Skip to content

Intermediate · Malware and web security · topic 24 of 43 · 35 min

Malware types and how they get in

Explanation

Malware is any software made to harm or misuse a computer, its data or its user. Types are named by behaviour: viruses attach to files, worms spread by themselves, trojans pretend to be useful, ransomware locks files for money, and spyware and infostealers steal data. Most malware still gets in through a person: an attachment, a fake app or a cracked download.

Why learn malware types

Defenders do not write malware. They need to recognise it from its behaviour, because the type tells you what damage to expect and what to do first. A worm means "stop the spread across the network now". An infostealer means "assume every saved password on that machine is stolen". Ransomware means "isolate and protect the backups".

The main types

TypeWhat it doesWhat to do first
VirusAttaches to a normal file or program and spreads when that file is run or sharedIsolate, scan, restore clean files
WormSpreads by itself across networks using a vulnerability, with no user actionContain the network segment, patch the hole
TrojanPretends to be useful software (a game, a "PDF reader", a cracked tool) but hides a harmful partRemove, find what it installed
RansomwareEncrypts files and demands payment; often steals data first (double extortion)Isolate fast, protect backups, start the incident plan
Spyware / infostealerSecretly collects data: saved browser passwords, cookies, crypto wallets, screenshotsReset all passwords used on that machine, revoke sessions
KeyloggerRecords keystrokes, including passwordsAs for infostealers
Remote access trojan (RAT)Gives an attacker remote control of the deviceIsolate, look for what the attacker did
Botnet agentJoins the device to a network of infected machines controlled together, used for spam or DDoSRemove, block the controller addresses
RootkitHides deep in the system to conceal itself and other malwareUsually rebuild the machine from scratch
AdwareShows unwanted ads, may track browsingRemove, check browser extensions

Real malware often mixes types: a trojan that installs a RAT and later drops ransomware. Fileless malware runs only in memory using built-in tools like PowerShell, leaving few files to scan.

How malware gets in

  • Phishing attachments and links: invoices, "delivery failed" notices, fake HR letters.
  • Fake apps: in India, scammers share Android APK files on WhatsApp pretending to be bank KYC, traffic challan, electricity bill or government scheme apps. Once installed, they read SMS (and OTPs) and send them to the criminals.
  • Cracked software and pirated games, which often carry trojans or infostealers.
  • Exploiting unpatched software on internet-facing servers, VPNs and old browsers.
  • Infected USB drives and shared files.
  • Malicious browser extensions and fake ads in search results (malvertising).
Think of it like this: A trojan is like a sweet box from a stranger with something dangerous hidden under the sweets. The box looks like a gift, so you carry it inside yourself. That is why it is named after the wooden horse in the old Greek story.

Signs a device may be infected

  • Antivirus or EDR alerts, or security tools suddenly turned off.
  • New programs, browser extensions or scheduled tasks you did not add.
  • Unusual network traffic, such as constant connections to unknown addresses.
  • Files renamed with strange extensions, or ransom notes in folders.
  • On phones: unknown apps with SMS or accessibility permissions, OTP messages you never received in your SMS app.

Defences

  • Patch operating systems, browsers and apps quickly.
  • Run modern anti-malware or EDR, and do not let users disable it.
  • Users without admin rights, so malware cannot install deeply.
  • Install apps only from official stores; on Android, keep "install unknown apps" off.
  • Offline or immutable backups, tested by restoring.
  • Email filtering and user awareness.
  • Application allow-listing on important systems: only approved programs may run.

Common mistakes

  • Thinking Macs, Linux or phones "do not get malware".
  • Paying a ransom and assuming everything is fine. Payment does not guarantee working keys or deletion of stolen data, and the root cause is still there.
  • Cleaning a machine but not resetting passwords that the infostealer took.
  • Downloading samples "to learn". Study malware only through reports and safe, isolated labs run by professionals.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Malware types and how they get in · 1/7

Name it by what it does

Malware is software made to harm. Defenders name it by behaviour.

Prefer a video by a teacher? Find free videos on “types of malware explained virus worm trojan ransomware infostealer” on YouTube ↗

In real life: The fake challan app

Police in several Indian states have warned about WhatsApp messages with an APK file pretending to be a traffic e-challan or bank app. In a typical case, a shop owner installs one and allows its permissions. The app reads his SMS and forwards OTPs, and money leaves his account within an hour. Calling 1930 quickly gives the best chance of the bank freezing part of the money. Defence: never install APK files from messages, keep Android's unknown-apps setting off, and check app permissions.

Practice (0/3 done)

Task 1 · Question

Malware spreads from computer to computer across the network on its own, using an unpatched bug, with nobody clicking anything. What type is it?

Task 2 · Code · Python

Write classify(traits) where traits is a set of behaviour words. Return the FIRST matching type from these rules, checked in this order: 1. "encrypts_files" and "demands_payment" → "ransomware" 2. "self_spreads" and "needs_user" not in traits → "worm" 3. "pretends_useful" → "trojan" 4. "steals_passwords" → "infostealer" Otherwise → "unknown".

Task 3 · Practice

Check your own Android or iPhone: list apps that have SMS, accessibility or "install unknown apps" permission, and remove any you do not recognise or need.

Quick quiz

Question 1

1.What is "double extortion" ransomware?

Question 2

2.A free "PDF converter" also secretly installs remote control software. It is a…

Question 3

3.After cleaning an infostealer from a laptop, what else must happen?

Question 4

4.Which is the safest way to install apps on Android?

Question 5

5.Fileless malware is hard to catch because…

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What is "double extortion" ransomware?

Answer: It steals data and encrypts it, threatening to publish if not paid

Attackers both lock and leak to increase pressure.

A free "PDF converter" also secretly installs remote control software. It is a…

Answer: Trojan

Hiding harm inside something that looks useful is a trojan.

After cleaning an infostealer from a laptop, what else must happen?

Answer: Reset passwords and revoke sessions for accounts used on that laptop

The stolen passwords and cookies still work until changed or revoked.

Which is the safest way to install apps on Android?

Answer: Only from the official Play Store, with unknown-apps install off

Official stores have checks; side-loaded APKs are a top source of banking malware in India.

Fileless malware is hard to catch because…

Answer: It runs in memory using built-in tools, leaving few files to scan

Behaviour-based tools (EDR) and logging catch it better than file scans.

What is a sandbox in malware analysis?Related

Answer: An isolated machine where a suspicious file is run and observed

Sandboxes let analysts watch behaviour safely.

From How defenders detect malware

Why can attackers avoid hash-based malware detection?Related

Answer: Changing even one byte of the file gives a new hash

Hash matching only catches exact known files, so it is one layer among several.

From Hashing: fingerprints for data

You may practise cracking on…Related

Answer: Only hashes you created or are authorised to test

Only your own or explicitly authorised hashes.

From Password hashing and cracking (your own hashes only)

What does the Notes database save for an image attachment?Related

Answer: The storage key plus facts like file name, type and size

Files live in object storage; the database keeps the key (and a few facts) to find the file again.

From Adding image attachments to notes

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next: How defenders detect malware →

Next steps

  1. 3 more topics in “Malware and web security” before its exam: How defenders detect malware, The OWASP Top 10 with fixes, Secure coding basics.
  2. Module 6 exam: Malware and web security · 13 questions · 25 min, without help. 4 topics of this module still to finish first.
  3. Then the next module, Cloud security basics. 43 topics left in the course before the final exam.

← Previous: A SOC analyst's day and playbooks