procedure

insaniunt 👍 1 Selected: D

Polymorphic: The malware changes its code as it propagates, making signature-based detection approaches nearly impossible. This aligns with the characteristics of polymorphic malware. Rootkit: The malware installs itself in the registry, ensuring a persistent presence and the ability to survive system reboots. This behavior is typical of rootkit malware, which often hides its presence and maintains control over the compromised system by integrating itself deeply into the operating system, often in the registry or kernel lev

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The malware exhibits two distinct behaviors that map directly to Metamorphic and Rootkit techniques. First, it embeds code into genuine system binaries rather than appending/prepending, which is a hallmark of metamorphic malware that restructures its code to avoid signatures. Second, it installs itself in the registry to survive reboots and maintain presence, a classic rootkit behavior designed for persistence and stealth.

Why the Other Options Are Wrong

Polymorphic malware typically uses encryption with changing keys to alter its signature but does not necessarily rewrite its internal logic or structure as thoroughly as metamorphic malware. Macro malware relies on script languages within documents, which is not described here. Option A fails to account for the persistence mechanism, and Option C incorrectly identifies macro malware.

Community Comment Notes

Community discussion highlights the confusion between polymorphic and metamorphic traits. As qwerty100 noted, the answer is D due to the specific description of code rewriting without encryption keys. Some users like LordXander argued for A, mistakenly interpreting 'hiding as a genuine executable' as polymorphism, whereas the structural change indicates metamorphism. The consensus correctly identifies the lack of encryption key mention as the differentiator for metamorphic behavior.

Exam Strategy

Focus on the keywords 'rewriting code', 'no encryption keys', and 'registry/installation'. When you see 'changes code' without mentioning encryption, think Metamorphic. When you see 'persistence', 'hiding in OS', or 'registry/BIOS', think Rootkit.

Frequently Asked Questions

How do I tell Polymorphic from Metamorphic malware?

Polymorphic uses encryption with changing keys. Metamorphic rewrites its own code structure/logic entirely, often without encryption.

Why is this considered Rootkit behavior?

Rootkits focus on persistence and hiding. Installing in the registry to survive reboots and maintain access is a standard rootkit tactic.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide