Trojan Worm Virus

Name malware families for IR and detection literacy — trojan, worm, virus — not operational deployment on $MAL_LAB or elsewhere.

Trojan Worm Virus• Audio Walkthrough

00:00/03:32

Visual · mal_trojan_worm_virus

Family names literacy. $MAL_LAB only. Original Cyberlium.

Family names help SOC triage alerts — they are vocabulary, not deployment instructions.

Trojans masquerade as legitimate software while performing hidden actions. Worms self-replicate across networks without user action. Viruses attach to hosts/files and spread when those hosts execute or share infected content. Defenders map alerts and ATT&CK behaviors to these categories for prioritization. Cyberlium teaches family literacy for $MAL_LAB sample labeling and report writing. You will NOT build trojans, write worms, or create viruses for 'practice.' Next: Ransomware Named.

1. Trojan: disguised delivery

Trojans rely on social engineering or bundled installers — user runs what looks benign. IR looks for unexpected outbound connections, persistence, and credential access following the initial run. Examples in reports are named for classification, not replication recipes.

On $MAL_LAB, you may label a training sample 'trojan-like' if it hides payload delivery — still only legally sourced specimens in sandbox.

Command guide

Try these commands — Trojan: disguised delivery

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, python3. Reference sites: MITRE malware families (https://attack.mitre.org/software/); CISA Stop Ransomware (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Worm vs virus: propagation model

Worms spread automatically across network shares, exploits, or credentials — no user click required for each hop. Viruses need a host file or boot process and spread when infected artifacts move.

Detection differs: worms trigger lateral movement and scan telemetry; viruses trigger file infection signatures and removable-media policies.

3. Literacy supports triage — not authorship

Forbidden: writing self-spreading code, trojanizing apps for classmates, or 'testing worm logic' on any network outside isolated $MAL_LAB with authorized samples.

Ship: table — trojan/worm/virus, one-line definition, one defender detection cue each. Next: Ransomware Named.

4. What you ship: trojan/worm/virus literacy table

Three rows: definition + detection cue each. $MAL_LAB labeling context. NEVER authorship. chmod 600.

5. What you record before the next lesson

Date. Family table. $MAL_LAB named. File t22-m02-l01-trojan-worm-virus.txt chmod 600.

6. Wrong vs right: live malware on daily driver vs sandbox

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Write a worm 'for lab.' Mislabel every alert 'virus' without reading behavior.
Right: Write trojan/worm/virus literacy table. Next: Ransomware Named.

Hands-on Exercise