Ethical › Module 7 › Lesson 1
Malware Families Without Samples
Virus, worm, trojan, ransomware as delivery and intent — not a zoo of files.
Visual · malware_families_vocab
Four defender words — virus, worm, trojan, ransomware — name how code arrives and what it is for. They are not a download list.
Opening
A family is a sentence about delivery and intent. A zip of samples is not this course, and it is not literacy.
Module 6 talked access and hashes as defense, not as a cracking kit. Unwanted code is the next named threat in the same ethical-hacking map: people still say “virus” for everything that beeps, then they hunt live files “to see.” That hunt is how a study hour becomes a foothold on the machine you meant to protect. In Cyberlium wording, a malware family is a short claim about how the code is carried (delivery) and what the operator wanted (intent). A virus rides a host file you run. A worm copies itself. A trojan lies about being useful. Ransomware is extortion against your data. Those four sentences let a defender pick a control — refuse the file, patch the service, restore the backup — without collecting a zoo. This lesson is ORIGINAL Cyberlium teaching mapped to the CEH v13 malware-threats domain — not official EC-Council training, not a certification, not exam dumps. You will not download live samples, “malware bazaar” homework, ransomware builders, RATs, or packers. Next lesson names the human and install paths (email, sideload, macros) that Topic 5 and Topic 6 already trained you to refuse. Here you practice the quieter skill: write the vocabulary, lock the notes, and treat a sample archive as out of ethics.
1. Family means delivery plus intent — not a hash, not a museum of files
Defenders need shared nouns so a ticket is not “bad stuff on the laptop.” Delivery is the ride: a document the user opened, a copy that jumped a share, an installer that pretended to be a game. Intent is the job: replicate, steal, lock files for money, spy. A family name is those two facts glued together. It is not a SHA-256 of a binary you found on a forum. Topic 8 already taught that a matching hash is byte equality, not a morality certificate; here a matching family label is a hypothesis about behavior, not proof you should fetch the specimen. Public news may say “ransomware hit org X.” Your homework is still not that org’s disk image, and it is not a replica you compile “to understand encryption.” Understanding, in this module, is naming the ride and the job so the control is obvious.
Overlap is normal. One incident can be a trojan (disguise) that drops ransomware (extortion) after a phish (Topic 5 delivery). Wormable ransomware is taught in history talks because spread and extortion happened together. The point of the vocabulary is to pick more than one control: refuse the lure, patch the hole that let it spread, restore from a backup the encryptor cannot reach. Collecting five filenames that “are WannaCry-like” does not add a sixth control. It adds a sixth way to infect the lab PC. This path refuses that museum. example.com was the safe name in Module 2; the safe object here is a notes file of definitions, not a samples folder.
Command guide
Family = delivery plus intent — WHAT/WHY (no sample museum)
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' family_means: delivery path + operator intent not_a_museum: I will not collect live malware files for this course EOF
2. Virus vs worm: a host you run vs a copy that travels
A virus, as this course uses the word, needs a host the user (or a process they started) already intended to run: a program, a document with active content, a removable file they copied. Delivery is piggyback. Intent historically mixed replication with a payload. The defender sentence is: do not run surprise executables; treat unexpected attachments like Topic 5 treated surprise links; keep backups because a host you trusted can still be a ride. You do not “confirm” a virus by executing a specimen. Execution is the foothold. You confirm by refusing the file, by vendor/OS messaging on a device you own, and by restore if damage already happened — Lesson 3.
A worm copies itself across a network, a share, or careless removable media without needing a fresh social lure at every hop. Delivery is automation of spread. Intent is scale. This course will not teach you to write one, scan a neighbor for one, or replay a historic outbreak against a café. The defender sentence is Module 5 plus hygiene: patch the named bug that made spread cheap, turn off services you do not need, do not plug an unknown USB “to see what is on it.” Famous worm names belong in a history paragraph, not in a downloads directory. If a classmate says the CEH domain is incomplete without a live worm, they are describing a different, unauthorized hobby. This path is not official CEH training and does not give that hobby.
3. Trojan vs ransomware: a lie about usefulness vs extortion against data
A trojan is unwanted code that arrives dressed as something you asked for: a helper, a crack, a “PDF invoice” that is an executable, an APK with a bank icon (Topic 6). Delivery is deception. Intent is whatever was hidden — steal a session, persist, open a door for someone else. This lesson names the disguise. It does not name how to build a remote-access tool, how to hide an icon, or how to pack the lie so scanners miss it. Packing and obfuscation labs are out. RAT construction is out. The control is the same refusal Topic 5 and Topic 6 already drilled: surprise installers are not a research method; cracked tools are not cheaper software; the icon is not the identity.
Ransomware is an intent word: deny you your files (encrypt or lock) and demand payment, or destroy them to hurt. Delivery can be any ride — email attachment, sideload, stolen credentials from Module 6’s threat picture, a wormable service left unpatched. The family label tells the defender to prioritize backups that the encryptor cannot reach, isolation so it does not share-spread, and restore from trusted media — not a builder, not a decryptor you download from a random blog, not a payment as a “lab.” Paying a criminal gang is not a Cyberlium exercise. Building an encryptor “to see” is malware authoring. Both are out. Lesson 3 will make the recovery order boring on purpose.
4. What you record: four sentences, ethics line — never a specimen path
A family note is boring on purpose. Date (UTC). Four one-line definitions in your words: virus, worm, trojan, ransomware — each must mention delivery or intent, not a filename. One overlap sentence (a trojan can drop ransomware). Ethics line: no live samples, no virus downloads, no packing, no RATs, no ransomware builders, no neighbor’s PC as a zoo. Empty files fail. Files that list hashes of malware you fetched fail even if you “did not run them.” Possession of a specimen is not a literacy trophy in this course. chmod 600 so another local account does not read your lab tree. You will reuse the same folder in Lessons 2–4 for foothold, detection, and the hygiene audit. Start the habit now so the lab is fill-in, not invention.
A useful failure: you write “virus = bad file,” feel the lesson is too small, and search for a live sample to make it “real.” That feeling is how people graduate into unauthorized handling of harmful code. The skill is stopping at vocabulary. Next lesson will name email, sideload, and macros as the rides humans actually offer — still without a packer, still without a payload kit. Module 1’s permission line still holds: skill does not create consent, and curiosity does not create a safe sandbox when the object is malware.
5. Wrong vs right: collecting a sample zoo vs writing delivery-and-intent sentences
Worked failure — same curiosity, opposite blast radius. Right never treats a live binary, a builder, or a neighbor disk as a family lab.
Wrong
Download “virus packs,” ransomware builders, RATs, or packed samples “to classify.” Run them in a home VM and call it CEH. Hash a classmate’s infected USB into Discord. Skip notes because filenames felt like studying. This path is not official CEH training and does not give you that zoo.
Right
Write virus, worm, trojan, ransomware as delivery-plus-intent in $HOME/cyberlium-lab/malware-families-notes.txt and chmod 600. No specimens. No packing. No RATs. No builders. Next: How Malware Gets a Foothold — email, sideload, macros as human/install paths.
6. Hands-on: definitions only, then lock malware-families-notes.txt
On a computer you own, create cyberlium-lab if needed. Run the helper only to print the four sentences and write the notes template. Fill the blanks in your own words. Do not add a samples directory because definitions felt easy. chmod 600. The script refuses any URL or file path argument so it cannot become a downloader.
Command guide
Trojan vs ransomware — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' trojan: pretends useful, delivers something else ransomware: extortion against MY data — backups are the control refuse: live samples, crack forums, decryptor roulette EOF
Mission: malware-families-notes.txt in cyberlium-lab (mode 600)
1) In your own words, define virus, worm, trojan, and ransomware as delivery and/or intent — not as filenames. 2) Fill $HOME/cyberlium-lab/malware-families-notes.txt (overlap + ethics line) and chmod 600. 3) Do not download samples, builders, RATs, or packed binaries. Do not use a neighbor’s device as a zoo.
Stuck? Ask Cyberlium AI Mentor
If “I need a live file to learn families” still feels true, ask for a hint — not a sample. Try: "Hint only: why are virus/worm/trojan/ransomware delivery-and-intent sentences, why live samples and ransomware builders are out of this course, and where do locked notes live?" You still fill malware-families-notes.txt. No zoo. No packing.
You now treat a malware family as a delivery-plus-intent sentence, not as a file you keep. Notes are locked in cyberlium-lab. This is original Cyberlium material covering the same domain as CEH v13 Module 7, not official training and not an exam dump. Next — How Malware Gets a Foothold — names email, sideload, and office macros as the rides humans offer, carrying Topic 5 phishing and Topic 6 Android unknown-source installs, still with no packing lab.
Knowledge Check
APPLY: A classmate wants a “virus pack” so they can label hashes as CEH family homework. What is a family here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Definitions are too easy, so you should run a ransomware builder in a home VM to make the family “real.”
True or False
Knowledge Check
APPLY: You are filling malware-families-notes.txt. Which pairing matches this lesson?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice