Session Trojan

Trojans:
-------
Trojan or Trojan horse is the name given to a computer virus. It is a type of computer software that is camouflaged in the form of regular software such as utilities, games and sometimes even antivirus programs. Once it runs on the computer, it causes problems like killing background system processes, deleting hard drive data and corrupting file allocation systems.

Trojans can be differentiated on the basis of connections:

1.Forward connection based trojans
2.Reverse connection based trojans



1. Forward Connection
---------------------
	When the attacker have the target's IP Address, then he can directly attack the system.
	1. Target keeps on moving --> IP Address of the target will keep on changing
	2. It will be very very hard for an attacker to get the target's IP Address everytime, when he will change the location.



2. Reverse Connection
---------------------
	This is the current type of trojan that is implemented nowadays in which an attacker uses his/her IP address to launch an attack. Its not required to know the IP address of the victim. The trojan developed by hacker is send to the victim and further when executed by victim attacker gets the access.

	Tools we use to make a trojan is a third party tool known as Remote Administrative Tool (RAT).
	eg: Dark Comet
	    NjRAT
	    Nanocore etc...

Note: The RAT's created from the above tools or from somewhere else could be implemented on internet and intranet but the procedure varies...
INTRANET : when attacker and the victim are on the same network
INTERNET : when attacker and the victims are in a different network (using DDNS and port forwarding)


Tool:Dark comet


steps:
1.create a server with your ip details  then send to victim
2.listen to the port which you set while creating server
3.wait for incoming connection.once they connected,then control their system
Anti-Malware :
================
The softwares which are made to detect the malwares and preventing them from destroying the system.
Like : anti-virus or Web security

 How the Anti-malware programs work:
 ------------------------------------
They basically work on the basis of signatures and definitions .Every application created has its own signature so these anti malwares have a database of signatures(of trojans).So when they find a signature of application in the database they consider it to be a virus or trojan and simply remove it or ask for actions to implemented ...

https://www.youtube.com/watch?v=bTU1jbVXlmM