System Hacking Phases and Attack Techniques · Topic 5 of 6
Malware, APT and Trojan Concepts
Learn malware components and spread, the six stages of an advanced persistent threat, and how trojans infect hosts, are detected and are stopped.
- 5 min
- A dropper carries malware, a downloader fetches it, and a crypter hides it.
- The APT lifecycle has six phases from preparation to cleanup.
- A trojan needs the user to run it, a worm spreads by itself.
What it is
Malware is software designed to damage a system, steal data or give unauthorized control. It is the tool behind many of the system hacking steps.
An advanced persistent threat (APT) is a long-term targeted intrusion by a skilled actor. A trojan is malware that pretends to be legitimate software to be installed by the user.
How it works
Malware components and spread
Malware is often built from parts.
| Component | Role |
|---|---|
| Dropper | Carries malware inside it and installs it |
| Downloader | Fetches further malware from the internet |
| Payload | The harmful action |
| Crypter | Encrypts the code to avoid detection |
| Packer | Compresses the code, changing its signature |
| Obfuscator | Hides the code's purpose |
| Exploit | Code that uses a vulnerability to deliver the malware |
| Injector | Loads code into another running process |
Ways malware reaches victims include phishing email attachments and links, drive-by downloads from compromised sites, malicious advertising, fake software updates, removable media, vulnerable services, pirated software and search engine poisoning.
Malware types
| Type | Key idea |
|---|---|
| Virus | Attaches to a file and spreads when it is run |
| Worm | Spreads by itself over networks |
| Trojan | Looks useful but does harm |
| Ransomware | Encrypts data and demands payment |
| Spyware and keylogger | Secretly records activity |
| Adware | Shows unwanted advertising |
| Rootkit | Hides malware and access |
| Botnet bot | A machine controlled remotely with many others |
| Backdoor | Hidden access path |
| Cryptojacker | Uses the victim's processor to mine cryptocurrency |
| Logic bomb | Runs when a condition occurs, such as a date |
| Fileless malware | Runs in memory and uses system tools |
APT concepts
An APT is advanced (skilled, with custom tools), persistent (long-term, in no hurry) and a threat (organized, funded and with a clear target). Targets are often governments, defense, finance and technology firms.
The lifecycle as EC-Council presents it has six phases.
| Phase | What happens |
|---|---|
| Preparation | The attacker researches the target and prepares tools |
| Initial intrusion | Entry, often by spear phishing or exploiting an exposed service |
| Expansion | Moves within the network and gains more access |
| Persistence | Sets up lasting, redundant access |
| Search and exfiltration | Finds valuable data and sends it out |
| Cleanup | Removes traces, but leaves access for later |
Characteristics include custom malware, low and slow activity, use of valid accounts and living-off-the-land tools. Defenders detect APTs through behavior: unusual outbound traffic, off-hours logins and lateral movement. The best defense is layered: segmentation, strong authentication, monitoring, threat intelligence and incident response.
Trojan concepts
A trojan hides its true purpose inside something that looks useful, such as a free utility, a game or a document. The user installs it, so no exploit is needed.
| Trojan type | Purpose |
|---|---|
| Remote access trojan (RAT) | Gives full remote control |
| Backdoor trojan | Opens a hidden path in |
| Banking trojan | Steals financial credentials |
| Ransomware trojan | Encrypts files for payment |
| Botnet trojan | Adds the host to a botnet |
| Proxy trojan | Turns the host into a relay |
| Defacement trojan | Changes visible content |
| Covert channel trojan | Sends data through unexpected channels, such as ICMP or DNS |
| Mobile trojan | Targets phones |
A wrapper binds a trojan to a harmless program so that both install together. A crypter then encrypts the result to evade antivirus. Some classic trojans used well-known ports, such as Back Orifice (31337) and NetBus (12345), although modern ones use common ports like 80 and 443.
Signs of infection include slow performance, unexpected network traffic, new processes or startup entries, disabled security tools and unexplained pop-ups.
Detection and prevention:
- Scan open ports and connections, using netstat or TCPView, for unknown listeners.
- Review running processes with Process Explorer and startup entries with Autoruns.
- Verify file integrity with checksums and signatures.
- Run anti-malware software and keep it updated.
- Avoid unknown attachments, pirated software and untrusted downloads.
- Use application allow lists and least privilege.
- Block unused ports and monitor outbound traffic.
A worked example
A free PDF converter is downloaded from an unofficial site. It works, but afterward the host calls a foreign address on port 443 every five minutes and a new startup entry appears. This is a trojan with a backdoor function. The fix is isolation, removal using trusted media and downloading software only from official sources.
How the exam asks about this
- "Which malware hides inside a seemingly useful program?" -> A trojan.
- "Which component downloads further malware after the first infection?" -> A downloader.
- "Which APT phase follows initial intrusion?" -> Expansion.
What to remember for the exam
- A dropper carries malware, a downloader fetches it, and a crypter hides it.
- The APT lifecycle has six phases from preparation to cleanup.
- A trojan needs the user to run it, a worm spreads by itself.
- A wrapper binds a trojan to a harmless file.
- Detect with netstat, TCPView, Process Explorer and Autoruns.
Do not confuse a dropper (contains the malware) with a downloader (fetches it from elsewhere).
Common mistakes
Calling every malware a virus. A virus is one type with a specific behavior.
Assuming an APT is always noisy. They are designed to be quiet and slow.
Expecting a trojan to spread by itself. It relies on the user, so awareness is a key defense.
Check yourself
What is a trojan?
Malware disguised as legitimate software that the user installs.
Name the six APT phases.
Preparation, initial intrusion, expansion, persistence, search and exfiltration, and cleanup.
What is the role of a crypter?
It encrypts malware code so that signature-based antivirus is less likely to detect it.
Topic 5 of 6 in System Hacking Phases and Attack Techniques
Test yourself on System Hacking Phases and Attack Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.