--- title: "What Is Malware? A Clear Guide to Malware Types, Capabilities, and Defenses" description: "A practical guide to malware categories, overlapping capabilities, representative examples, layered defenses, and incident-response actions." author: "Andrey Pautov" status: "Helping material" tags: - helping-materials - trainsec - trainsec-malware-analyst-level-1 - malware-analysis canonical: "https://1200km.com/cyber-knowledge/helping-materials/what-is-malware.md" medium: "https://medium.com/@1200km/what-is-malware-93746950ce9a" course: "TrainSec Malware Analyst Professional — Level 1" date: "2026-08-06" --- # What Is Malware? A Clear Guide to Malware Types, Capabilities, and Defenses > **Helping material:** This guide supports the [TrainSec Malware Analyst Professional — Level 1 learning record](/courses/trainsec-malware-analyst-professional-level-1/). It is an independent educational resource, not official TrainSec course material. ![What Is Malware guide cover showing malicious code approaching a protected network.](../short-guides/what-is-malware/cover.png) *Cover — What Is Malware? A Clear Guide to Malware Types, Capabilities, and Defenses.* Also published on [Medium](https://medium.com/@1200km/what-is-malware-93746950ce9a). ## Table of contents - [Introduction](#introduction) - [Malware types and capabilities](#malware-types-and-capabilities) - [1. Viruses](#1-viruses) - [2. Worms](#2-worms) - [3. Trojans](#3-trojans) - [4. Droppers, downloaders, and loaders](#4-droppers-downloaders-and-loaders) - [5. Ransomware and data extortion](#5-ransomware-and-data-extortion) - [6. Wipers and pseudo-ransomware](#6-wipers-and-pseudo-ransomware) - [7. Backdoors and remote-access Trojans](#7-backdoors-and-remote-access-trojans) - [8. Rootkits and bootkits](#8-rootkits-and-bootkits) - [9. Fileless malware and living-off-the-land techniques](#9-fileless-malware-and-living-off-the-land-techniques) - [10. Spyware and information stealers](#10-spyware-and-information-stealers) - [11. Keyloggers](#11-keyloggers) - [12. Adware and potentially unwanted applications](#12-adware-and-potentially-unwanted-applications) - [13. Bots, botnets, and cryptominers](#13-bots-botnets-and-cryptominers) - [How malware labels fit together](#how-malware-labels-fit-together) - [How to reduce malware risk](#how-to-reduce-malware-risk) - [What to do if malware is suspected](#what-to-do-if-malware-is-suspected) - [Summary table](#summary-table) - [Conclusion](#conclusion) - [References](#references) ## Introduction **Malware**, short for *malicious software*, is software or code intentionally used to compromise the confidentiality, integrity, or availability of a device, application, network, or data. Attackers may use malware to steal information, obtain remote access, disrupt operations, extort victims, conduct surveillance, consume computing resources, or destroy data.[^1] Malware can be delivered or propagated through phishing messages, malicious websites, compromised downloads, trojanized applications, software supply-chain compromises, removable media, stolen credentials, exposed remote services, and vulnerabilities in unpatched systems. It may also be installed after an attacker has already gained access by another method. Understanding malware terminology is useful, but the categories must be applied carefully. > **Malware categories are not mutually exclusive.** > > A single malicious program may belong to several categories at the same time. For example, it may be delivered as a Trojan, install a backdoor, record keystrokes, use rootkit techniques, and execute parts of its payload in memory. Malware labels describe different dimensions: * **Propagation:** How the malware spreads, such as a virus or worm. * **Delivery or presentation:** How it reaches or deceives the victim, such as a Trojan. * **Objective:** What it is intended to achieve, such as ransomware, spyware, or a wiper. * **Capability:** What functionality it provides, such as keylogging or remote access. * **Stealth and execution:** How it hides or runs, such as rootkit or fileless techniques. * **Command model:** How infected systems are controlled, such as a botnet. This distinction explains why one sample can correctly receive several labels. ## Malware types and capabilities ## 1. Viruses ![Infographic explaining computer viruses, their host-based replication process, examples, and defensive controls.](assets/what-is-malware/01-viruses.png) *Figure 1 — Viruses replicate through a host object such as a file, document, program, or boot area.* ### Definition A **computer virus** is malicious code that replicates by inserting or attaching a copy of itself to another file, document, program, or boot area. The infected host must normally be executed, opened, or otherwise activated before the virus can run and continue propagating.[^1] A virus is therefore not simply any malicious program. Its defining characteristic is replication through a host object. ### How Viruses Work A typical virus follows this sequence: 1. A user or process executes an infected host file. 2. The malicious code runs alongside or instead of the legitimate content. 3. The virus searches for additional suitable files or system areas. 4. It inserts copies of itself into those targets. 5. The infected files spread through sharing, removable media, downloads, or other transfer mechanisms. Some viruses immediately damage files or systems. Others remain dormant, steal information, disable security tools, or install additional payloads. ### Representative Examples * **Sality:** A file-infecting virus that also included botnet and malware-downloading capabilities. * **Virut:** A polymorphic file-infecting virus that compromised executable and web-related files. * **Macro viruses:** Malware written in document macro languages and embedded in files such as word-processing documents or spreadsheets. --- ## 2. Worms ![Infographic explaining self-contained worm propagation, representative examples, and defensive controls.](assets/what-is-malware/02-worms.png) *Figure 2 — Worms are self-contained malware that can propagate without attaching to another file.* ### Definition A **worm** is a self-contained malicious program that replicates and propagates without attaching itself to another program. Worms commonly spread through vulnerable network services, messaging systems, email, shared storage, or removable media.[^1] Unlike a virus, a worm does not require a separate host file. Some worms can propagate automatically after compromising one system, although particular infection paths may still depend on user interaction. ### Why Worms Are Dangerous Worms can spread rapidly because each newly infected system may begin scanning for and attacking additional targets. This can produce: * widespread compromise; * network congestion; * service disruption; * rapid deployment of secondary payloads; * large botnets; * ransomware outbreaks. ### Representative Examples * **ILOVEYOU (2000):** An email-borne worm that used social engineering and mailed copies of itself to contacts found on infected systems. * **Conficker (2008):** A worm that exploited a Windows vulnerability and used additional propagation methods to build a large botnet. * **WannaCry (2017):** Ransomware with worm capabilities that used the SMB vulnerability associated with EternalBlue to spread between vulnerable Windows systems.[^2] WannaCry is an important example of overlapping classification: it was both **ransomware**, because it encrypted data and demanded payment, and a **worm**, because it could propagate between vulnerable systems. --- ## 3. Trojans ![Infographic explaining Trojan delivery, common capabilities, representative examples, and defensive controls.](assets/what-is-malware/03-trojans.png) *Figure 3 — Trojans are defined by deceptive or concealed malicious functionality.* ### Definition A **Trojan**, or **Trojan horse**, is non-self-replicating malware that appears legitimate, is embedded in apparently legitimate content, or performs malicious actions hidden from the user. A Trojan does not have to be installed voluntarily. It may arrive through a malicious attachment, a fake installer, a cracked application, a compromised website, another malware component, or a software supply-chain compromise. The defining characteristic is deceptive or concealed functionality—not a specific delivery channel. ### Common Trojan Capabilities A Trojan may: * steal credentials or financial information; * download additional malware; * install a backdoor; * join the system to a botnet; * record keystrokes; * capture screenshots; * manipulate browser sessions; * provide remote command execution. ### Representative Examples * **Zeus / Zbot:** A banking Trojan known for stealing online-banking credentials through techniques such as keylogging and form grabbing. * **Emotet:** First identified as a banking Trojan in 2014, it evolved into a modular loader and cybercrime service used to provide access and deliver additional malware. An international law-enforcement operation disrupted its infrastructure in January 2021.[^3] * **Fake codec and fake update Trojans:** Malware presented as a media component, browser update, security tool, or other apparently useful software. A Trojan describes how malicious functionality is concealed or presented. It does not describe the complete set of actions the malware performs after execution. --- ## 4. Droppers, Downloaders, and Loaders ![Infographic comparing droppers, downloaders, and loaders across a typical staged-malware attack flow.](assets/what-is-malware/04-droppers-downloaders-loaders.png) *Figure 4 — Droppers, downloaders, and loaders establish or execute the next attack stage.* These terms describe components used to install or execute another payload. ### Dropper A **dropper** carries another malicious component inside itself and writes or installs that component on the target system. ### Downloader A **downloader** retrieves additional malware from a remote location after it runs. ### Loader A **loader** prepares and executes another payload. It may load code from disk, decrypt embedded code, inject code into another process, or execute a payload directly in memory. These components are frequently delivered as Trojans. Their primary purpose is to establish the next stage of an attack rather than to perform the final objective themselves. Emotet, for example, evolved beyond its original banking-Trojan role and became widely used as a loader that enabled delivery of other criminal malware.[^3] --- ## 5. Ransomware and Data Extortion ![Infographic explaining ransomware pressure mechanisms, examples, and layered defensive controls.](assets/what-is-malware/05-ransomware-data-extortion.png) *Figure 5 — Modern ransomware defense must address both operational recovery and stolen-data extortion.* ### Definition **Ransomware** is malware that restricts access to systems or data and demands payment. The most common form encrypts files or systems and offers a decryption mechanism in exchange for a ransom. Modern ransomware operations often combine several pressure mechanisms: * **Encryption:** The victim loses access to files or systems. * **Data theft:** Information is stolen before encryption. * **Publication threats:** The operator threatens to leak stolen data. * **Operational pressure:** Customers, partners, regulators, or employees may be contacted. * **Destructive actions:** Backups, virtual infrastructure, or recovery systems may be targeted. The combination of encryption and data-theft threats is commonly called **double extortion**. Some extortion operations steal data and demand payment without deploying ransomware at all.[^4] ### Representative Examples * **CryptoLocker (2013):** An influential early example of modern file-encrypting ransomware distributed through criminal infrastructure. * **WannaCry (2017):** Ransomware with worm-like propagation that affected organizations in many countries.[^2] * **Ryuk:** Ransomware associated with targeted attacks against organizations and frequently deployed after an earlier compromise. ### Important Limitation of Backups Offline, immutable, and versioned backups are critical recovery controls, but they do not prevent initial compromise or protect information that has already been stolen. A complete ransomware strategy must address prevention, detection, containment, recovery, and data-extortion risk.[^4] --- ## 6. Wipers and Pseudo-Ransomware ![Infographic explaining destructive wipers, pseudo-ransomware, examples, and recovery-focused defenses.](assets/what-is-malware/06-wipers-pseudo-ransomware.png) *Figure 6 — Wipers are defined by destructive impact rather than recoverable encryption.* ### Definition A **wiper** is malware designed to destroy data, corrupt systems, or make devices unusable. Recovery may be impossible without rebuilding systems and restoring data from known-good backups. Some wipers imitate ransomware by displaying a ransom message, even though the malware does not provide a functional recovery mechanism. This is often called **pseudo-ransomware** or **ransomware-like destructive malware**. ### Representative Examples * **NotPetya (2017):** Destructive malware designed to resemble ransomware. Its payment and recovery process did not provide victims with a reliable path to restore encrypted systems. It also used worm-like propagation techniques.[^11] * **Shamoon:** Destructive malware used in attacks that overwrote data and rendered affected systems inoperable. NotPetya should not be described as ordinary ransomware merely because it displayed a ransom demand. Its defining outcome was destructive wiping rather than recoverable encryption. --- ## 7. Backdoors and Remote-Access Trojans ![Infographic explaining backdoors and remote-access Trojans, their capabilities, origins, examples, and defenses.](assets/what-is-malware/07-backdoors-rats.png) *Figure 7 — Backdoors and RATs provide hidden or unauthorized remote access.* ### Backdoor Definition A **backdoor** is a hidden or unauthorized mechanism that bypasses normal authentication or security controls and enables access, command execution, or control of a system. A backdoor may be: * installed by malware; * created manually after an intrusion; * embedded in compromised software; * introduced through a supply-chain attack; * implemented through modified accounts, services, code, or configurations. ### Remote-Access Trojan A **remote-access Trojan**, often abbreviated as **RAT**, is malware that gives an attacker remote administrative capabilities. Depending on the tool, those capabilities may include command execution, file transfer, screen capture, credential theft, microphone or camera access, and deployment of additional payloads. Legitimate remote-administration tools can provide similar functions. The distinction depends on authorization, intent, deployment, and control. ### Representative Examples * **Back Orifice (1998):** An early and widely known Windows remote-administration backdoor. * **SUNBURST (2020):** A backdoor inserted into compromised SolarWinds Orion software builds and distributed through legitimate update channels. SolarWinds initially reported up to 18,000 potentially vulnerable customer downloads, but the number of organizations selected for follow-on exploitation was substantially smaller.[^5] * **PoisonIvy:** A remote-access Trojan used in multiple targeted intrusion campaigns. A backdoor is a capability or access mechanism. The malware that installs it may simultaneously be classified as a Trojan, loader, rootkit, spyware platform, or bot. --- ## 8. Rootkits and Bootkits ![Infographic explaining rootkit operating levels, stealth characteristics, examples, and defensive controls.](assets/what-is-malware/08-rootkits-bootkits.png) *Figure 8 — Rootkits subvert trusted visibility to conceal malicious artifacts or activity.* ### Rootkit Definition A **rootkit** is software or functionality used to hide malicious programs, files, processes, drivers, accounts, services, network connections, or other system components. Rootkits may alter or intercept operating-system behavior so that ordinary tools receive false or incomplete information.[^6] Rootkits can operate at several levels: * **User mode:** Hides artifacts by manipulating user-level processes or libraries. * **Kernel mode:** Alters or hooks operating-system kernel behavior. * **Boot level:** Runs during the boot process; this form is often called a **bootkit**. * **Hypervisor level:** Operates beneath the normal operating system. * **Firmware level:** Persists in device or system firmware. ### Representative Examples * **Sony BMG rootkit (2005):** Copy-protection software installed from certain music CDs that concealed itself and introduced security risks. * **ZeroAccess:** Malware that used rootkit techniques to hide botnet and monetization components. * **LoJax:** A UEFI rootkit used to maintain persistence below the operating-system level. A rootkit is primarily a **stealth mechanism**. Malware using a rootkit may also provide espionage, remote access, credential theft, or other capabilities. ### Remediation Deep rootkit or firmware compromise can undermine trust in the operating system and security tools. Depending on the affected layer, remediation may require full reimaging, boot-chain repair, firmware replacement, or hardware-specific recovery procedures. --- ## 9. Fileless Malware and Living-off-the-Land Techniques ![Infographic explaining fileless and living-off-the-land techniques, examples, and behavioral detection controls.](assets/what-is-malware/09-fileless-living-off-the-land.png) *Figure 9 — Fileless techniques reduce reliance on conventional payload files but still leave behavioral evidence.* ### What “Fileless” Means There is no single universally accepted definition of **fileless malware**. The term is commonly used for attacks in which the principal malicious payload executes in memory, is stored in a nontraditional location such as the registry, or relies heavily on legitimate system tools.[^7] “Fileless” does **not** necessarily mean that no file is ever used. A campaign may begin with a document, script, shortcut, or other file while executing its main payload directly in memory. Different stages of the same attack may be file-based or fileless. ### Common Techniques Fileless and memory-resident attacks may use: * PowerShell or other scripting engines; * Windows Management Instrumentation; * registry-stored payloads; * scheduled tasks; * process injection; * reflective loading; * macros; * trusted system utilities; * direct execution of code in memory. The abuse of legitimate tools already present on a system is often called **living off the land**. ### Representative Examples * **Poweliks:** Stored malicious code in the Windows Registry and used legitimate Windows components for execution. * **Kovter:** Used registry-based persistence and script or system-tool execution. * **Duqu 2.0:** An advanced espionage platform whose principal components were designed to operate largely in memory. ### Detection Fileless techniques can reduce the effectiveness of controls based only on static file signatures. They are not invisible. Detection may rely on behavioral monitoring, script inspection, memory scanning, process telemetry, command-line logging, endpoint detection and response, and correlation across multiple attack stages.[^7] --- ## 10. Spyware and Information Stealers ![Infographic comparing spyware and information stealers, their targets, examples, and defensive controls.](assets/what-is-malware/10-spyware-information-stealers.png) *Figure 10 — Spyware emphasizes covert surveillance, while infostealers emphasize monetizable data theft.* ### Spyware **Spyware** is malware designed to collect information about a user, device, or organization without appropriate knowledge or authorization. It may collect: * credentials; * messages and call data; * browser activity; * files and documents; * screenshots; * clipboard contents; * microphone or camera data; * device identifiers; * location information. ### Information Stealers An **information stealer**, or **infostealer**, focuses on obtaining data that can be monetized or used for further compromise. Common targets include: * browser passwords; * authentication cookies; * cryptocurrency wallets; * email credentials; * VPN credentials; * cloud tokens; * saved payment data; * system and application information. The terms spyware and infostealer overlap. “Spyware” often emphasizes surveillance, while “infostealer” often emphasizes theft of credentials, sessions, and financially useful data. ### Representative Examples * **Pegasus:** A sophisticated mobile-surveillance platform developed by NSO Group. Public research has documented multiple infection methods, including zero-click exploit chains such as FORCEDENTRY.[^8] * **FinFisher / FinSpy:** Commercial surveillance software documented in investigations involving targeted monitoring. * **Agent Tesla:** A spyware Trojan and information stealer with capabilities including keylogging, clipboard collection, credential theft, and screen capture.[^9] --- ## 11. Keyloggers ![Infographic explaining software keylogging methods, examples, characteristics, and defensive controls.](assets/what-is-malware/11-keyloggers.png) *Figure 11 — Keylogging is usually a capability within a broader malware platform.* ### Definition A **software keylogger** records keyboard input. Attackers may use it to capture passwords, messages, payment information, commands, and other sensitive text. Keylogging is often a capability inside a larger malware platform rather than a completely separate malware class. Banking Trojans, spyware, remote-access Trojans, and information stealers may all include keylogging modules.[^9] ### Keylogging Methods Software keyloggers may: * hook keyboard-related application programming interfaces; * read raw keyboard input; * install a driver; * monitor browser or application input; * modify system components; * store captured data locally before exfiltration. ### Representative Examples * **Agent Tesla:** Includes keylogging among a broader set of information-stealing capabilities. * **Zeus:** Used keylogging and form grabbing to obtain banking credentials. * **HawkEye:** An information-stealing malware family with keylogging functionality. ### Hardware Keyloggers A physical device placed between a keyboard and computer may also record keystrokes. It is a surveillance device, but it is **not malware**, because malware is software or code. --- ## 12. Adware and Potentially Unwanted Applications ![Infographic explaining adware and potentially unwanted applications, risk factors, examples, and defenses.](assets/what-is-malware/12-adware-pua.png) *Figure 12 — Consent, transparency, behavior, and removability determine whether advertising software becomes a security concern.* ### Definition **Adware** is software that displays, injects, or redirects users to advertising. Ad-supported software is not automatically malicious. Classification depends on consent, transparency, behavior, installation practices, data collection, and the ability to remove or disable the software. Security vendors may classify intrusive advertising software as a **potentially unwanted application**, or **PUA**, rather than malware. Potentially unwanted applications are not necessarily malicious, but they can degrade performance, alter browser settings, install additional unwanted components, or increase exposure to security threats.[^10] Adware is more likely to be considered malicious when it: * installs without informed consent; * hides its presence; * resists removal; * intercepts or modifies encrypted traffic; * tracks users deceptively; * redirects traffic; * installs additional software; * executes unauthorized code. ### Representative Examples * **Fireball:** Browser-hijacking adware associated with traffic manipulation and advertising revenue. * **Superfish:** Advertising software preinstalled on some Lenovo systems that installed a root certificate and weakened HTTPS security. * **Gator / GAIN:** Early advertising software known for bundling, tracking, and intrusive advertisements. --- ## 13. Bots, Botnets, and Cryptominers ![Infographic explaining bots, botnets, cryptominers, common uses, examples, and defensive controls.](assets/what-is-malware/13-bots-botnets-cryptominers.png) *Figure 13 — Botnets are an operational control model; cryptominers monetize stolen computing resources.* ### Bots and Botnets A **bot** is a compromised device or malicious agent that receives commands from an operator. A **botnet** is a collection of bots controlled as a group. Botnets may be used for: * distributed denial-of-service attacks; * spam and phishing distribution; * credential attacks; * malware delivery; * proxying malicious traffic; * click fraud; * cryptocurrency mining; * data theft. A botnet is an operational control model, not a mutually exclusive malware category. A worm, Trojan, backdoor, or Internet of Things malware family may turn a device into a bot. ### Cryptominers A **malicious cryptominer** uses a victim’s computing resources to generate cryptocurrency without authorization. Cryptomining malware may cause: * performance degradation; * increased energy consumption; * hardware stress; * unexpected cloud-computing costs; * disruption of legitimate workloads. Some cryptominers spread as worms, arrive as Trojans, exploit internet-facing services, or operate as payloads deployed through a botnet. --- ## How Malware Labels Fit Together The following examples show why malware should be classified across multiple dimensions: | Example | Propagation or delivery | Objective | Capabilities or techniques | | --------------- | ----------------------------------------------- | ------------------------------------- | ----------------------------------------------------- | | **WannaCry** | Worm-like network propagation | Ransomware | Exploitation and encryption | | **Emotet** | Trojan and email delivery | Access brokerage and payload delivery | Loader and botnet functionality | | **NotPetya** | Supply-chain delivery and worm-like propagation | Destruction | Wiping, credential abuse, and lateral movement | | **Agent Tesla** | Trojan commonly delivered through phishing | Information theft | Keylogging, credential collection, and screen capture | | **SUNBURST** | Compromised software update | Espionage and persistent access | Backdoor and command and control | | **Pegasus** | Exploit-based mobile compromise | Surveillance | Data collection and microphone or camera access | A technically accurate description therefore looks like this: > Agent Tesla is a spyware Trojan and information stealer that includes keylogging. It is less accurate to say: > Agent Tesla is only a keylogger. --- ## How to Reduce Malware Risk No single product or control can stop every malware attack. Effective defense uses multiple layers. ### 1. Maintain an Accurate Asset Inventory Organizations should know which devices, operating systems, applications, services, cloud resources, and identities they operate. Unknown assets cannot be patched, monitored, or protected reliably. ### 2. Patch Operating Systems and Applications Apply security updates promptly, prioritizing: * internet-facing systems; * remote-access services; * browsers; * email clients; * document readers; * identity infrastructure; * vulnerabilities known to be actively exploited. ### 3. Protect Identities Use: * strong, unique passwords; * a password manager; * multi-factor authentication; * least privilege; * separate administrative accounts; * privileged-access controls; * rapid revocation of exposed credentials and sessions. Multi-factor authentication reduces risk, but phishing-resistant methods provide stronger protection against credential theft and adversary-in-the-middle attacks. ### 4. Control Email, Web, and Software Delivery Use email and web filtering, attachment inspection, reputation controls, sandboxing where appropriate, and policies that restrict software installation. Obtain software from trusted sources and verify publishers, signatures, hashes, or release provenance when the risk justifies it. ### 5. Use Endpoint Protection and Behavioral Visibility Modern endpoint defenses should combine file scanning with: * behavioral detection; * script visibility; * memory inspection; * process telemetry; * exploit protection; * endpoint detection and response. Monitor high-risk behavior such as: * unusual scripting-engine activity; * suspicious process trees; * credential access; * process injection; * unexpected scheduled tasks or services; * mass file modification; * security-tool tampering; * abnormal outbound connections. ### 6. Restrict Scripts, Macros, and Administrative Tools Disable unnecessary macros and scripting capabilities. Apply application control or allowlisting where practical. Monitor legitimate administration tools because attackers may abuse them for living-off-the-land activity. ### 7. Segment Networks and Harden Remote Access Limit lateral movement through: * network segmentation; * host firewalls; * restricted administrative paths; * secure remote-access gateways; * careful control of protocols such as SMB and RDP; * separation of user, server, administrative, and backup environments. ### 8. Maintain Protected Backups Keep multiple backup generations and protect them from ordinary administrative compromise. Use offline, immutable, or logically isolated backups where appropriate, and test restoration procedures regularly.[^4] Backups support recovery from encryption or destruction. They do not prevent theft or publication of sensitive data. ### 9. Centralize Logs and Prepare Incident Response Collect and retain relevant: * endpoint telemetry; * identity and authentication logs; * network records; * email security logs; * cloud audit logs; * application events; * administrative activity. Define escalation paths, containment procedures, forensic processes, legal responsibilities, and external communication plans before an incident occurs. ### 10. Train Users Without Relying on Them as the Only Defense Users should know how to report: * suspicious messages; * unexpected authentication prompts; * unusual device behavior; * unapproved software; * possible data exposure. Training is useful, but technical controls must assume that some malicious content will eventually be opened or executed. These layered practices align with NIST malware-handling guidance and CISA ransomware-resilience recommendations.[^1][^4] --- ## What to Do If Malware Is Suspected 1. **Isolate the affected device** from wired, wireless, and remote-access networks when doing so will not create a safety or operational hazard. 2. **Notify the responsible security or IT team** immediately. 3. **Do not continue using the system** for email, banking, administration, or password changes. 4. **Preserve evidence** when the incident may require investigation. Random cleanup tools, reboots, or deletion can destroy volatile or forensic data. 5. **Identify the scope**, including affected accounts, endpoints, servers, cloud resources, and data. 6. **Contain attacker access** by revoking compromised sessions, tokens, keys, and credentials from a known-clean system. 7. **Eradicate the malware and persistence mechanisms** using validated procedures. 8. **Rebuild systems from trusted media** when system integrity cannot be established. 9. **Restore only from known-good backups** and monitor carefully for reinfection. 10. **Review the initial-access path and control failures** so the same technique cannot immediately succeed again. For organizations, malware response should be handled as an incident-response process rather than as a simple antivirus-cleanup task. --- ## Summary Table | Label | What the label describes | Defining characteristic | Representative examples | | --------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------- | ----------------------------- | | **Virus** | Propagation | Replicates through a host file, document, program, or boot area | Sality, Virut | | **Worm** | Propagation | Self-contained replication and propagation | ILOVEYOU, Conficker, WannaCry | | **Trojan** | Presentation or concealed functionality | Appears legitimate or hides malicious actions | Zeus, Emotet | | **Dropper / downloader / loader** | Attack stage | Installs, retrieves, or executes another payload | Emotet loader components | | **Ransomware** | Objective | Denies access, commonly through encryption, and demands payment | CryptoLocker, WannaCry, Ryuk | | **Wiper** | Objective | Destroys data or system operability | NotPetya, Shamoon | | **Backdoor / RAT** | Access capability | Provides hidden or unauthorized remote access | SUNBURST, PoisonIvy | | **Rootkit** | Stealth | Hides malicious artifacts or activity | ZeroAccess, LoJax | | **Fileless techniques** | Execution and evasion | Uses memory, nontraditional storage, or trusted tools while minimizing conventional payload files | Poweliks, Kovter | | **Spyware / infostealer** | Objective | Secretly collects surveillance, credential, or session data | Pegasus, Agent Tesla | | **Keylogging** | Capability | Records keyboard input | Zeus module, Agent Tesla | | **Adware / PUA** | Monetization or unwanted behavior | Displays advertising or changes system or browser behavior | Fireball, Superfish | | **Bot / botnet** | Command model | Receives commands as part of an attacker-controlled network | Mirai, ZeroAccess | | **Malicious cryptominer** | Objective | Uses computing resources to mine cryptocurrency without authorization | Various miner botnets | > **Remember:** The same malware can appear in several rows because these labels describe different aspects of its behavior. --- ## Conclusion Malware is not a collection of clean, mutually exclusive species. Modern malicious software is modular and multifunctional. A single intrusion may use: * a Trojan for delivery; * a loader for execution; * a backdoor for access; * a rootkit for stealth; * keylogging for credential theft; * ransomware or a wiper for final impact. The most useful way to analyze malware is to ask several separate questions: 1. How did it reach the system? 2. How does it propagate? 3. What objective does it serve? 4. What capabilities does it provide? 5. How does it persist or hide? 6. How is it controlled? 7. What evidence does it leave? 8. Which preventive, detective, and recovery controls apply? This multidimensional approach is more accurate than assigning one label, and it leads to better detection, incident response, and defensive design. --- ## References [^1]: National Institute of Standards and Technology, *SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops*. [^2]: Microsoft Security, *WannaCrypt Ransomware Worm Targets Out-of-Date Systems*. [^3]: Europol, *World’s Most Dangerous Malware EMOTET Disrupted Through Global Action*. [^4]: Cybersecurity and Infrastructure Security Agency, *#StopRansomware Guide*. [^5]: SolarWinds Corporation, US Securities and Exchange Commission filings concerning the SUNBURST incident. [^6]: MITRE ATT&CK, *Rootkit — Technique T1014*. [^7]: Microsoft Threat Intelligence, *Out of Sight but Not Invisible: Defeating Fileless Malware*. [^8]: Citizen Lab, *FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild*. [^9]: MITRE ATT&CK, *Input Capture: Keylogging — T1056.001* and *Agent Tesla — S0331*. [^10]: Microsoft Defender for Endpoint, *Potentially Unwanted Applications*. [^11]: Microsoft Security, *Overview of Petya, a Rapid Cyberattack*.