Which rootkit is described as trojanized and masquerades as cracked software to infect systems and perform data exfiltration?

Which rootkit is described as trojanized and masquerades as cracked software to infect systems and perform data exfiltration?

• A. Scranos
• B. LoJax
• C. Necurs
• D. Horse Pill

Answer: (A)

Starting with the main idea: this type of rootkit relies on social-engineering by posing as cracked software to lure victims, then hides deep in the system while secretly stealing data. Scranos fits this pattern because it was distributed through trojanized installers that looked like cracked software. Once installed, it uses kernel-level techniques to hide its files and processes and sets up data-exfiltration capabilities that grab sensitive information (credentials, financial data, etc.) and send it back to the attacker. The disguise as cracked programs is the key tactic that enables initial infection, while the rootkit and exfiltration components keep it stealthy and effective. The other options involve different infection methods or targets. LoJax is known for persisting in the UEFI firmware, not for being spread via cracked software; Necurs is a mass-spam botnet rather than a rootkit that hides itself and exfiltrates data; Horse Pill is associated with different attack patterns and isn’t characterized by masquerading as cracked software to perform data exfiltration.

Starting with the main idea: this type of rootkit relies on social-engineering by posing as cracked software to lure victims, then hides deep in the system while secretly stealing data. Scranos fits this pattern because it was distributed through trojanized installers that looked like cracked software. Once installed, it uses kernel-level techniques to hide its files and processes and sets up data-exfiltration capabilities that grab sensitive information (credentials, financial data, etc.) and send it back to the attacker. The disguise as cracked programs is the key tactic that enables initial infection, while the rootkit and exfiltration components keep it stealthy and effective.

The other options involve different infection methods or targets. LoJax is known for persisting in the UEFI firmware, not for being spread via cracked software; Necurs is a mass-spam botnet rather than a rootkit that hides itself and exfiltrates data; Horse Pill is associated with different attack patterns and isn’t characterized by masquerading as cracked software to perform data exfiltration.