After several employees installed a free PDF utility that looked legitimate and worked as advertised, the help desk finds that every installed copy opened a remote shell to an outside host. The program never spread to other machines on its own. Which type of malware best describes this behavior?
Select an answer to reveal the explanation.
Short Explanation
Think of the wooden horse at Troy: it looks like a gift, so you carry it inside yourself. That's a trojan — it rides in on something useful and needs you to run it. Don't let the remote shell push you toward worm; worms spread on their own, and this one never left the machines users installed it on.
Full Explanation
A trojan is malware that disguises a malicious payload inside software that appears legitimate, relying on the user to install and run it. Here the utility genuinely worked, which is typical: the useful function lowers suspicion while a hidden component, often a remote access trojan, opens a reverse shell to attacker infrastructure. The defining traits are deception and user execution, not the payload type. A worm is ruled out because worms self-propagate across networks by exploiting services or credentials, and the scenario states the program never spread on its own. A file-infecting virus is defined by inserting its code into other host files so that running them executes the virus; nothing indicates other executables were modified. A logic bomb is dormant code that fires when a date or condition is met, and the shell opened on installation rather than waiting for a trigger. Exam caveat: categories can overlap, so a trojan may drop a worm or ransomware later; classify by the behavior actually described. Operational check: identify the installer hash, search endpoint telemetry for every host that executed it, and confirm the outbound connection destination so it can be blocked and each host remediated.