Types of malware and how to recognize them
People tend to play fast and loose with security terminology. However, it’s
important to get your malware classifications straight because knowing how
various types of malware spread is vital to containing and removing them.
This concise malware bestiary will help you get your malware terms right
when you hang out with geeks.
1. Viruses
A computer virus is what most of the media and regular end-users call every
malware program reported in the news. Fortunately, most malware
programs aren’t viruses. A computer virus modifies other legitimate host
files (or pointers to them) in such a way that when a victim’s file is
executed, the virus is also executed.
Pure computer viruses are uncommon today, comprising less than 10% of
all malware. That’s a good thing: Viruses are the only type of malware that
“infects” other files. That makes them particularly hard to clean up because
the malware must be executed from the legitimate program. This has
always been nontrivial, and today it’s almost impossible. The best antivirus
programs struggle with doing it correctly and in many (if not most) cases
will simply quarantine or delete the infected file instead.
2. Worms
Worms have been around even longer than computer viruses, all the way
back to mainframe days. Email brought them into fashion in the late 1990s,
and for nearly a decade, computer security pros were besieged by malicious
worms that arrived as message attachments. One person would open a
wormed email and the entire company would be infected in short order.
The distinctive trait of the computer worm is that it’s self-replicating. Take
the notorious Iloveyou worm: When it went off, it hit nearly every email user
in the world, overloaded phone systems (with fraudulently sent texts),
brought down television networks, and even delayed my daily afternoon
paper for half a day. Several other worms, including SQL Slammer and MS
Blaster, ensured the worm’s place in computer security history.
What makes an effective worm so devastating is its ability to spread without
end-user action. Viruses, by contrast, require that an end-user at least kick
it off, before it can try to infect other innocent files and users. Worms
exploit other files and programs to do the dirty work. For example, the SQL
Slammer worm used a (patched) vulnerability in Microsoft SQL to incur
buffer overflows on nearly every unpatched SQL server connected to the
internet in about 10 minutes, a speed record that still stands today.
3. Trojans
Computer worms have been replaced by Trojan malware programs as the
weapon of choice for hackers. Trojans masquerade as legitimate programs,
but they contain malicious instructions. They’ve been around forever, even
longer than computer viruses, but have taken hold of current computers
more than any other type of malware.
A Trojan must be executed by its victim to do its work. Trojans usually
arrive via email or are pushed on users when they visit infected websites.
The most popular Trojan type is the fake antivirus program, which pops up
and claims you’re infected, then instructs you to run a program to clean
your PC. Users swallow the bait and the Trojan takes root.
Remote access Trojans (RATs) in particular have become popular among
cybercriminals. RATs allow the attacker to take remote control over the
victim’s computer, often with the intent to move laterally and infect an
entire network. This type of Trojan is designed to avoid detection. Threat
actors don’t even need to write their own. Hundred of off-the-shelf RATs are
available in underground marketplaces.
Trojans are hard to defend against for two reasons: They’re easy to write
(cyber criminals routinely produce and hawk Trojan-building kits) and
spread by tricking end-users — which a patch, firewall, and other traditional
defense cannot stop. Malware writers pump out Trojans by the millions
each month. Antimalware vendors try their best to fight Trojans, but there
are too many signatures to keep up with.
4. Hybrids and exotic forms
Today, most malware is a combination of traditional malicious programs,
often including parts of Trojans and worms and occasionally a virus. Usually
the malware program appears to the end-user as a Trojan, but once
executed, it attacks other victims over the network like a worm.
Many of today’s malware programs are considered rootkits or stealth
programs. Essentially, malware programs attempt to modify the underlying
operating system to take ultimate control and hide from antimalware
programs. To get rid of these types of programs, you must remove the
controlling component from memory, beginning with the antimalware scan.
Bots are essentially Trojan/worm combinations that attempt to make
individual exploited clients a part of a larger malicious network. Botmasters
have one or more “command and control” servers that bot clients check into
to receive their updated instructions. Botnets range in size from a few
thousand compromised computers to huge networks with hundreds of
thousands of systems under the control of a single botnet master. These
botnets are often rented out to other criminals who then use them for their
own nefarious purposes.
5. Ransomware
Malware programs that encrypt your data and hold it as hostage waiting for
a cryptocurrency pay off has been a huge percentage of the malware for the
last few years, and the percentage is still growing. Ransomware has often
crippled companies, hospitals, police departments, and even entire cities.
Most ransomware programs are Trojans, which means they must be spread
through social engineering of some sort. Once executed, most look for and
encrypt users’ files within a few minutes, although a few are now taking a
“wait-and-see” approach. By watching the user for a few hours before
setting off the encryption routine, the malware admin can figure out exactly
how much ransom the victim can afford and also be sure to delete or
encrypt other supposedly safe backups.
Ransomware can be prevented just like every other type of malware
program, but once executed, it can be hard to reverse the damage without a
good, validated backup. According to some studies, about a quarter of the
victims pay the ransom, and of those, about 30 percent still do not get their
files unlocked. Either way, unlocking the encrypted files, if even possible,
takes particular tools, decryption keys and more than a bit of luck. The best
advice is to make sure you have a good, offline backup of all critical files.
6. Fileless malware
Fileless malware isn’t really a different category of malware, but more of a
description of how they exploit and persevere. Traditional malware travels
and infects new systems using the file system. Fileless malware, which
today comprises over 50 percent of all malware and growing, is malware
that doesn’t directly use files or the file system. Instead they exploit and
spread in memory only or using other “non-file” OS objects such as registry
keys, APIs or scheduled tasks.
Many fileless attacks begin by exploiting an existing legitimate program,
becoming a newly launched “sub-process,” or by using existing legitimate
tools built into the OS (like Microsoft’s PowerShell). The end result is that
fileless attacks are harder to detect and stop. If you aren’t already very
familiar with common fileless attack techniques and programs, you probably
should be if you want a career in computer security.
7. Adware
If you’re lucky, the only malware program you’ve come in contact with is
adware, which attempts to expose the compromised end-user to unwanted,
potentially malicious advertising. A common adware program might redirect
a user’s browser searches to look-alike web pages that contain other
product promotions.
8. Malvertising
Not to be confused with adware, malvertising is the use of legitimate ads or
ad networks to covertly deliver malware to unsuspecting users’ computers.
For example, a cybercriminal might pay to place an ad on a legitimate
website. When a user clicks on the ad, code in the ad either redirects them
to a malicious website or installs malware on their computer. In some cases,
the malware embedded in an ad might execute automatically without any
action from the user, a technique referred to as a “drive-by download.”
Cybercriminals have also been known to compromise legitimate ad
networks that deliver ads to many websites. That’s often how popular
websites such as the New York Times, Spotify and the London Stock
Exchange have been vectors for malicious ads, putting their users in
jeopardy.
The goal of cybercriminals who use malvertising is to make money, of
course. Malvertising can deliver any type of money-making malware,
includingEransomware, cryptomining scripts or banking Trojans.
9. Spyware
Spyware is most often used by people who want to check on the computer
activities of loved ones. Of course, in targeted attacks, criminals can use
spyware to log the keystrokes of victims and gain access to passwords or
intellectual property.
Adware and spyware programs are usually the easiest to remove, often
because they aren’t nearly as nefarious in their intentions as other types of
malware. Find the malicious executable and prevent it from being executed
— you’re done.
A much bigger concern than the actual adware or spyware is the
mechanism it used to exploit the computer or user, be it social engineering,
unpatched software, or a dozen other root exploit causes. This is because
although a spyware or adware program’s intentions are not as malicious, as
say, a backdoor remote access trojan, they both use the same methods to
break in. The presence of an adware/spyware program should serve as a
warning that the device or user has some sort of weakness that needs to be
corrected, before real badness comes calling.
Finding and removing malware
Unfortunately, finding and removing individual malware program
components can be a fool’s errand. It’s easy to get it wrong and miss a
component. Plus, you don’t know whether the malware program has
modified the system in such a way that it will be impossible to make it
completely trustworthy again.
Unless you’re well trained in malware removal and forensics, back up the
data (if needed), format the drive, and reinstall the programs and data when
you find malware on a computer. Patch it well and make sure end-users
know what they did wrong. That way, you get a trustworthy computer
platform and move ahead in the fight without any lingering risks or
questions.
To identify if a file or program is malware or not, you can use antivirus
software to scan the file for known signatures or patterns of malicious code.
However, antivirus software may not detect new or unknown malware, or
malware that uses encryption or obfuscation techniques. Therefore, you
may need to use other methods such as checking the file metadata for
anomalies or inconsistencies, analyzing the file hash and comparing it with
online databases of known malware hashes, examining the file header for
suspicious values, and inspecting the file content using a hex editor or a
disassembler to look for malicious code, strings, or instructions.
It's like playing detective with digital bad guys. First, you would get to
gather clues by studying the behavior and code of the suspicious program.
Then, you roll up your sleeves and analyze its features, like its structure and
how it operates. Next up, you compare what you found with known malware
types to see if it matches any existing ones. And you put a label on it based
on its characteristics, giving it a classification that helps folks understand
what they're dealing with.
Adopting a proactive, multi-layered approach is crucial to effectively
tackling malware threats. This involves leveraging powerful tools such as
Wireshark, NIDS/NIPS, and SIEM solutions for network traffic and behavior
analysis while maintaining robust endpoint security with updated antivirus
software. Additionally, conducting thorough log analysis, leveraging threat
intelligence feeds, and performing packet-level inspections are vital
measures. Deploying honeypots and sandboxes is also recommended, as
educating users to recognize social engineering tactics. Lastly, developing
and regularly updating an incident response plan is essential to ensure a
swift and effective organizational response to potential malware incidents.
Malware classification
The second step is to classify the malware according to its type, category,
family, or variant. This can be done by using malware analysis tools, which
extract and interpret the malware features, functions, and behaviors. These
tools come in two forms: static and dynamic. Static analysis tools examine
the malware code without executing it and can provide information about
the malware structure, syntax, logic, and dependencies (e.g. IDA Pro,
Ghidra, PEStudio). Dynamic analysis tools execute the malware in a
controlled environment (e.g. virtual machine or sandbox) and can provide
information about the malware runtime, network, and system activities (e.g.
Cuckoo Sandbox, Wireshark, Process Monitor). Using both static and
dynamic analysis tools helps you classify the malware based on various
characteristics such as infection vector (e.g. email attachments or web
downloads), payload (e.g. stealing data or displaying ads), persistence
mechanism (e.g. modifying registry entries or injecting code into other
processes), and evasion technique (e.g. encrypting code or using anti-
debugging tricks).
Wire shark are an important tool in network security. As a dynamic analysis
tool, Wire Shark may be useful for virus classification and identification. In
fact, Linkedin Learning has introduced a lecture on Wire Shark.
Malware attribution
The third step is to attribute the malware to its source, origin, or author,
which can be done with malware intelligence tools like Malpedia,
ReversingLabs, and ThreatConnect. These tools collect and correlate data
from various sources, such as malware samples, reports, blogs, forums, or
social media. When attributing the malware based on indicators like its
name, campaign, or actor, you can gain a better understanding of the
malware's nature, behavior, and impact. This is essential for cybersecurity
professionals to protect their systems and networks from malicious threats.
Identifying and classifying malware is a complex process but following these
steps can help develop effective countermeasures and responses.
Malware Clustering
Malware clustering provides, among other things, a visual representation of
the relationships between malware. These results can greatly improve
analysts’ ability to identify similarities between large sets of malware
samples and empower them to more quickly recognize samples that are
already known or that share similarities with known malware. Ultimately,
this frees up security teams to focus on new types of malware.
Analysts can generate quick and meaningful results by using impfuzzy in
combination with the Neo4J graph database. Impfuzzy uses fuzzy hashing to
calculate hash values of the import API. It is also available as a Volatility
plugin.
Although it is not specifically designed to represent malware clusters, the
VirusTotal Graph tool helps analysts understand the relationship between
malware files in a graph representation. It provides visibility into the entire
VirusTotal data set as well as an intuitive interface to pivot and navigate
over them.
The Antivirus Vendor Naming Convention
Antivirus vendors love to assign quirky names to malware using a signature-
based approach. The top-level classification is often done via a basic naming
convention. Typically, the malware name prefix designates the targeted
platform or the malware capabilities, followed by the malware family name
(e.g., “Trojan.Win32”).
Unfortunately, this naming convention is often limited to individual vendors,
which makes sharing information more difficult. Additionally, this technique
does not always describe the malware’s full range of capabilities.
Kaspersky Lab categorizes malware according to a classification tree. The
malware samples are placed in a diagram according to two basic rules:
Behavior that poses the least threat is shown in the lower area of the
diagram.
Behavior that poses a greatest threat is displayed in the upper part of
the diagram.
For example, if an email worm represents a higher risk than an internet
relay chat (IRC) worm, the email worm is placed near the top of the
diagram and above the IRC worm.
CARO
Microsoft uses the Computer Antivirus Research Organization (CARO)
malware naming scheme according to the following format:
Type — The behavior of the malware. For example, is it a Trojan,
spammer or remote access tool?
Platform — The targeted platform, programming language or file
format.
Family — A grouping based on common characteristics, including
attribution to the same authors.
Variant — A distinct version of the malware.
Additional information — Extra details, including how it is used as
part of a multicomponent threat. For example, “!lnk” indicates that
the threat component is a shortcut.
CARO is an organization that consists of individuals across corporate and
academic borders, and it is designed to research and study malware. It has
been pushing for a naming standard since it was established in 1990.
MAEC
Malware Attribute Enumeration and Characterization (MAEC) is a
community-developed structured language for encoding information about
malware based on attributes such as behaviors, artifacts and relationships
between malware samples. It can be used for malware characterization that
is not based on signatures. MAEC is similar to STIX — if you use STIX or
TAXII, MAEC is certainly worth investigating.
The MAEC language is defined by two specification documents:
The core concepts with high-level use cases and the definition of data
types and top-level objects; and
A vocabularies document with explicit values.
MAEC has JavaScript Object Notation (JSON) schemas and Cuckoo
reporting modules available. There is also a module for converting
VirusTotal reports to MAEC.
Machine-Parsable Malware Classification
Some threat intelligence sharing platforms, such as the Malware
Information Sharing Platform (MISP), support malware classification
schemes with machine-parsable tags along with human-readable
descriptions. Having both of these classification approaches available at
once can help make incident response processes more fluent.
The machine-parsable tags allow analysts to easily include automation steps
and protection rules that can be pushed to their security solutions. For
example, once a sample has been analyzed and all characteristics of a
threat event have been added to the platform, the security team can then
deploy intrusion detection system (IDS) rules automatically during the
containment and eradication phase. In the meantime, the human-readable
tags allow analysts to quickly create summary reports. Having the
integration immediately available in a threat information sharing platform
makes exchanging this information with peers much easier.
Selecting the Right Malware Classification Approach
There are many different approaches for classifying malware. Choosing the
right scheme depends on your specific use case.
If you are interested in spotting relationships and similarities between
malware samples, a classification scheme based on image representation
and malware clustering techniques is certainly worth investigating. If your
goal is to improve your incident response process for dealing with malware
outbreaks, the classification should account for the prioritization and
urgency criteria.
The capabilities and behavior of the malware will define its impact on your
environment. For example, is it designed to steal user credentials, leak
sensitive data, allow remote access or sabotage your systems? A higher
impact requires a higher priority. You should also consider whether there
are protection measures that might hinder or slow down your analysis.
Any platform targeted by the malware can be used as input to determine its
priority level. Malware that targets platforms that are not deployed in your
environment or that use document formats that are automatically filtered is
more of a nuisance than a real threat.
Propagation methods will also help define the urgency of the incident.
Malware that can automatically spread without user interaction requires
immediate follow-up. Malware that your security solutions have already
recognized and filtered, on the other hand, can be classified as less urgent.
If you are just starting with a classification scheme, the malware naming
convention based on CARO is a great foundation. You should also prepare
playbooks for the most frequent malware types to ensure that your team is
not caught off guard when an incident strikes. Regardless of which
classification scheme you choose, make sure that you build it in such a way
that you can easily include automated steps in your incident response
strategy.
