Trojans

Trojans (Trojan programs, Trojan Horses) are malicious programs that disguise themselves as legitimate software or otherwise deceive users into running them or granting them access to a system. Once executed, a Trojan can perform hidden actions such as stealing data, installing other malware, providing remote access to a device, or modifying system settings.

The name comes from the Trojan Horse in ancient Greek legend: a dangerous component enters a system disguised as something safe or useful.

Unlike computer viruses and worms, Trojans are not defined by the ability to create copies of themselves and spread automatically. Their key characteristic is deceiving the user or disguising their malicious functionality.

How a Trojan Works

The specific behavior depends on the type of Trojan. A typical scenario looks like this:

• The user receives a file or program that appears to be safe.
• The user runs it, or the malicious code is activated as part of another attack.
• The Trojan executes with the permissions available to it.
• The malicious component may attempt to establish persistence in the system.
• It then performs the actions intended by the attacker.

For example, a document disguised as an invoice can run a macro on opening that quietly downloads a further malicious component.

For example, a program may appear to be a useful utility, document, installer, or update but install an additional malicious component after being launched.

Some Trojans perform their primary functions themselves, while others are used to deliver additional modules.

Main Types of Trojans

Trojan programs can be classified according to the functions they perform.

• Backdoor Trojan creates a hidden remote access channel to an infected device. An attacker can use it to perform further actions within the system.
• Downloader Trojan is designed to download additional malicious components.
• Dropper Trojan contains or delivers other malicious files and installs them on the system.
• Banking Trojan targets financial information, credentials, and other data related to banking services.
• Infostealer Trojan collects confidential data such as stored credentials and information from applications.
• RAT (Remote Access Trojan) provides remote control capabilities over an infected device. The abbreviation RAT can also stand for the legitimate term Remote Administration Tool, so its meaning depends on the context.

For example, a dropper may first install a banking Trojan and then set up a backdoor that keeps the attacker’s access in place.

A single malicious program can perform the functions of several types at once, so these categories are not always mutually exclusive.

Trojan vs. Virus: What Is the Difference?

A Trojan and a computer virus are different types of malware.

The main difference lies in how they spread.

Trojan disguises itself as a safe object or uses another form of deception to enter a system and be executed.

Virus can insert its code into other files or objects and reproduce by infecting them.

For this reason, the expression “Trojan virus” is commonly used in everyday language, but technically, Trojan and virus refer to different categories of malware.

Trojan vs. Worm

A worm differs in its ability to spread automatically between devices or systems, for example by using network mechanisms or exploiting vulnerabilities.

A Trojan is generally not characterized by self-propagation. Its delivery may require user action, another malicious component, or access that an attacker has already obtained.

However, a single attack can use several mechanisms. For example, self-propagating malware may install a Trojan component on infected devices.

Trojan vs. Spyware

Spyware is defined primarily by its purpose — covertly collecting information about a user or system.

A Trojan is characterized by how it is presented or gains access to a system: the malicious program poses as something safe or conceals its actual purpose.

Therefore, a single program can be both a Trojan and spyware. For example, a malicious application may disguise itself as a useful program and then steal credentials after being launched.

Trojan vs. Backdoor

A backdoor is a mechanism that provides hidden access to a system or access outside the normal intended process.

A Trojan may install a backdoor, but the terms are not synonymous. A Trojan describes a particular type of malware, while a backdoor describes an access mechanism.

For example, a Remote Access Trojan may enable remote connections that effectively function as a backdoor.

What to Do If a Trojan Is Detected

If security software detects a Trojan, it is important to understand that deleting a single file may not eliminate all the consequences of the infection.

It is necessary to determine what actions the malware may have already performed and whether additional components have appeared in the system. In a corporate environment, an incident may require isolating the device, analyzing logs and network activity, and checking user accounts and other systems with which the infected computer interacted.

If there is a possibility that credentials have been compromised, they should be treated as potentially exposed and appropriate security measures should be taken.

FAQ

🠔 Back to glossary