GREM GREM Network Traffic Analysis & C2 Communication

Question 1

Which tool is the standard choice for capturing and analyzing network packets during a malware sandbox session?

Accepted Answer

Wireshark

Answer

IDA Pro

Answer

x64dbg

Answer

Ghidra

Question 2

In C2 malware communication, what is a 'beacon interval'?

Accepted Answer

The periodic delay between a malware's check-in requests to its C2 server

Answer

The encryption key rotation period

Answer

The time between infection and payload execution

Answer

The interval between file system scans

Question 3

Which DNS record type is most frequently abused by malware for covert data exfiltration?

Accepted Answer

TXT

Answer

MX

Answer

SOA

Answer

AAAA

Question 4

What does the fast-flux DNS technique allow malware C2 infrastructure to do?

Accepted Answer

Rapidly cycle through IP addresses to evade blocklists

Answer

Resolve domains faster than standard DNS

Answer

Encrypt DNS queries end-to-end

Answer

Use UDP exclusively for command traffic

Question 5

Which FLARE-developed tool simulates DNS, HTTP, and SMTP services during malware analysis to capture outbound requests?

Accepted Answer

FakeNet-NG

Answer

PE Explorer

Answer

OllyDbg

Answer

Resource Hacker

Question 6

Which Wireshark display filter correctly isolates only HTTP GET requests from a traffic capture?

Accepted Answer

http.request.method == "GET"

Answer

http.request.method == "POST"

Answer

tcp.port == 80

Answer

http.method.get == 1