IntermediateSecurity

Malware Basics: Types, Analysis, and Defense Strategies

Understand different types of malware, basic analysis techniques, and strategies for protecting systems from malicious software.

#Malware#Analysis#Ransomware#Viruses#Cyber Defense

Types of Malware

Viruses

Viruses attach themselves to legitimate programs and spread when the infected program is executed. Types include file infectors (attach to executables), boot sector viruses (infect master boot record), macro viruses (embedded in documents), and polymorphic viruses (change code to evade detection).

Worms

Worms are self-replicating malware that spread without human interaction by exploiting network vulnerabilities. Notable examples include the Morris Worm (1988, one of the first internet worms), MSBlast (2003, exploited Windows RPC), Stuxnet (2010, targeted Iranian nuclear facilities), and WannaCry (2017, ransomware worm using EternalBlue).

Trojans

Trojans disguise themselves as legitimate software. They include Remote Access Trojans (RATs) providing remote control, banking Trojans stealing financial credentials, backdoors creating unauthorized access, and downloaders fetching additional malware.

Ransomware

Ransomware encrypts files and demands payment for decryption. Notable examples include CryptoLocker (2013, pioneered modern ransomware), Locky (2016, large-scale email campaign), Ryuk (2018, targeted enterprises), REvil/Sodinokibi (2019, ransomware-as-a-service), and BlackCat/ALPHV (2021, first Rust-based ransomware).

Other Types

Spyware monitors user activity through keyloggers, screen scrapers, and information stealers. Adware displays unwanted advertisements. Rootkits provide privileged access while hiding from security tools. Fileless malware operates in memory without writing files to disk, evading traditional antivirus detection.

Malware Analysis Approaches

Static Analysis

Analyzing malware without executing it. Techniques include file type identification (file command), hash calculation (MD5, SHA256), string extraction (strings command), VirusTotal checking, and disassembly with IDA Pro or Ghidra.

Dynamic Analysis

Analyzing malware behavior during execution in a controlled environment. Uses sandboxes (Cuckoo Sandbox), API call monitoring, network traffic analysis, and registry/filesystem monitoring.

Memory Analysis

Analyzing RAM dumps for malware artifacts using tools like Volatility. Examines running processes, network connections, loaded DLLs, and injection detection.

Defense Strategies

Technical Controls: Antivirus/anti-malware software, Endpoint Detection and Response (EDR), application whitelisting, least privilege, patch management, network segmentation, email filtering, regular backups (3-2-1 rule).

User Education: Recognize phishing attempts, avoid suspicious downloads, verify software sources, report unusual system behavior.

Incident Response for Malware

When malware is suspected: isolate affected systems immediately, preserve evidence (take disk images and memory dumps), identify the malware type and entry vector, contain the spread, eradicate the malware, restore from clean backups, and conduct post-incident analysis to prevent recurrence.

Malware defense requires a layered approach combining technical controls, user education, and incident response capabilities. Regular backups remain the most important defense against ransomware.

Frequently Asked Questions

What is the difference between a virus and a worm?

A virus requires a host program and human interaction to spread — it attaches to legitimate files and executes when the file is opened. A worm is self-replicating and spreads automatically across networks without human interaction by exploiting vulnerabilities.

What is ransomware and how does it work?

Ransomware encrypts your files using strong encryption and demands payment (usually cryptocurrency) for the decryption key. It typically enters through phishing emails, exploit kits, or remote desktop compromise. Regular offline backups following the 3-2-1 rule are the best defense.

What is a Trojan in cybersecurity?

A Trojan disguises itself as legitimate software to trick users into installing it. Once executed, it can provide remote access (RAT), steal banking credentials, create backdoors, or download additional malware. Unlike viruses, Trojans do not self-replicate.

What is fileless malware?

Fileless malware operates entirely in system memory without writing files to disk, making it invisible to traditional antivirus software. It exploits legitimate system tools like PowerShell or WMI. Defense requires [EDR solutions](/learn/firewall-fundamentals) and behavioral monitoring rather than signature-based detection.

What is static analysis in malware investigation?

Static analysis examines malware without executing it. Techniques include identifying the file type with `file`, calculating hashes (MD5, SHA256), extracting strings with `strings`, checking VirusTotal, and disassembling with tools like Ghidra or IDA Pro. This safely reveals indicators of compromise.

What is dynamic analysis of malware?

Dynamic analysis executes malware in a controlled sandbox environment to observe its behavior — including API calls, network connections, file modifications, and registry changes. Tools like Cuckoo Sandbox automate this process. Always use isolated VMs to prevent accidental spread.

What is a rootkit and why is it dangerous?

A rootkit provides privileged (root-level) access to a system while hiding its presence from security tools and the operating system. It can intercept system calls, modify boot processes, and hide files and processes. Rootkits are difficult to detect and often require complete system reimaging.

What is spyware and how does it collect data?

Spyware secretly monitors user activity through keyloggers, screen scrapers, and browser hijackers. It collects passwords, browsing habits, financial information, and personal data. It often arrives bundled with free software or through phishing emails. Use anti-malware tools and practice [safe browsing](/learn/secure-browsing-guide).

What is the 3-2-1 backup rule?

The 3-2-1 rule states: keep 3 copies of your data, on 2 different media types, with 1 copy stored offsite or offline. This ensures that even if ransomware encrypts your primary data, you have clean backups available for restoration without paying the ransom.

How do I respond to a malware infection?

Isolate the infected system immediately from the network, preserve evidence (disk images, memory dumps), identify the malware type and entry vector, contain the spread, eradicate the infection, restore from clean backups, and conduct a post-incident analysis to prevent recurrence.

What is a keylogger and how can I detect it?

A keylogger records keystrokes to capture passwords, messages, and other sensitive input. Hardware keyloggers are physical devices plugged between keyboard and computer; software keyloggers run as processes. Detect software keyloggers with [antivirus scans](/learn/malware-basics), process monitoring, and behavioral analysis tools.