Analyse · Malware

Malware taxonomy

A framework for classifying any sample by answering four questions: what it is trying to achieve, how it arrives, whether it replicates on its own and how hard it is to notice. For profiles of individual families use the Malware catalogue; for the techniques malware uses to stay on a system and hide, see Persistence and evasion.

Why defenders study categories

During an incident the first question is not “what is this malware called?” but “what can it do?”. The category immediately answers the questions that shape the response: if a worm is spreading on its own, you isolate the network; if it is an infostealer, you change passwords and revoke sessions; if it is human-operated ransomware, encryption is the last stage and the intruder has been in the network for days.

Categories also help people communicate: analysts, security vendors and CERTs use the same terms in their reports, and knowing the difference between a trojan, a backdoor and a RAT lets you read an advisory and judge how urgent it is. Finally, they guide defence: each category leaves different traces and is countered with different measures.

Categories are not mutually exclusive boxes: a real sample often combines several of them (WannaCry was ransomware with a worm component). Classifying means describing every behaviour, not picking a single label. This page explains how threats work so that you can recognise them and defend against them: any hands-on test requires systems you own or written authorisation; read Ethics and law.

Module overview

Who it is for: Students, junior SOC analysts, developers and system administrators who want to read threat reports and advisories
Level: Beginner
Duration: About 40–60 minutes, including the quiz
Prerequisites: Everyday computer use and basic knowledge of files, processes and networks; no security experience required

Learning objectives

Tell the main categories of malware apart by their behaviour
Understand the difference between self-replication, deceiving the user and hands-on use by an attacker
Classify a real case even when it combines several categories
Link each category to the signs that reveal it and to response priorities

Main categories

Comparison table

Category	Self-replicating	Requires victim action	Main vector	Detection difficulty

Self-replicating: the code creates copies of itself on other files or systems without the attacker stepping in. “Varies” means it depends on the malware used.

Requires victim action: someone has to open a file, install a program or click a link for the system to be infected. “Varies” means there are variants that require it and variants that do not.

Detection difficulty: how hard it is for a defender to notice the threat with common tools (antivirus, EDR, network logs). Low = easy to notice, very high = needs specialist analysis. It is a general teaching guide: every sample is different.

Borderline cases

Some famous pieces of malware do not fit into a single category. Understanding why is the best way to learn how to classify.

Classification quiz

11 scenarios: choose the most suitable category. If you are signed in, your score counts towards the “Malware expert” trophy.

Loading…

Next steps

Malware catalogue — over 1,000 documented families, with indicators of compromise and detection methods

Persistence and evasion — how malware stays on a system and hides, with references to MITRE ATT&CK

Historic breaches — real cases of intrusions and data leaks