Which rootkit masquerades as cracked software or legitimate applications to infect systems and perform data exfiltration?

Which rootkit masquerades as cracked software or legitimate applications to infect systems and perform data exfiltration?

• A. Necurs
• B. Horse Pill
• C. LoJax
• D. Scranos

Answer: (D)

Masquerading as cracked software to spread infection is a technique used by rootkits to bypass user suspicion and gain a foothold on a system. Scranos is known for packaging itself with cracked software or legitimate-looking installers, tricking users into running it. Once it’s on the machine, it stays hidden while it collects sensitive data and exfiltrates it to the attacker, making this disguise and the resulting data theft a defining behavior of this threat. Other options populate different threat models: Necurs is mainly a spam-distributed botnet, LoJax is a persistent UEFI rootkit used for long-term espionage, and Horse Pill refers to another malware family with different delivery and goals, not primarily defined by masquerading as cracked software.

Masquerading as cracked software to spread infection is a technique used by rootkits to bypass user suspicion and gain a foothold on a system. Scranos is known for packaging itself with cracked software or legitimate-looking installers, tricking users into running it. Once it’s on the machine, it stays hidden while it collects sensitive data and exfiltrates it to the attacker, making this disguise and the resulting data theft a defining behavior of this threat. Other options populate different threat models: Necurs is mainly a spam-distributed botnet, LoJax is a persistent UEFI rootkit used for long-term espionage, and Horse Pill refers to another malware family with different delivery and goals, not primarily defined by masquerading as cracked software.