Mobile Device Malware Analysis GASF Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is performing dynamic analysis of a mobile malware sample in a sandbox. The malware is known to use a custom encryption algorithm for its C2 traffic. The analyst has set up a fake C2 server to interact with the malware. The malware sends an initial beacon that includes a device identifier and a public key. The analyst wants to decrypt the subsequent C2 traffic. Which step is necessary to successfully decrypt the traffic?

   • ADisable the malware's encryption by patching the binary to skip the encryption routine.
   • BExtract the malware's private key from the binary using static analysis, since the malware must store it locally.
   • CUse the fake C2 server's private key to decrypt the traffic, since the malware likely uses the server's public key to encrypt the session.
   • DUse a network sniffer to capture the traffic and then brute-force the encryption key.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During a forensic investigation of a compromised Android device, the examiner finds a suspicious native library (.so file) in the app's data directory. The library is not listed in the app's original APK. The examiner suspects the library is a rootkit that hides malicious processes. Which forensic technique would be MOST effective in confirming the presence of a rootkit?

   • ASearch the device's filesystem for files with suspicious names or permissions.
   • BCheck the app's manifest for the REQUEST_INSTALL_PACKAGES permission.
   • CCompare the list of running processes from the kernel's perspective (e.g., via /proc) with the list from user-space tools (e.g., 'ps').
   • DUse an antivirus app to scan the device for known rootkit signatures.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company allows employees to use personal Android devices for work (BYOD). An employee reports that their device is displaying persistent pop-up ads and the battery drains quickly. The employee admits to installing a 'free flashlight' app from an unknown website last week. Which infection vector and malware type best match this scenario?

   • AA drive-by download from a compromised website that exploited a browser vulnerability to install ransomware.
   • BSideloading of a trojanized app that displays adware and consumes resources.
   • CPhishing via SMS that tricked the employee into clicking a malicious link that installed a worm.
   • DA malicious app downloaded from the official Google Play Store that uses a privilege escalation exploit to gain root access.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A user reports that their Android device is showing persistent pop-up ads and the battery drains quickly. The user admits to installing a free flashlight app from an unknown website. The app is not listed in the device's app drawer, but the package name appears in Settings > Apps. Which infection vector and malware type best match this scenario?

   • ASideloading a trojanized app that acts as adware, hiding its icon to remain stealthy while displaying ads.
   • BA legitimate flashlight app that is poorly coded and causes battery drain, with ads being a normal part of the free version.
   • CPhishing via a malicious link that triggered a drive-by download of a worm that self-propagates to other devices.
   • DA drive-by download from the website that installed a ransomware payload, which is now encrypting files and displaying ads as a distraction.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which tool category is commonly used to detect known mobile malware by comparing file signatures against a database?

   • AHex editor
   • BDebugger
   • CAntivirus engine
   • DNetwork analyzer
   Reveal Solution Discussion Select an answer first