TechKnowSurge

VideoSecurityFree

Malware

Malware is software intentionally designed to cause disruption, and it encompasses a wide range of threats with goals ranging from data theft and system control to ransomware and adware. Understanding malware means examining its components — vectors, payloads, droppers, and command-and-control mechanisms — rather than forcing it into rigid categories.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Malware is software that is intentionally designed to cause disruption, and it serves a broad range of malicious objectives including data exfiltration, unauthorized system access, denial-of-service attacks, ransomware-based extortion, and unwanted adware delivery. The term itself combines the words malicious and software, and while the concept seems straightforward, the variety of forms malware takes makes it difficult to fit neatly into any single classification system. Common industry categories — viruses, worms, and Trojans — describe how malware spreads rather than what it actually does, and many threats such as ransomware or logic bombs can exist within any of those spreading mechanisms simultaneously. A more accurate way to understand malware is through its functional components rather than its category label. The vector describes how malware enters an environment, whether through a phishing attachment, a malicious link, or removable media. The payload defines the malware's intent — what it actually does once inside a system. The dropper handles concealment, using techniques like fileless execution or rootkits to avoid detection. Command-and-control infrastructure allows attackers to manage compromised systems remotely, and logic bombs can trigger any component based on a specific time or condition. Thinking of these elements as modular building blocks provides a clearer picture of how modern malware is actually constructed and deployed. Because adding components increases both the size and the detectability of malware, attackers frequently use staged delivery — introducing a minimal foothold first, such as a basic command-and-control implant, and then deploying additional capabilities over time. This approach aligns with frameworks like the Cyber Kill Chain and MITRE ATT&CK, which model attacker behavior across phases including delivery, exploitation, persistence, and discovery. It is also worth noting that not all harmful software is malware in the strictest sense — adware occupies a gray area, and buggy software with no malicious intent can cause damage comparable to a deliberate attack — making intent a key factor when evaluating any potentially harmful code.

What you'll learn

Identify common types of malware and describe their characteristics, including vectors, payloads, droppers, and command-and-control components
Explain how malware components can be assembled and staged to evade detection and carry out attacks

What's covered

Malware

What Is Malware
- Intentionally Causes Disruption
- Malicious vs. Ambiguous Software
Malware Goals
- Data Exfiltration
- Ransomware Encryption
- Denial of Service
- Adware and Access
Malware Characteristics
- Vector (Entry Method)
  - Email Attachments
  - Malicious Links
  - Removable Media
- Payload (Intent)
- Dropper and Concealment
  - Fileless Malware
  - Rootkits
- Command and Control
Malware Assembly
- Modular Components
  - Logic Bombs
  - Spreading Mechanisms
- Staged Delivery
  - Reduces Detection Risk
  - Cyber Killchain Phases

Key terms

Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Virus: Malicious code that attaches itself to legitimate programs and replicates when executed.
Worm: Self-replicating malware that spreads across networks without requiring user interaction.
Trojan Horse: Malware disguised as legitimate software that performs malicious actions when executed.
Ransomware: A type of malware that encrypts a victim's files and demands payment in exchange for the decryption key.
Spyware: Malware that secretly monitors and collects user activity and sends it to a third party without consent.
Payload: The actual data content of a packet or message, excluding headers and metadata.
Botnet: A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Dropper: A malware component used to secretly install or conceal malicious code on a target system, often using techniques such as fileless execution or rootkits to avoid detection.
Logic Bomb: Malicious code that remains dormant until a specific condition or trigger is met, at which point it executes its harmful function.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.

Topics

Malware Cybersecurity Threat Analysis Command And Control Malware Components Evasion Techniques

Transcript

Some software is built specifically for malicious behavior, and we call this type of software malware — mal for malicious and ware because it's software. So let's talk about malware and what that looks like.

What Malware Is

Malware is just software that's intentionally designed to cause disruption. The mal means malicious and the ware is the software side of this. Malware is designed to do a lot of different things. It has many different goals. Maybe it's for data exfiltration. Maybe it's to gain access. Maybe it's some sort of denial of service attack to cause chaos. Maybe it's to control systems. Or perhaps it's to present ads to the end user. Or it could be to encrypt data and hold it for ransom until that user pays money, and we call that ransomware.

The Trouble with Categories

Now, I've seen a lot of sources, a lot of articles, a lot of things that try to categorize these different malware. Some of the common categories that you may see out there are viruses, worms, trojans, logic bombs, ransomware, spyware, adware. I'm actually not a big fan of categorizing. I've tried to do the same thing myself. But the problem is you've got something like ransomware or logic bombs — that could be a virus or a Trojan or a worm. It could be any of these. So we really kind of mix these all up. There's an attempt to categorize them, but it doesn't always fit in a nice neat box. So a lot of times you'll see them try to fit things into three main categories: viruses, worms, or Trojans. I'm not a big fan of this either, because not everything fits into these three boxes, but these are some of the most common types of malware that are out there.

Payload and Spreading Mechanism

If we have something like ransomware, where it will encrypt data and hold it ransom until the victim pays money to the attacker — what we see is ransomware can be inserted inside of a worm, or inside of a virus, or inside of a Trojan. So these are the spreading mechanisms to get this around, but then this is going to be what actually carries out the attack. We actually call this the payload. So a worm could have a payload that carries out the attack, but the worm is the mechanism to distribute it.

Thinking in Characteristics

So rather than thinking of these strict categories, I like to think of it more as different characteristics. We can think of it in several different forms, like vector. Vector is how it gets into an organization. How are you going to do that? It could be through an email attachment, or maybe you're sending a link that will bring them to a website and then it gets downloaded from that website, or maybe there's some sort of removable media, and that's how it gets inserted. That's the vector into the organization.

There's also the exploit code, whether it's a virus, a Trojan, or worm. We also have that payload that we talked about. What is the intent of this malware? What's it doing? Maybe it's going to be for data exfiltration, or denial of service attack, or access, or command and control, or the adware.

There's also something called the dropper, which is how it kind of gets hidden in here. Maybe it's fileless, or maybe it's a rootkit, or maybe it's a boot sector virus. There are ways that we can start hiding this code so that way it goes unseen.

And then there's the command and control part of it. The command and control could be the intent of it, or it could just be a component of it as well, such as a botnet. And not everything really fits neatly into this as well, because it could be a logic bomb — any one of these items could be a logic bomb that we send off and we launch at a certain time or a certain trigger.

Assembling Malware from Components

So maybe even better yet, we think of it as different modules or components that we assemble together, maybe kind of like Legos. So here we've got some sort of malware assembly. Maybe what we want to do is launch a ransomware attack. So we're going to have this ransomware that's going to encrypt it, but we don't want it to act right away. We want it to have a chance to spread. So we create some sort of logic bomb. Maybe it's going to get triggered at a certain time. But we also want it to go undetected, so maybe we have a fileless virus here, or fileless malware, that goes undetected. So there are a lot of different components that we can use to assemble this together to make this malware.

But we have to be careful, because any one of these that we add to this could increase the size and also increase the chances that this is going to be detected. So we have to be concerned about the size of the malware that we're building.

Staged Delivery

For that purpose, sometimes we use some sort of staged delivery. We have some sort of simplistic malware that we create — maybe it's a command and control. We deliver that. Once we've delivered that, then we increase it and do other things on the system. So we might not deliver all of the malware, all of our tools, all at once. We might stage it and deliver it in components. It's one of the reasons why we have different phases in both the cyber kill chain and the MITRE ATT&CK, because we might be launching some sort of delivery and exploitation, and then going into the persistence, and then there's the command and control, and there's the discovery. Each one of these might have a different staged approach towards this malware and delivering that malware.

Beyond Malware

Now throughout the rest of this module, we're going to talk more about malware, but we're also going to introduce a few other concepts as well — things that might not be considered malware, malicious software. For instance, a virus is definitely malware. There's no question about that, because it's causing harm to the computer, or it's designed by definition to carry out some sort of harm to the computer. But we have things like adware, which gets a little bit in between here, where sometimes it's malicious and sometimes it's not as malicious, but it might not be something we really want.

There's also things like buggy software. The intent is really not to be malicious at all, but it could cause just as much harm, or maybe possibly even more harm, than a virus or some sort of other malware. So we have to look at the intent. And the intent of this is to cover really just kind of all aspects of this. So we might be covering mostly the malware that falls on this side of the spectrum, but we could be covering a few other things as well.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →