Malware Classification
INTRODUCTION TO MALWARE
Definition: Malware (malicious software) is
any software designed to harm, exploit, or
compromise a system.
Importance: Understanding malware helps
prevent infections and protect sensitive data.
Common Attack Vectors: Malware spreads
through email, malicious websites, software
downloads, and network vulnerabilities
VIRUSES
Self-replicating code that attaches to
programs or files.
Requires a host file to spread and execute
its payload.
Types:
Macro Viruses (spread via documents).
Boot Sector Viruses (infect system startup
sectors).
Polymorphic Viruses (change their code to
evade detection).
WORMS
Standalone malware that spreads without
human interaction.
Uses network vulnerabilities to infect
other systems.
Examples: SQL Slammer, WannaCry
exploited security flaws to propagate rapidly.
TROJANS
Disguised as legitimate software to trick
users into running them.
Types:
1. Backdoor Trojans (allow remote access).
2. Banking Trojans (steal financial data).
Example: The Zeus Trojan targeted
banking credentials
RANSOMWARE
Encrypts files and demands payment for
decryption.
Notorious Examples: WannaCry, Ryuk.
Prevention:
Regular backups.
Updated security patches.
Avoid suspicious email links.
SPYWARE & ADWARE
Spyware: Secretly collects user data, such
as keystrokes and browsing activity.
Adware: Displays unwanted ads and may
track behavior.
Prevention: Use ad blockers, anti-
spyware tools, and avoid unknown
downloads.
ROOT KITS
Gives attackers deep system access
while hiding malicious activity.
Types:
1. Kernel Mode (harder to detect, runs at OS
level).
2. User Mode (affects applications).
Challenges: Hard to detect and remove
without full system reinstallation
KEY LOGGERS
Captures keystrokes to steal login
credentials.
Types:
1. Hardware Key loggers (plugged into USB
or keyboard ports).
2. Software Key loggers (installed secretly
on devices).
Prevention: Use on-screen keyboards,
anti-malware tools, and secure
passwords.
BOTNETS
Networks of compromised devices
("bots") controlled remotely.
Uses:
1. DDoS attacks (disrupts websites).
2. Spam distribution.
Example: Mirai Botnet infected IoT devices
to launch massive DDoS attacks
FILELESS MALWARE
Lives in system memory instead of files,
making it hard to detect.
Evades antivirus detection by using
legitimate system tools like PowerShell.
Attack Methods: Malicious scripts injected
through phishing emails or infected
websites.
CRYPTO JACKING
Uses victims' computing power to mine
crypto currency without consent.
Types:
1. Browser-based (runs via malicious
JavaScript).
2. Malware-based (installs mining software
on devices).
Prevention: Ad-blockers, security
updates, and endpoint monitoring
POTENTIALLY UNWANTED PROGRAMS
(PUPS)
Bundled software that installs without
user consent.
Can slow down systems and introduce
security risks.
Best Practices:
1. Download from trusted sources.
2. Disable unwanted software during
installation
LOGIC BOMBS
Malicious code hidden inside software,
activated by specific conditions.
Used for sabotage by insiders.
Example: A disgruntled employee
embedding a time-triggered attack in
company software
COMMAND AND CONTROL (C2)
MALWARE
Controls infected systems remotely
through:
HTTP, DNS tunneling, or encrypted
channels.
Defense Strategies:
1. Network monitoring for suspicious traffic.
2. Blocking known C2 servers
MOBILE MALWARE
Android vs. iOS Vulnerabilities:
1. Android is more open but has higher
malware risk.
2. iOS is tightly controlled but still
vulnerable to zero-day exploits.
Common Mobile Threats: Banking Trojans,
Spyware.
Best Practices: Only download from official
app stores
IOT MALWARE
Targets smart devices like cameras,
routers, and smart TVs.
Examples:
1. BrickerBot (permanently disables IoT
devices).
2. Mozi Botnet (used for large-scale attacks).
Securing IoT: Regular firmware updates,
strong passwords, and network
segmentation
DETECTING AND PREVENTING
MALWARE
Antivirus & Endpoint Protection: Detects
known threats.
Behavioral Analysis: Identifies suspicious
activity patterns.
Best Practices: Regular updates,
security patches, and user awarenes
INCIDENT RESPONSE AND MALWARE REMOVAL
Steps:
1. Identification & Containment (isolate
infected systems).
2. Eradication & Recovery (remove
malware, restore backups).
Backups are essential for data recovery
and ransomware protection