CEH Practice Question: Malware, Social Engineering and Network Attacks

A security analyst discovers a user downloaded a file that, when executed, creates a hidden process that connects to a remote server and allows full remote control of the system. Which type of malware BEST describes this behavior?

⚠ Common exam trap

Test-takers frequently confuse a RAT with a worm or virus because they focus on the 'remote control' aspect, but fail to recognize that a RAT specifically provides interactive remote access, whereas worms and viruses have different primary behaviors like self-replication or code mutation.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Remote Access Trojan (RAT)

The behavior described—downloading a file that, when executed, creates a hidden process that connects to a remote server and provides full remote control—is the classic definition of a Remote Access Trojan (RAT). A RAT is a type of malware that allows an attacker to remotely control the victim's system, often using a command-and-control (C2) channel over protocols like TCP or HTTP. The hidden process and outbound connection to a remote server are key indicators of a RAT, distinguishing it from other malware types that do not provide interactive remote control.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Worm
Why it's wrong here
Worms are self-replicating malware that spread autonomously across networks, often exploiting vulnerabilities without user interaction. Their primary goal is typically network disruption, resource consumption, or acting as a carrier for other payloads, but they are not inherently designed to provide persistent, interactive remote control over a single infected machine. They prioritize widespread infection over deep, sustained control of individual systems.
✗
Ransomware
Why it's wrong here
Ransomware is a type of malicious software designed to block access to a computer system or encrypt its data until a sum of money is paid. Its core functionality revolves around data denial and extortion, making files inaccessible and demanding payment for decryption. It does not establish a persistent backdoor for remote command execution or surveillance, focusing solely on financial gain through data hostage-taking.
✓
Remote Access Trojan (RAT)
Why this is correct
A Remote Access Trojan (RAT) is a sophisticated form of malware specifically engineered to grant an attacker comprehensive, covert administrative control over an infected system. It establishes a persistent backdoor, enabling remote execution of commands, file manipulation, keystroke logging, screen capture, and even webcam/microphone activation. This direct, interactive control makes a RAT the definitive tool for remote system manipulation and surveillance.
✗
Polymorphic virus
Why it's wrong here
A polymorphic virus is characterized by its ability to change its internal structure, encryption, or code signature with each infection, making it challenging for traditional signature-based antivirus software to detect. This mutation capability is an evasion technique rather than a specific payload or functionality. While it can carry various malicious payloads, polymorphism itself does not inherently provide remote access or control over the compromised system.

Visual reference

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question