What is a trojan?¶

A trojan is software that appears legitimate, useful or harmless while concealing malicious behaviour.

Avoid the dangerous assumption¶

The dangerous assumption is that a trojan must visibly imitate a well-known application.

It may simply be presented as something the user is likely to trust.

A trojan may appear as:

• a document
• an installer
• a software update
• a media file
• a security tool
• a mobile application
• a cracked program
• a browser extension.

Once executed, it may install malware, steal information, open remote access or download further components.

Investigators should examine both the presentation and the behaviour.

What did the user believe the file or application was?

How was it delivered?

What prompted execution?

What code actually ran?

What changes followed?

A file can be malicious even if it performs the promised function as well. A fake installer may install the expected software while also creating a backdoor.

Do not assume user execution proves informed consent. The file may have been disguised or delivered through a compromised trusted source.

Likewise, do not assume that every altered or unofficial application is malicious without examining its behaviour.

Preserve the original file, source message or website, installation records, process activity, created files, persistence and network connections.

A trojan label describes the deceptive delivery or presentation. It does not by itself explain the full payload or identify the offender.

User accounts can help explain delivery but not necessarily responsibility. A file may have been opened under one person’s account while the device was shared, remotely controlled or used through an unattended session.

Operational takeaway¶

Establish what the software appeared to be, how it reached the user and what behaviour followed execution before describing it as a trojan.