Lesson 1.4: Types of malware

Malware is software made to harm: to encrypt, steal, spy, spread or give someone else control. The main families (virus, worm, trojan, ransomware, infostealer, backdoor/RAT, botnet agent, adware) are defined by what they do, which is also how defenders recognise them. In the lab you work on an isolated SOC workstation with five samples quarantined by the endpoint protection yesterday. Without running anything, you classify each one from its recorded behaviour, check what kind of file it is, and take the hashes other defenders need.

16 min

You will learn to

Name the main malware families and what they do
Classify malware from observed behaviour
Identify file types without running them
Take hashes of samples
Explain why samples are handled in isolation

Key terms

Malware: Software intentionally designed to cause harm: damage, steal, spy, extort or take control.
Virus and worm: A virus attaches to other files and spreads when they're run; a worm spreads by itself across networks or removable media.
Trojan: Malware disguised as something useful.
Ransomware: Malware that encrypts data and demands payment; modern groups also steal the data first and threaten to publish it (double extortion).
Infostealer: Malware that collects saved passwords, cookies, crypto wallets and documents and sends them out.
Backdoor / RAT: Malware that gives a remote attacker ongoing control (Remote Access Trojan).

← What is Linux? · All lessons · What is a computer network? →