## Malware Categories: Know Your Enemy

"Malware" is a catch-all term for "Malicious Software". However, calling everything a "Virus" is like calling every vehicle a "Car" (inaccurate when it is a tank or a jet). As an analyst, you must use precise terminology.

### 1. Virus
*   **Definition**: Code that attaches itself to a legitimate program (host). It cannot run by itself. It needs you to run the host program.
*   **Behavior**: Replicates by infecting other files.
*   **Analogy**: A biological virus needs a human cell to reproduce.
*   **Example**: CIH (Chernobyl), file infectors. *Rare in modern times.*

### 2. Worm
*   **Definition**: A standalone program that propagates automatically across a network. It does **not** need a host file and does **not** need user interaction.
*   **Behavior**: Scans the network for vulnerabilities (e.g., SMB exploits), copies itself, and executes.
*   **Impact**: Can saturate network bandwidth instantly.
*   **Example**: **WannaCry** (spread via EternalBlue), **Conficker**, **Morris Worm**.

### 3. Trojan Horse
*   **Definition**: Malware disguised as legitimate software.
*   **Behavior**: You think you are downloading "Adobe Photoshop Crack.exe" or "Zoom_Installer.exe". You run it, it installs the app (maybe), but also installs the malware.
*   **Key**: It relies on **Social Engineering**, not exploits.
*   **Example**: **Emotet** (often delivered via fake invoices), **Zeus**.

### 4. Ransomware
*   **Definition**: Malware that encrypts your files and demands payment for the decryption key.
*   **Behavior**:
    1.  Infects machine.
    2.  Contacts C2 server (to generate keys).
    3.  Encrypts documents (`.docx`, `.jpg`, `.pdf`).
    4.  Changes wallpaper to "YOUR FILES ARE ENCRYPTED".
*   **Evolution**: Modern Ransomware (Double Extortion) also *steals* your data before encrypting it, threatening to leak it if you don't pay.
*   **Example**: **Ryuk**, **Conti**, **LockBit**.

### 5. Rootkit
*   **Definition**: Malware designed to hide its existence. It digs deep into the OS (Kernel level).
*   **Behavior**: It intercepts System Calls.
    *   You ask Windows: "Show me all files in C:Windows".
    *   Windows asks Kernel.
    *   Rootkit intercepts: "List files, but remove 'evil.sys' from the list."
    *   Windows shows you the list. You see nothing.
*   **Detection**: Extremely difficult. Usually requires memory forensics.

### 6. Spyware / Keylogger
*   **Definition**: Steals information.
*   **Behavior**: Records keystrokes (passwords), takes screenshots, activates the webcam.
*   **Example**: **Pegasus** (Mobile spyware), **Agent Tesla**.

### 7. Cryptominer (Coinminer)
*   **Definition**: Steals your CPU/GPU power to mine cryptocurrency (Monero).
*   **Symptoms**: Computer fans spin at 100%, system becomes sluggish.
*   **Risk**: It proves the attacker has code execution. Today it's a miner; tomorrow it could be Ransomware.

### 8. RAT (Remote Access Trojan)
*   **Definition**: Logic that gives the attacker full remote control (Screen, Mouse, Shell, Files).
*   **Behavior**: It's like TeamViewer for hackers.
*   **Example**: **NjRAT**, **DarkComet**.

### Review
*   If it spreads on its own -> **Worm**.
*   If it looks like a game but isn't -> **Trojan**.
*   If it locks your files -> **Ransomware**.
*   If it hides in the kernel -> **Rootkit**.