[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 4 · 4.1.b
AP Cybersecurity · Securing Devices
Identifying the Type of Malware
Ask how it spreads and what it does — most samples are one answer from each column.
key ideaAsk how it spreads and what it does. Most samples are one answer from each column.
The categories
Malware is malicious software that can damage or destroy a device or network, or give an adversary access to a device and its data. It is usually a tool inside a larger plan rather than the goal itself — which is why the type tells you what the adversary was after.
The two columns are independent. A single sample can be a trojan by delivery and ransomware by payload, and naming both halves is what a complete answer looks like.| Type | Defining feature | Column |
|---|
| virus | must be activated by a user executing or opening a file | spread |
| worm | spreads computer to computer without human interaction | spread |
| trojan | embedded in other software that seems harmless | spread |
| remote access trojan (RAT) | a trojan that gives the adversary remote access | spread + payload |
| ransomware | encrypts files; demands payment for a decryption key within a fixed time | payload |
| spyware | tracks a user's actions and sends information back | payload |
| keylogger | software or hardware that logs keystrokes — often yielding usernames and passwords | payload |
| logic bomb | triggers only when specific conditions are met — a date, an OS version, a character set | payload |
The keylogger row carries a detail worth remembering: it can be hardware as well as software, which is why it belongs to physical security as much as to this unit.
MalwareMalicious software that can damage or destroy a device or network, or grant an adversary access to it and its data.
VirusMalware that must be activated by a user executing or opening a file.
WormMalware that spreads computer to computer without human interaction.
TrojanMalware embedded in other software that seems harmless. A RAT is one that grants remote access.
Logic bombMalware set to fire only when specific conditions are met — a date, an OS version, a character set.
| Ordinary malware | Fileless malware |
|---|
| what it is | a file or collection of files | malicious code living in RAM |
| how it acts | runs its own code | uses legitimate programs already installed on the device |
| what anti-malware scans | files on disk | nothing on disk to find |
| what survives a reboot | the files | often nothing — which cuts both ways |
Fileless malware is defined by what it lacks. Because it lives in memory and borrows trusted programs, file-scanning detection is structurally unable to see it.
Telling them apart
the deciding questions
- Virus versus worm is settled by one question: did a person have to do something?
- Trojan describes the disguise, not the payload — say what it carries as well.
- A logic bomb may sit dormant for months; discovery does not mean it has not already been placed elsewhere.
- Fileless malware lives in RAM and abuses legitimate installed programs.
Worked examples
EX 1
Name both halves
An employee opens an invoice attachment. It installs software that encrypts every file and demands payment. Classify it.
1
Ask how it spread
A user opened a file that appeared harmless — a trojan by delivery, and virus-like in needing activation.
2
Ask what it did
Encrypted files and demanded payment — ransomware by payload.
3
Give the complete answer
A trojan delivering ransomware.
4
Note the deadline
Ransomware typically promises a decryption key within a fixed time, which is pressure, not a guarantee.
5
Note what the type implies
Expect data theft too — modern operators exfiltrate before encrypting.
EX 2
Virus or worm?
Over one night, 300 machines are infected. No user reported opening anything. Which type, and what does that imply?
1
Apply the deciding question
No human action, so it is not a virus.
2
Name it
A worm — it spreads from one computer to another without human interaction.
3
Explain the rate
Self-propagation is why 300 machines fell overnight rather than one at a time.
4
Identify what allowed it
A flat network and an unpatched vulnerability — worms need a path and a way in.
5
Give the response
Segment immediately to stop propagation, then patch. Containment precedes cleanup.
EX 3
The malware with no file
A device behaves as though compromised, but a full disk scan finds nothing. Explain what may be happening.
1
Note the contradiction
Symptoms without files is the signature of fileless malware.
2
Say where it lives
Malicious code in RAM, using legitimate programs already installed on the device.
3
Say why the scan is clean
A file scanner has nothing on disk to examine.
4
Give the detection that works
Behavioral monitoring — a trusted program doing untrusted things.
5
Note the reboot caveat
Memory-resident code often does not survive a restart, which destroys the evidence as well as the malware.
Watch out
Trojan describes the disguise, not the payload
‘It was a trojan’ says how it arrived. Name what it carried — a RAT, ransomware, spyware — to describe the incident.
A keylogger can be hardware
The CED defines it as software or hardware. A physical device between keyboard and computer is invisible to every anti-malware product.
Logic bombs are quiet by design
They trigger only when specific conditions are met — a date, an OS version, a character set. Absence of effect is not absence of the bomb.
Fileless malware defeats file scanning by construction
It lives in RAM and borrows installed programs. Detection has to watch behavior rather than contents.