You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet…

The name resolution process on a Unix system first checks the local /etc/hosts file before querying a DNS server. The goal is to make the malware running on the infected computer (192.168.1.120) connect to the analysis computer (192.168.1.115). To achieve this, the hosts file on the infected machine must be modified. An entry must be added that maps the hostname the malware is trying to resolve (iamabadserver.com) to the IP address of the desired destination (192.168.1.115). This redirects the malware's network traffic to the controlled analysis machine, a common technique in dynamic malware analysis.

A. Modifying the hosts file on the destination computer has no effect on the name resolution process occurring on the source (infected) computer.

C. This entry modifies the correct file but redirects the malware to connect to itself (192.168.1.120), not the intended analysis computer.

D. The name resolution is performed by the client initiating the connection (the infected machine), not the machine it is intended to connect to.

1. Red Hat Enterprise Linux 8 Documentation

"Configuring host names"

Section 3.2

"Configuring static host names using the /etc/hosts file": This official documentation specifies that the /etc/hosts file is used to map hostnames to IP addresses on a local machine

particularly in the absence of a DNS server. It confirms the format IP-address canonical-hostname [aliases...] and its role in the name resolution process.

2. MIT OpenCourseWare

6.033 Computer System Engineering

Spring 2018

Recitation 10: Naming

Section 2

"Name Resolution": This university courseware explains the hierarchy of name resolution. It clarifies that a system will check local configuration files

such as /etc/hosts

for a mapping before attempting to contact an external DNS server. This principle is central to why modifying the local hosts file works.

3. Sikorski

M.

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. (Referenced in numerous university curricula

e.g.

Carnegie Mellon University

Course 14-822): Chapter 16

"Malware-Focused Network Signatures

" and Chapter 19

"Analyzing Malicious Documents

" describe the technique of using the /etc/hosts file to redirect a malware's network communications to a local analysis machine to observe its behavior in a controlled environment.