Systems and methods for classifying package files as trojans

A system for classifying package files as Trojans, the system comprising:

• a detection module, stored in memory, that detects a resemblance between an unclassified package file and a known legitimate package file;
• a signatory determination module, stored in memory, that determines that the unclassified package file is signed by a different signatory than a signatory that signed the known legitimate package file;
• a feature determination module, stored in memory, that determines that a feature of the unclassified package file is suspicious, the feature being absent from the known legitimate package file;
• a classification module, stored in memory, that classifies the unclassified package file as a Trojan version of the known legitimate package file based on the unclassified package file being signed by the different signatory and having the suspicious feature;
• at least one physical processor configured to execute the detection module, the signatory determination module, the feature determination module, and the classification module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• detect a resemblance between an unclassified package file and a known legitimate package file;
• determine that the unclassified package file is signed by a different signatory than a signatory that signed the known legitimate package file;
• determine that a feature of the unclassified package file is suspicious, the feature being absent from the known legitimate package file;
• classify the unclassified package file as a Trojan version of the known legitimate package file based on the unclassified package file being signed by the different signatory and having the suspicious feature.