Types of Malware

Understanding the diverse landscape of cyber threats is fundamental to information security. While “malware” serves as an umbrella term for malicious software, security professionals categorize these threats based on their distinct propagation vectors (how they spread) and payload mechanisms (what they do).

Below is a technical analysis of the most prevalent types of malware and their operational behaviors within a compromised environment.

1. Computer Virus

A virus is defined by its dependency on a host. It acts as a parasitic code segment that inserts itself into legitimate executable files, documents, or boot sectors.

• Propagation Vector: Viruses rely on user-initiated execution. The code remains dormant until the user runs the infected host file.
• Technical Behavior: Once executed, the virus loads into memory and seeks other executables to infect via code injection, potentially corrupting data or rendering the system inoperable.

2. Worm

Unlike viruses, a worm is a standalone, self-replicating program that operates independently of a host file.

• Propagation Vector: Worms exploit vulnerabilities in network protocols (e.g., SMB, RPC) to spread automatically across networks without user interaction.
• Technical Behavior: They consume significant bandwidth and system resources. Worms are specifically engineered for rapid lateral movement, scanning for and infecting vulnerable nodes within an enterprise network.

3. Trojan (Trojan Horse)

A Trojan disguises itself as legitimate or desirable software to deceive users into installation via social engineering techniques.

• Propagation Vector: Trojans do not self-replicate. They rely on the user downloading and installing the file under false pretenses.
• Technical Behavior: Upon execution, Trojans typically establish a backdoor, granting attackers unauthorized remote access (RAT), or serve as a downloader for secondary payloads like ransomware.

4. Ransomware

Ransomware focuses on denial of availability. It is a type of malware designed to encrypt user data or lock the operating system until a ransom is paid.

• Technical Behavior: Modern ransomware employs advanced asymmetric encryption algorithms. The malware communicates with a Command and Control (C2) server to generate encryption keys, ensuring that files cannot be recovered without the private key held by the attacker.

5. Fileless Malware

Fileless malware represents a stealthy evolution in threat capability. It executes malicious activities directly in the system’s volatile memory (RAM) without writing traditional files to the disk.

• Technical Behavior: This type utilizes “Living off the Land” (LotL) tactics, leveraging legitimate system administration tools like PowerShell or WMI (Windows Management Instrumentation) to execute commands. Because there is no file signature to scan, it often evades traditional antivirus detection.

6. Rootkit

A rootkit is designed for concealment and persistence. It is a suite of tools that enables an unauthorized user to maintain access to a system while hiding its presence.

• Technical Behavior: Rootkits often function at the kernel level (Ring 0). By intercepting and modifying system calls (API hooking), they can hide processes, files, and network connections from the operating system and security tools.

7. Spyware and Keyloggers

Spyware operates in the background to harvest data.

• Technical Behavior: Keyloggers, a specific subset, hook into the keyboard API to record keystrokes, capturing sensitive information such as login credentials and encryption keys before they are transmitted over the network.