Malware

1. Introduction to Malware

Malware is a general term for malicious software designed to
perform unauthorized, harmful or deceptive activities on a computer system,
network, device or information environment.

The word malware comes from “malicious software.” It includes
many different types of programs and code, each with different behaviors and
objectives.

Malware may attempt to steal information, damage files, disrupt operations,
gain unauthorized access, spy on users, install additional software or use a
compromised computer as part of a larger attack.

2. Malware and the CIA Triad

Malware can affect the three fundamental security objectives known as the
CIA triad:

• Confidentiality — preventing unauthorized access to information.
• Integrity — preventing unauthorized modification or destruction of information.
• Availability — keeping systems and information accessible when needed.

For example:

3. Virus

A computer virus is malicious code that typically attaches
itself to another file or program and relies on execution of the host content
to spread or perform its activity.

Historically, viruses were associated with infected executable files and
documents containing malicious macros.

Modern malware can use more sophisticated delivery mechanisms, so the
traditional distinction between malware categories can sometimes overlap.

4. Worm

A worm is malware capable of spreading between systems,
often by exploiting vulnerabilities or network-accessible services.

Unlike a traditional virus, a worm does not necessarily require a user to
manually execute an infected host file for every new infection.

Worm outbreaks can spread rapidly across vulnerable networks.

5. Trojan

A Trojan is malicious software that is presented or disguised
as something legitimate or useful.

Examples may include:

• A fake software installer
• A malicious document
• A counterfeit browser update
• A fake utility application

The user may believe the program is legitimate while the software performs
unauthorized activity after execution.

6. Spyware

Spyware is software designed to monitor users or collect
information without appropriate authorization.

Depending on its capabilities, spyware may attempt to collect information such
as browsing activity, credentials, personal information or other sensitive data.

7. Adware

Adware is software that displays or delivers advertising,
sometimes aggressively or without appropriate user consent.

Not all advertising-supported software is malicious. The security concern
arises when advertising behavior is deceptive, intrusive, unauthorized or
associated with other malicious functionality.

8. Ransomware

Ransomware is malware that can restrict access to systems or
data, commonly by encrypting files, and may demand payment from victims.

Ransomware can seriously affect business operations because it may impact
availability of important information and systems.

Ransomware is covered in greater detail in a later lesson in this module.

9. Rootkits

A rootkit is a collection of techniques or software intended
to maintain unauthorized privileged access while hiding malicious activity
or components.

Some rootkits target operating-system components or low-level system functions,
making detection and removal particularly challenging.

10. Botnets

A botnet is a collection of compromised devices that can be
controlled through malicious infrastructure or command-and-control mechanisms.

Compromised devices may be used for activities such as spam distribution,
credential attacks, data theft or distributed denial-of-service activity.

A device may become part of a botnet without its owner immediately realizing
that it has been compromised.

11. Keyloggers

A keylogger is software or hardware designed to record
keystrokes.

Malicious keyloggers may attempt to capture credentials, messages or other
sensitive information.

Security controls such as endpoint protection, application control,
multi-factor authentication and secure authentication practices can reduce
the impact of credential theft.

12. Fileless and Memory-Based Malware

Some attacks attempt to minimize the use of traditional executable files on
disk and instead abuse legitimate system tools or operate substantially in
memory.

This is sometimes described as fileless malware, although the
term can describe several different techniques.

Security teams may therefore need behavioral monitoring and endpoint telemetry
rather than relying exclusively on scanning files stored on disk.

13. Common Malware Delivery Methods

Malware can reach a victim through different channels.

• Malicious email attachments
• Malicious links
• Compromised websites
• Fake software installers
• Untrusted downloads
• Malicious advertisements
• Exploitation of vulnerable software
• Removable media
• Compromised accounts
• Supply-chain compromise

The delivery method is not necessarily the same as the malware type.
For example, a Trojan may be delivered through email while ransomware may
be delivered through a compromised account or vulnerable service.

14. Phishing as a Malware Delivery Method

Attackers may use deceptive messages to persuade users to open a malicious
attachment, visit a malicious website or install unsafe software.

This connects malware with social engineering and phishing, which will be
covered in detail in later lessons.

15. Exploiting Vulnerable Software

Malware can sometimes gain access by exploiting weaknesses in software,
operating systems, network services or applications.

This is why security updates and vulnerability management are important
defensive practices.

Organizations should maintain an inventory of systems and software, prioritize
important security updates and remove unsupported software where possible.

16. Malware Persistence

Some malware attempts to remain active after a computer is restarted.
This behavior is known as persistence.

Persistence techniques can involve operating-system mechanisms, scheduled
tasks, services, startup locations or other system features.

Security teams should investigate persistence carefully because removing one
malicious file may not eliminate all components of an infection.

17. Malware Command and Control

Some malware communicates with external infrastructure controlled by an
attacker. This infrastructure is often described as
command and control (C2).

C2 communication can allow compromised systems to receive instructions,
send information or download additional components.

Security monitoring may look for unusual network connections, suspicious DNS
requests, unexpected processes and abnormal communication patterns.

18. Common Signs of Malware Infection

Possible warning signs include:

• Unexpected system slowdowns
• Unknown applications or processes
• Unexpected browser behavior
• Unusual network traffic
• Repeated security alerts
• Unexpected files or configuration changes
• Disabled security software
• Unexpected account activity
• Frequent crashes
• Unexpected pop-ups
• Files becoming inaccessible or renamed

19. Malware Prevention

Malware prevention uses multiple layers of security.

• Keep operating systems updated.
• Update applications and browsers.
• Use reputable endpoint security software.
• Use strong authentication and multi-factor authentication.
• Limit administrator privileges.
• Download software from trusted sources.
• Be cautious with unexpected attachments and links.
• Maintain reliable backups.
• Segment important systems where appropriate.
• Monitor unusual activity.
• Train users about common attack techniques.

20. Least Privilege

The principle of least privilege means users and applications
should receive only the permissions required to perform legitimate tasks.

If malware runs under a highly privileged account, the potential impact can
be significantly greater.

Using standard user accounts where practical can reduce the consequences of
some malware infections.

21. Endpoint Protection

Endpoint protection can use several techniques to identify suspicious or
malicious activity.

Depending on the product, these may include:

• Signature-based detection
• Behavioral detection
• Heuristic analysis
• Reputation services
• Application control
• Exploit protection
• Endpoint detection and response

No single detection technique is perfect. Layered security is therefore
important.

22. Antivirus and Antimalware

Antivirus and antimalware technologies help identify and respond to malicious
software.

Modern endpoint security products can combine traditional malware signatures
with behavioral and cloud-assisted detection.

Security software should be maintained and monitored rather than installed
and then ignored.

23. Software Updates

Keeping software updated can reduce exposure to known vulnerabilities that
attackers may exploit.

Organizations should establish a process for:

• Identifying vulnerable software
• Prioritizing updates
• Testing important updates
• Deploying patches
• Verifying successful installation
• Handling unsupported systems

24. Backups and Malware Recovery

Reliable backups are an important defense against destructive malware,
including ransomware.

Backups should be:

• Regularly created
• Protected from unauthorized modification
• Separated from production systems where appropriate
• Tested through restoration exercises

A backup that has never been tested may not provide the expected recovery
capability.

25. Malware Detection and Investigation

When malware is suspected, investigators may examine:

• Running processes
• Network connections
• Recently created files
• System logs
• Security alerts
• Browser activity
• Authentication events
• Persistence mechanisms
• DNS activity

Evidence should be collected according to the organization’s incident-response
and forensic procedures.

26. Isolation During an Incident

If a device is suspected of being compromised, security teams may isolate it
from parts of the network to reduce potential spread or further unauthorized
communication.

Isolation procedures should follow the organization’s incident-response plan.
Unplanned actions can sometimes destroy useful evidence or interrupt critical
services.

27. Malware Analysis

Malware analysis is the process of studying malicious software
to understand its characteristics, behavior and impact.

Two broad approaches are:

Static Analysis

Static analysis examines malware without executing it. Analysts may inspect
file metadata, hashes, strings, headers and other characteristics.

Dynamic Analysis

Dynamic analysis observes malware behavior while it executes in a controlled
and isolated environment.

28. Malware Hashes

A cryptographic hash can provide a compact representation of a file’s contents.
Security teams can use hashes to compare files and identify known samples.

Common cryptographic hash functions encountered in cybersecurity include
SHA-256 and SHA-512.

A hash is not a complete malware-detection mechanism. Malware can be modified,
producing a different hash.

29. Simple PHP File Hash Example

The following PHP example calculates a SHA-256 hash of a file. It does not
execute the file.

<?php

$file = __DIR__ . '/sample-file.bin';

if ( is_file( $file ) ) {

	$hash = hash_file(
		'sha256',
		$file
	);

	echo 'SHA-256: ' .
		htmlspecialchars(
			$hash,
			ENT_QUOTES,
			'UTF-8'
		);

} else {

	echo 'File not found.';
}

This can be useful for authorized file-integrity checks and security analysis.

30. Malware Security Scenario

Imagine an employee reports that a workstation has suddenly become very slow
and is making unusual outbound network connections.

A security analyst should avoid immediately assuming that malware is responsible.

A structured investigation could include:

1. Confirm the reported symptoms.
2. Check endpoint security alerts.
3. Review running processes.
4. Inspect unusual network connections.
5. Review recent software and configuration changes.
6. Check relevant DNS activity.
7. Compare suspicious files with trusted security intelligence.
8. Determine whether isolation is appropriate.
9. Document evidence and actions.
10. Escalate according to incident-response procedures.

31. Malware and Security Monitoring

Security monitoring can help identify malware-related activity by correlating
events from multiple sources.

Examples include:

• Endpoint alerts
• Firewall logs
• DNS logs
• Authentication logs
• Proxy logs
• Application logs
• Network monitoring
• SIEM platforms

32. Malware and User Awareness

Technology alone cannot prevent every malware infection.

Users should understand how to recognize suspicious behavior, including:

• Unexpected attachments
• Urgent requests to install software
• Untrusted download websites
• Unexpected browser warnings
• Requests for passwords or authentication codes
• Suspicious removable media

Security awareness reduces the chance that a user unintentionally provides
malware with access to a system.

33. Malware Defense in Depth

A strong defensive architecture does not depend on a single control.

User Awareness
       |
       v
Email / Web Security
       |
       v
Endpoint Protection
       |
       v
Firewall / Network Controls
       |
       v
Monitoring / Detection
       |
       v
Incident Response
       |
       v
Backup / Recovery

34. Authorized Practical Exercise

Perform this exercise only on a computer or virtual machine that you own or
are explicitly authorized to examine.

Task 1

Open the operating system’s security or endpoint-protection interface and
identify the current malware-protection status.

Task 2

Identify whether automatic security updates are enabled.

Task 3

Review recent security alerts and determine whether any have been generated.
Do not execute suspicious files.

Task 4

Choose a harmless test file and calculate its SHA-256 hash using the PHP
example or another trusted hashing tool.

Task 5

Write a short report explaining the difference between a virus, worm, Trojan,
spyware, ransomware and botnet.

35. Malware Prevention Checklist

36. Review Questions

1. What is malware?
2. What does the term malware mean?
3. How can malware affect confidentiality?
4. How can malware affect integrity?
5. How can malware affect availability?
6. What is a computer virus?
7. What is a worm?
8. What is a Trojan?
9. What is spyware?
10. What is ransomware?
11. What is a rootkit?
12. What is a botnet?
13. What is a keylogger?
14. What are common malware delivery methods?
15. Why are software updates important for malware defense?
16. Why is least privilege useful?
17. What is the purpose of endpoint protection?
18. What is the difference between static and dynamic malware analysis?
19. Why should malware analysis be performed in a controlled environment?
20. Why are reliable backups important?
21. What are some signs that may justify investigating a possible malware infection?
22. Why should a suspicious symptom not automatically be classified as malware?

37. Key Takeaways

• Malware is malicious software designed to perform unauthorized or harmful activity.
• Malware can affect confidentiality, integrity and availability.
• Viruses, worms, Trojans, spyware, ransomware, rootkits and botnets are different malware categories.
• Malware can be delivered through email, websites, downloads, vulnerabilities and other channels.
• Software updates reduce exposure to known vulnerabilities.
• Endpoint security provides important malware-detection and response capabilities.
• Least privilege can reduce the impact of a compromised process or account.
• Backups are important for recovery from destructive malware.
• Security monitoring can help identify unusual malware-related behavior.
• Malware analysis should be performed in controlled and authorized environments.
• A suspicious symptom is an investigation clue, not automatic proof of infection.
• Effective malware defense requires multiple layers of security.

38. Conclusion

Malware represents a broad category of cybersecurity threats. Understanding
the major malware families, delivery methods, warning signs and defensive
controls gives cybersecurity professionals the foundation required to
investigate and respond to malicious software.

The most effective approach is layered: secure configuration, software
updates, endpoint protection, access control, network security, monitoring,
user awareness, incident response and reliable recovery mechanisms should
work together.

In the next lesson, we will examine another major cyber threat:
Phishing.