Essential Malware Types Cheatsheet: Defending Against Digital Threats

Introduction to Malware

Malware (malicious software) refers to any software intentionally designed to cause damage to computers, servers, networks, or their users. Understanding the different types of malware is crucial for effective cybersecurity strategy and protection of digital assets. This cheatsheet provides a comprehensive overview of common malware types, their behaviors, detection methods, and prevention strategies.

Core Malware Concepts

Key Malware Characteristics

Common Malware Objectives

• Data Theft – Stealing sensitive information
• Financial Gain – Extracting money through ransoms or fraud
• Resource Hijacking – Using victim’s computing resources (cryptocurrency mining)
• Sabotage – Damaging systems or disrupting operations
• Espionage – Gathering intelligence from specific targets
• Backdoor Creation – Establishing persistent access for future exploitation

Major Malware Categories

Viruses

Definition: Malicious code that attaches to legitimate files or programs and executes when the host file is executed.

Types of Viruses

Virus Infection Cycle

1. Dormancy – Virus is inactive until triggered
2. Propagation – Virus replicates by attaching to other files
3. Triggering – Specific condition activates the virus
4. Execution – Virus performs its intended malicious function
5. Infection – Virus spreads to new files or systems

Worms

Definition: Self-replicating malware that spreads across networks without requiring user action or host files.

Key Worm Characteristics

Notable Worm Examples

Trojans

Definition: Malware disguised as legitimate software that performs malicious actions when executed.

Trojan Types by Function

Common Trojan Delivery Methods

• Phishing emails with malicious attachments
• Malicious downloads disguised as legitimate software
• Drive-by downloads from compromised websites
• Social engineering tactics (fake updates, tech support scams)
• Malvertising (malicious advertising)
• Infected USB drives and removable media

Ransomware

Definition: Malware that encrypts victim’s files and demands payment (ransom) for the decryption key.

Ransomware Attack Cycle

1. Infection – Enters system through vulnerability, phishing, etc.
2. Deployment – Ransomware components are installed and executed
3. Scanning – Searches for valuable files to encrypt
4. Encryption – Locks files using strong encryption
5. Communication – Contacts command & control server for keys
6. Notification – Displays ransom demand to victim
7. Deletion – Often deletes shadow copies and backups
8. Cleanup – May remove evidence of initial infection

Notable Ransomware Families

Ransomware Innovations and Tactics

• Double Extortion – Stealing data before encryption and threatening to publish
• Triple Extortion – Adding DDoS attacks or contacting customers as additional pressure
• Ransomware-as-a-Service (RaaS) – Subscription-based model for criminal affiliates
• Big Game Hunting – Targeting large organizations for higher ransoms
• Initial Access Brokers – Specialized criminals who gain access then sell to ransomware operators

Additional Malware Types

Spyware and Adware

Fileless Malware

Definition: Malware that operates entirely in memory without writing files to disk, making it difficult to detect with traditional methods.

Fileless Malware Techniques

• Memory-Only Execution – Runs entirely in RAM
• Script-Based Attacks – PowerShell, WMI, Windows Registry
• Living Off The Land (LOL) – Uses legitimate system tools
• Registry Manipulation – Stores payloads in Windows Registry
• DLL Injection – Inserts malicious code into legitimate processes

Advanced Persistent Threats (APTs)

Definition: Sophisticated, long-term targeted attacks, often state-sponsored, designed to maintain persistent access to networks.

APT Characteristics

• Sophisticated Targeting – Specific organizations or industries
• Extended Campaigns – Months or years of activity
• Advanced Evasion – Custom tools and zero-day exploits
• Data Exfiltration – Focused on stealing specific information
• Persistence – Multiple backdoors and access methods

Mobile Malware

Malware Comparison

Comparison by Propagation Method

Comparison by Detection Difficulty

Common Malware Defense Challenges and Solutions

Malware Prevention Best Practices

Organizational Defenses

• Defense in Depth – Layer multiple security controls
• Principle of Least Privilege – Restrict user and application permissions
• Network Segmentation – Isolate critical systems and limit lateral movement
• Regular Patching – Maintain up-to-date systems and applications
• Email Security – Deploy advanced filtering and anti-phishing solutions
• Employee Training – Conduct regular security awareness training
• Incident Response Plan – Develop and regularly test procedures
• Backup Strategy – Implement 3-2-1 backup rule (3 copies, 2 different media, 1 off-site)

Technical Controls

• Endpoint Protection – Next-gen antivirus and EDR solutions
• Application Whitelisting – Allow only approved applications to run
• Script Control – Restrict PowerShell and other scripting environments
• Network Monitoring – Deploy IDS/IPS and network traffic analysis
• DNS Filtering – Block connections to known malicious domains
• Web Filtering – Control access to potentially malicious websites
• Email Security – SPF, DKIM, and DMARC implementation
• Multi-Factor Authentication – Require additional verification for access

Personal Device Protection

• Keep Systems Updated – Apply security patches promptly
• Use Strong Antivirus – Install and maintain reputable security software
• Practice Email Caution – Verify sender before opening attachments or clicking links
• Download From Trusted Sources – Avoid unofficial app stores and websites
• Use Password Managers – Create and store strong, unique passwords
• Enable Multi-Factor Authentication – Add extra layer of account security
• Regular Backups – Maintain recent backups of important data
• Device Encryption – Encrypt sensitive data on devices and storage media

Malware Response and Recovery

Initial Response Steps

1. Isolate Affected Systems – Disconnect from network to prevent spread
2. Identify Malware Type – Determine what you’re dealing with
3. Assess Damage – Evaluate compromised data and systems
4. Document Evidence – Record indicators of compromise for analysis
5. Notify Stakeholders – Inform relevant parties per incident response plan
6. Engage Specialists – Involve cyber incident response team if necessary

Recovery Process

1. Contain the Threat – Ensure complete isolation of affected systems
2. Eradicate the Malware – Remove all traces of infection
3. Restore from Clean Backups – Rebuild systems from known clean sources
4. Patch Vulnerabilities – Address the entry point that allowed the infection
5. Verify Security – Test systems before returning to production
6. Monitor for Reoccurrence – Maintain heightened vigilance
7. Perform Post-Incident Review – Learn from the incident and improve defenses

Resources for Further Learning

Organizations and Information Sources

• MITRE ATT&CK Framework – Comprehensive knowledge base of adversary tactics and techniques
• CISA (Cybersecurity & Infrastructure Security Agency) – Government resources and alerts
• SANS Institute – Research and education in security awareness
• VirusTotal – File and URL analysis service
• Malware Analysis Websites – Hybrid Analysis, Joe Sandbox, Any.Run

Recommended Books

• “Practical Malware Analysis” by Michael Sikorski and Andrew Honig
• “Malware Analyst’s Cookbook” by Michael Ligh et al.
• “The Art of Memory Forensics” by Michael Hale Ligh et al.
• “Rootkits and Bootkits” by Alex Matrosov, Eugene Rodionov, and Sergey Bratus
• “Reversing: Secrets of Reverse Engineering” by Eldad Eilam

Online Courses and Learning Platforms

• SANS FOR610: Reverse-Engineering Malware
• Pluralsight Malware Analysis courses
• Cybrary Malware Analysis courses
• Udemy Ethical Hacking courses
• TryHackMe and HackTheBox labs

Tools for Malware Analysis

• Static Analysis – IDA Pro, Ghidra, PE Explorer, PEiD
• Dynamic Analysis – Process Monitor, Process Explorer, Wireshark
• Sandboxing – Cuckoo Sandbox, Windows Sandbox, VMware/VirtualBox
• Memory Analysis – Volatility Framework, Rekall
• Disassemblers/Debuggers – x64dbg, OllyDbg, Radare2