Malware & Malicious Code (Malcode)

1. Self-Propagating & Execution Mechanics

Malware defined primarily by how it attaches to hosts or spreads across systems.

• Viruses — Malicious code that requires human interaction or host file execution to run and replicate.
  • File Infectors: Attaches malicious code to executable files (.exe, .dll).
  • Boot Sector Viruses: Infects the Master Boot Record (MBR) or GUID Partition Table (GPT) to execute before the OS loads.
  • Macro Viruses: Embedded inside office documents (Word, Excel) using VBA macros to execute upon opening.
  • Polymorphic / Metamorphic Viruses: Changes its underlying signature/code structure every time it infects a new file to evade traditional antivirus rules.
• Worms — Self-contained, self-propagating malware that spreads across networks without human interaction by exploiting vulnerabilities in operating systems or network services (e.g., WannaCry using EternalBlue, Stuxnet).
• Trojans (Trojan Horses) — Malware disguised as legitimate, desirable software (e.g., a fake game, cracked software, or PDF utility) that tricks the user into installing it.
  • Droppers & Downloaders: Minimalist Trojans whose sole job is to bypass initial checks and drop/download a heavier payload.
  • Remote Access Trojans (RATs): Gives the attacker full remote control over the infected machine (e.g., DarkComet, njRAT).
  • Banking Trojans: Specifically targets financial credentials via web-injects, keylogging, or session hijacking (e.g., Zeus, TrickBot).

2. High-Impact Extortion & Destructive Malware

Malware defined by the damage or ransom demands it inflicts on the target.

• Ransomware — Encrypts or locks a victim's files/systems and demands a ransom payment (usually in cryptocurrency) for the decryption key.
  • Crypto-Ransomware: Encrypts personal and system files (e.g., LockBit, BlackCat).
  • Locker Ransomware: Locks the user out of the entire device/OS screen without necessarily encrypting individual files.
  • Double/Triple Extortion Ransomware: Encrypts files, threatens to leak stolen data on dark web leak sites, and launches DDoS attacks against the target until paid.
• Wipers / Destructive Malware — Designed purely to destroy data, wipe hard drives, or render systems permanently unbootable with no recovery option (e.g., NotPetya, HermeticWiper, Shamoon).
• Scareware / Rogue Security Software — Uses fake pop-ups and browser warnings claiming the system is heavily infected, tricking the victim into paying for a fake removal tool or providing credit card details.

3. Stealth, Persistence, & Deep-Access Malware

Malware designed to embed itself deeply into the OS or hardware to evade detection and maintain long-term access.

• Rootkits — Grants attackers administrative (root-level) access while actively hiding its presence, processes, and files from OS-level security tools.
  • User-Mode (Ring 3) Rootkits: Hooks API calls in user memory to hide files/processes.
  • Kernel-Mode (Ring 0) Rootkits: Operates at the OS kernel level, making it extremely difficult for traditional EDRs to detect.
  • Hypervisor / Type-0 Rootkits: Runs beneath the operating system as a virtual machine monitor.
• Bootkits — Infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI/BIOS firmware, allowing malicious code to run before the operating system and EDR agents even boot up.
• Fileless Malware / Living off the Land (LotL) — Malware that operates entirely in volatile system memory (RAM) and abuses trusted native administrative tools (e.g., PowerShell, WMI, vssadmin) without writing malicious files to the hard drive.
• Backdoors — Secret bypass mechanisms built into or left behind on a system, allowing attackers to re-enter without authenticating.
• Logic Bombs — Dormant code embedded within legitimate software that triggers a malicious action only when specific conditions are met (e.g., a specific date, or a employee's user account being deleted).

4. Surveillance & Credential Harvesting

Malware designed to quietly gather intelligence, credentials, and user activity.

• InfoStealers — Specialized malware designed to harvest stored browser passwords, session cookies, cryptocurrency wallet keys, auto-fill data, and VPN tokens (e.g., RedLine Stealer, Lumma Stealer).
• Spyware — Monitors user activity in secret, collecting personal habits, browsing history, and sensitive files.
• Keyloggers — Hardware or software modules that record every keystroke typed by the user to capture passwords, credit card numbers, and private messages.
• Screen Scrapers — Captures periodic screenshots or video recordings of the user’s display, often triggered when banking or sensitive applications are opened.
• Adware — Automatically displays or downloads unwanted advertisements, often redirecting search queries or hijacking browser homepages.
• Cryptojackers (Coinminers) — Secretly uses the victim’s CPU/GPU processing power to mine cryptocurrency for the attacker, causing severe performance degradation and high electricity usage.

5. Botnets & Command-and-Control (C2) Agents

Malware designed to turn infected hosts into remote-controlled worker nodes.

• Botnets / Zombie Networks — Networks of thousands of compromised devices (PCs, servers, IoT devices) controlled by a central threat actor (e.g., Mirai botnet).
  • DDoS Bots: Used to launch coordinated volumetric traffic floods against websites or infrastructure.
  • Spam Bots: Used to send massive volumes of phishing emails.
  • Proxy Bots: Used to route malicious attacker traffic through victim IP addresses to hide the real attacker's location.
• C2 Beacons / Implant Agents — Lightweight agents installed on infected endpoints that periodically "beacon" back out to an attacker's server (using HTTP/S, DNS, or custom protocols) to request new commands.

6. Malware Evasion Techniques (How They Hide)

Mechanisms used by various malware types to bypass antivirus (AV) and Endpoint Detection & Response (EDR).

• Packers & Crypters — Compressing or encrypting the malicious executable payload to obscure the PE (Portable Executable) header and code structure from static scanners.
• Obfuscation — Rewriting code, adding junk code (dead code insertion), or encoding strings (e.g., Base64/XOR) to make human reverse-engineering and automated signature checks difficult.
• Anti-Analysis & Anti-Sandbox — Detecting if the malware is running inside a virtual machine (VMware, VirtualBox) or sandbox environment (e.g., checking for mouse movements, low uptime, or specific debugger drivers) and remaining dormant if detected.
• Process Injection — Injecting malicious code into a legitimate, trusted running process (e.g., explorer.exe or svchost.exe) to blend in with normal system activity.
  • Process Hollowing: Spawning a benign process in a suspended state, clearing its memory, and replacing it with malicious code.
  • Reflective DLL Injection: Loading a DLL into a process directly from memory without writing it to disk.
• EDR Unhooking & AMSI Bypass — Patching or overwriting the API hooks that EDRs place in user-mode memory, or patching the Windows Anti-Malware Scan Interface (AMSI) in memory to blind host defenses.

7. The Defensive & Analytical Counterparts

How defenders analyze and categorize malware threats.

• Static Analysis — Analyzing malware without executing it (examining PE headers, extracting strings, calculating MD5/SHA256 hashes, generating YARA rules).
• Dynamic Analysis (Sandboxing) — Executing malware in an isolated environment and monitoring process creation, file modifications, registry edits, and network traffic.
• Heuristic & Behavioral Engines — Modern EDR capabilities that detect malware based on suspicious actions (e.g., an Office document spawning PowerShell to download a file) rather than static signatures.