CEH Practice Question: Malware, Social Engineering and Network Attacks

A system administrator notices unusual outbound traffic from a server on port 4444. The server has no legitimate service listening on that port. A malware analyst runs 'strings' on a suspicious binary and finds a reference to 'cmd.exe /c' and an IP address. What type of malware is MOST likely present?

⚠ Common exam trap

The trap here is that candidates may associate port 4444 with legitimate services like Kerberos or Blizzard games, but CEH expects you to recognize it as the default Metasploit reverse shell port, not a worm or ransomware indicator.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Backdoor Trojan

The outbound traffic on port 4444, a common port for the Metasploit Meterpreter reverse shell, combined with the 'strings' output showing 'cmd.exe /c' (a command shell invocation) and an IP address, indicates a backdoor Trojan. This malware type establishes a covert reverse connection to an attacker's command-and-control server, allowing remote shell access without a legitimate service on the target port.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Worm
Why it's wrong here
Worms are self-replicating malware that primarily focus on spreading autonomously across networks, often exploiting vulnerabilities to propagate without user interaction. While a worm might deliver a payload, such as a backdoor, its defining characteristic is its ability to spread. The observed "unusual outbound traffic" combined with `cmd.exe /c` on port 4444 specifically indicates a remote command execution channel, which is a *result* of a payload, not the primary mechanism or purpose of a worm's propagation itself.
✗
Keylogger
Why it's wrong here
A keylogger is a type of surveillance software designed to record every keystroke made on a target machine, often used for credential theft or espionage. While keyloggers do generate outbound traffic to exfiltrate captured data, they are not designed to establish an interactive remote command shell or execute arbitrary commands like `cmd.exe /c` on a specific port such as 4444. The observed activity directly points to interactive remote control rather than passive data collection.
✓
Backdoor Trojan
Why this is correct
A Backdoor Trojan is malware disguised as legitimate software that, once executed, creates a covert entry point into a compromised system, bypassing normal authentication mechanisms. The "unusual outbound traffic" combined with the execution of `cmd.exe /c` on a non-standard port like 4444 is a classic indicator of a Remote Access Trojan (RAT) or backdoor establishing a command-and-control (C2) channel. This setup allows an attacker to remotely issue commands and control the compromised machine, aligning perfectly with the observed remote shell activity.
✗
Ransomware
Why it's wrong here
Ransomware is a type of malicious software designed to encrypt a victim's files or lock them out of their system, then demand a ransom payment, typically in cryptocurrency, for decryption or access restoration. While ransomware might communicate with a C2 server for key exchange or payment instructions, its primary operational goal is data encryption and extortion, not establishing an interactive remote command shell via `cmd.exe /c` on a specific port like 4444. The observed activity is indicative of direct system control, not file encryption.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question