What is Malware?
Malware is malicious software designed to damage or disable computer systems and give limited or full control to its creator for the purposes of theft or fraud.
Malware can:
- Attack browsers and track websites visited
- Slow down systems and degrade performance
- Cause hardware failure and render computers inoperable
- Steal personal information including contacts, credentials, and financial data
How Malware Enters a System
Malware does not require sophisticated exploits to succeed. Many infections occur through ordinary user behavior.
Entry Vectors
├── Instant Messenger Applications
├── Portable Hardware / Removable Devices
├── Browser and Email Software Bugs
├── Untrusted Sites and Freeware Applications
├── Downloading Files from the Internet
├── Email Attachments
├── Installation by Other Malware
└── Bluetooth and Wireless Networks
Common Web Malware Distribution Methods
Attackers use a range of web-based techniques to deliver malware at scale.
| Method | Description |
|---|---|
| Black Hat SEO | Ranking malware pages highly in search results to attract unsuspecting visitors |
| Social Engineered Clickjacking | Tricking users into clicking on innocent-looking web content |
| Spear-phishing Sites | Sites that mimic legitimate institutions to steal login credentials |
| Malvertising | Embedding malware in ad networks that appear on legitimate, high-traffic sites |
| Compromised Legitimate Websites | Hosting embedded malware that spreads to visitors |
| Drive-by Downloads | Exploiting browser flaws to install malware simply by visiting a webpage |
| Spam Emails | Attaching malware to emails and tricking victims into opening the attachment |
Components of Malware
Malware is rarely a simple executable. Sophisticated malware is composed of multiple components designed to evade detection and accomplish specific objectives.
| Component | Role |
|---|---|
| Crypter | Protects malware from reverse engineering or analysis |
| Downloader | A Trojan type that fetches additional malware from the internet |
| Dropper | Covertly installs other malware files onto the system |
| Exploit | Malicious code that breaches security via software vulnerabilities |
| Injector | Injects code into running processes to hide or prevent removal |
| Obfuscator | Conceals code and intended purpose to evade security mechanisms |
| Packer | Bundles files into a single compressed executable to bypass detection |
| Payload | The piece of software that provides control over the exploited system |
| Malicious Code | Defines core functionality such as data theft or backdoor creation |
Trojans
A Trojan is a program that appears harmless but contains malicious code that activates when the user performs predefined actions. Unlike viruses, Trojans do not self-replicate — they rely on deception.
Trojans create covert communication channels between the victim machine and the attacker to transfer sensitive data.
Trojan types include:
- Remote Access Trojans (RAT)
- Backdoor Trojans
- Botnet Trojans
- Rootkit Trojans
- E-Banking Trojans
- Point-of-Sale Trojans
- Defacement Trojans
- Service Protocol Trojans
- Mobile Trojans
- IoT Trojans
- Security Software Disabler Trojans
- Destructive Trojans
- DDoS Attack Trojans
- Command Shell Trojans
Botnets
A botnet is a collection of compromised computers connected to the internet to perform distributed tasks. The attacker distributes malware that silently converts a user's machine into a bot — an automated agent that receives commands and executes them, often without the owner's knowledge.
Botnets are used to launch DDoS attacks, send spam, mine cryptocurrency, and exfiltrate data at scale.
Viruses
A virus is a self-replicating program that attaches itself to other programs, boot sectors, or documents. Unlike worms, viruses require a host file to spread.
Viruses can:
- Infect other programs
- Transfer themselves across systems
- Encrypt themselves to evade detection
- Alter or corrupt files and data
- Self-replicate without user awareness
Common virus types:
Virus Types
├── System / Boot Sector Virus
├── File and Multipartite Virus
├── Macro and Cluster Virus
├── Stealth / Tunneling Virus
├── Encryption Virus
├── Sparse Infector Virus
├── Polymorphic Virus ← changes code on each replication
├── Metamorphic Virus ← rewrites itself entirely
├── Overwriting / Cavity Virus
├── Companion / Camouflage Virus
├── Shell and File Extension Virus
├── FAT and Logic Bomb Virus
├── Web Scripting Virus
├── Email and Armored Virus
├── Add-on and Intrusive Virus
├── Direct Action / Transient Virus
└── Terminate and Stay Resident Virus
Ransomware
Ransomware is a type of malware that restricts access to a computer's files and folders, then demands an online ransom payment to remove the restrictions.
Ransomware attacks have evolved from simple file encryption to double extortion — encrypting data while also threatening to publish it publicly if the ransom is not paid.
Computer Worms
Worms are malicious programs that independently replicate, execute, and spread across network connections — without needing to infect executable files as viruses do.
Worms consume available computing resources without human interaction. Attackers frequently use worm payloads to install backdoors in large numbers of infected systems simultaneously.
Rootkits
Rootkits are programs designed to hide their own presence as well as the attacker's malicious activities, granting persistent access to the host.
Rootkits work by replacing operating system calls and utilities with modified versions that undermine security and allow malicious functions to execute invisibly.
Rootkit Operation:
OS Kernel Calls
|
v
[Rootkit intercepts]
|
v
Modified behavior returned to caller
(logs wiped, processes hidden, backdoor maintained)
A typical rootkit includes:
- Backdoor programs
- DDoS tools
- Packet sniffers
- Log-wiping utilities
- IRC bots
Potentially Unwanted Applications (PUAs)
Also known as grayware or junkware, PUAs are applications that may cause significant privacy and security risks. They are typically installed unknowingly through third-party installers or misleading license agreements.
PUA categories include:
- Adware
- Torrent clients
- Marketing trackers
- Cryptomining software
- Dialers
Adware specifically supports advertisements, generating unsolicited ads and pop-ups while tracking browsing behavior for marketing purposes. Signs of adware infection include slow internet, frequent crashes, and unexpected browser changes.
Spyware
Spyware secretly monitors user activity and sends information to remote attackers without the user's knowledge. It hides its processes and files to avoid detection.
Types of spyware include:
- Desktop spyware
- Chat spyware
- Keystroke loggers
- Program-executed spyware
Keyloggers
Keystroke loggers monitor every keystroke a user types and log or transmit the data to a remote attacker. They allow collection of email credentials, passwords, banking details, and chat activity.
Keyloggers come in two forms:
- Hardware keyloggers — physical devices inserted between keyboard and computer
- Software keyloggers — programs installed on the target system
Fileless Malware
Fileless malware (also called non-malware) leaves no footprint on the file system. Instead of writing to disk, it infects legitimate processes and resides entirely in RAM, making it extremely difficult to detect with traditional antivirus tools.
It leverages existing system vulnerabilities by injecting malicious code into running processes such as Microsoft Word, Flash, Adobe PDF Reader, JavaScript engines, and PowerShell.
Fileless malware techniques:
Delivery Methods
├── Phishing Emails
├── Legitimate Applications
├── Native System Applications (PowerShell, WMI)
├── Infection through Lateral Movement
├── Malicious Websites
├── Registry Manipulation
├── Memory Code Injection
└── Script-based Injection
The absence of files on disk means signature-based scanners often fail completely. Detecting fileless malware requires behavioral monitoring and memory analysis.