> For the complete documentation index, see [llms.txt](https://oklencodes.gitbook.io/untitled/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oklencodes.gitbook.io/untitled/malware/simple-trojan-with-python.md).

# Simple Trojan with Python

Understanding and Creating a simple Trojan with Python

<figure><img src="https://2022164620-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtzurpgroDJSMn9AFVmQP%2Fuploads%2FJvmeTdduDJ3b7YfLE0U7%2Fimage.png?alt=media&amp;token=9a67f3a9-75d7-44b5-9714-e5003f9b00e2" alt=""><figcaption></figcaption></figure>

When a trojan is executed on a victims machine, it will first pretend it is a legitamte process to evade EDR and anti virus tools that will typically first scan it for known malware signatures. Then it will look at the behaviour of the file to see what processes it tries to interact with, this could be a range of things from Keylogging to file extraction or even establishing a remote connection. As I mentioned Trojans can bypass this by using techniques like [Process Hollowing](https://www.techtarget.com/whatis/definition/process-hollowing#:~:text=Process%20hollowing%20is%20a%20security,process%20to%20execute%20malicious%20code.).