6.1 Malware Types and Basic Behavior
Replication versus Delivery
Malware families are classified along two independent axes: how they arrive and how they spread. A virus attaches to a host object -- a PE file, an Office macro, a boot sector -- and depends on that object being moved and opened to travel; it never self-propagates. A worm is self-contained and replicates across networks by exploiting exposed services (the SMB vulnerability behind WannaCry is the canonical case), requiring no user action at all. A trojan does neither: it is pure delivery deception, a malicious binary masquerading as an invoice, installer, or crack. Ransomware, spyware, and RATs are payload classes defined by what they do, and they can be delivered by any of the three vehicles.
Execution and Evasion
Once bytes land on disk they must execute. Malicious Office macros spawn child processes such as powershell.exe or mshta.exe; droppers unpack a second-stage payload into user-writable paths like AppData and Temp, keeping the initial binary small and generic; and attackers lean on living-off-the-land -- signed OS binaries abused to run attacker code -- so naive scanners see only trusted processes. Fileless variants go further, injecting reflective DLLs directly into process memory and leaving almost nothing on disk to scan.
Persistence and C2 Beaconing
Reliable malware re-establishes itself after reboot: registry Run keys, scheduled tasks, services, Startup folder entries, and WMI event subscriptions on Windows; cron jobs, systemd units, and shell rc hooks on Linux. After the foothold holds, the implant enters command-and-control mode: it sleeps for a base interval with random jitter, then beacons out over HTTPS or DNS, receiving tasking inside otherwise normal-looking traffic. Fast-flux hosting, legitimate-domain fronting, and a remote kill switch that bricks the payload on takedown round out the operational profile.
Why the Taxonomy Matters
Detection engineering mirrors the lifecycle stage by stage: mail and web filters attack delivery, EDR rules watch macro-to-child-process chains, persistence hunts diff autorun entries against baselines, and beacon detection uses JA3 TLS fingerprints plus domain reputation to catch C2. Naming the stage tells you which control should have fired.
Architecture Diagram
Key Takeaways
- Viruses need a host object and user action; worms self-propagate across networks; trojans replicate nothing and rely on deception.
- Ransomware, spyware, and RATs describe payload behavior, not delivery -- any of the three vehicles can carry them.
- Droppers and living-off-the-land binaries separate the small first-stage from the real second-stage payload.
- Persistence (Run keys, scheduled tasks, cron) is what turns a one-shot infection into durable access.
- C2 beaconing hides in HTTPS/DNS with sleep intervals and jitter; JA3 and domain reputation are the countermeasures.