Malware › Module 2 › Lesson 3
Spyware APT Named
Name spyware and APT concepts for detection literacy — persistence, exfil, long dwell — samples only on $MAL_LAB from legal sources.
Visual · mal_spyware_apt_named
Spyware/APT named literacy. $MAL_LAB only. Original Cyberlium.
Opening
Spyware steals secrets; APT groups operate long campaigns — analysts name behaviors for hunting, not replication.
Spyware covertly collects keystrokes, screenshots, credentials, or audio. Advanced Persistent Threat (APT) actors combine stealth, custom tooling, and long dwell time against high-value targets — mapped in ATT&CK groups and vendor reports. Defenders hunt persistence, unusual egress, and credential access chains. Cyberlium teaches naming and report literacy for $MAL_LAB notes. You will NOT build spyware, keyloggers for strangers, or replicate APT campaigns against unauthorized targets. Next: Families Lab.
1. Spyware: covert collection
Spyware indicators: hooking APIs, unexpected microphone/camera access, browser credential dumps, exfil to rare domains. Consumer 'stalkerware' and enterprise infostealers share collection goals — defenders block exfil and remove persistence.
Analysis on $MAL_LAB labels collection modules in static strings or dynamic procmon — never deploy against real users.
Command guide
Try these commands — Spyware: covert collection
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, jq. Reference sites: CISA ransomware guide (https://www.cisa.gov/stopransomware/ransomware-guide); MalwareBazaar tags (https://bazaar.abuse.ch/browse/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. APT: named groups and TTP chains
APT reports name groups (e.g., ATT&CK Gxxxx) with TTP sequences — spearphish, custom malware, lateral movement, data staging. Literacy means reading reports for detection gaps, not copying campaigns against classmates or employers without engagement.
Map report TTPs to YOUR $MAL_LAB detection wishlist — technique ID, log source, gap Y/N.
3. Named for hunt — not for harm
Forbidden: keylogger deployment, stalkerware, APT playbooks against production, or 'long dwell' on unauthorized networks. Allowed: family/spyware/APT vocabulary in analysis reports with IOC hygiene.
Ship: spyware vs APT one-liner + three ATT&CK technique IDs you'd hunt on $MAL_LAB SIEM fixture. Next: Families Lab.
4. What you ship: spyware/APT literacy note for $MAL_LAB
Spyware vs APT definitions. Three hunt technique IDs. NEVER keyloggers/stalkerware. chmod 600.
5. What you record before the next lesson
Date. Spyware/APT note. Three technique IDs. File t22-m02-l03-spyware-apt-named.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy keylogger on classmate 'for APT lab.' Copy full APT chain to production.
Right
Write spyware/APT literacy note with hunt IDs. Next: Families Lab.
Mission: name spyware and APT for hunting
1) Define spyware and APT in one sentence each. 2) List three ATT&CK IDs to hunt. 3) Write NEVER keylogger/stalkerware line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Reports give TTP names — your job is detection mapping.
Knowledge Check
APPLY: Spyware/APT Named on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: APT reports should be copied as attack plans against unauthorized networks.
True or False
Knowledge Check
APPLY: Unexpected credential dumping + rare domain egress suggests:
Multiple choice