Malware › Module 2 › Lesson 1
Trojan Worm Virus
Name malware families for IR and detection literacy — trojan, worm, virus — not operational deployment on $MAL_LAB or elsewhere.
Visual · mal_trojan_worm_virus
Family names literacy. $MAL_LAB only. Original Cyberlium.
Opening
Family names help SOC triage alerts — they are vocabulary, not deployment instructions.
Trojans masquerade as legitimate software while performing hidden actions. Worms self-replicate across networks without user action. Viruses attach to hosts/files and spread when those hosts execute or share infected content. Defenders map alerts and ATT&CK behaviors to these categories for prioritization. Cyberlium teaches family literacy for $MAL_LAB sample labeling and report writing. You will NOT build trojans, write worms, or create viruses for 'practice.' Next: Ransomware Named.
1. Trojan: disguised delivery
Trojans rely on social engineering or bundled installers — user runs what looks benign. IR looks for unexpected outbound connections, persistence, and credential access following the initial run. Examples in reports are named for classification, not replication recipes.
On $MAL_LAB, you may label a training sample 'trojan-like' if it hides payload delivery — still only legally sourced specimens in sandbox.
Command guide
Try these commands — Trojan: disguised delivery
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE malware families — https://attack.mitre.org/software/ (named family literacy) CISA Stop Ransomware — https://www.cisa.gov/stopransomware (defender guidance)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "families=['Emotet','Ryuk','LockBit','QakBot']; print('Family literacy:', ', '.join(families))"
curl -sS https://www.cisa.gov/stopransomware | head -8Primary tools to practice this lesson: curl, python3. Reference sites: MITRE malware families (https://attack.mitre.org/software/); CISA Stop Ransomware (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Worm vs virus: propagation model
Worms spread automatically across network shares, exploits, or credentials — no user click required for each hop. Viruses need a host file or boot process and spread when infected artifacts move.
Detection differs: worms trigger lateral movement and scan telemetry; viruses trigger file infection signatures and removable-media policies.
3. Literacy supports triage — not authorship
Forbidden: writing self-spreading code, trojanizing apps for classmates, or 'testing worm logic' on any network outside isolated $MAL_LAB with authorized samples.
Ship: table — trojan/worm/virus, one-line definition, one defender detection cue each. Next: Ransomware Named.
4. What you ship: trojan/worm/virus literacy table
Three rows: definition + detection cue each. $MAL_LAB labeling context. NEVER authorship. chmod 600.
5. What you record before the next lesson
Date. Family table. $MAL_LAB named. File t22-m02-l01-trojan-worm-virus.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Write a worm 'for lab.' Mislabel every alert 'virus' without reading behavior.
Right
Write trojan/worm/virus literacy table. Next: Ransomware Named.
Mission: name three family types
1) Define trojan, worm, virus in one line each. 2) Add one blue detection cue per type. 3) Write NEVER authorship line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Family labels speed SOC triage — misuse speeds harm.
Knowledge Check
APPLY: Trojan/worm/virus literacy on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Worms typically self-replicate without per-hop user action.
True or False
Knowledge Check
APPLY: A training sample that hides a payload in a fake installer is best labeled:
Multiple choice