39.1 What Is Malware – Types for Defenders
Malware = software designed to harm, spy, encrypt, or control systems without honest user intent. Types (Blue vocabulary):
| Type | Simple idea | Blue focus |
|---|---|---|
| Virus | Needs a host file; spreads when that file runs / is shared | Scan files; block autorun; least privilege |
| Worm | Self-spreads over network (often no user click) | Patch, segment, block lateral SMB/RDP |
| Trojan | Looks useful; hides payload (fake tool, cracked installer) | Reputation, allowlisting, signed software |
| Ransomware | Encrypts / locks; demands payment | Backups, EDR, least privilege, isolate |
| Spyware | Steals keystrokes, cookies, files | EDR, MFA, browser hardening |
| Adware | Aggressive ads / unwanted PUPs | Browser hygiene; remove PUPs |
| Rootkit | Hides itself / other malware deep in OS | Boot integrity, offline scan, reimage |
| Botnet | Many infected hosts obey a C2 (command and control) | DNS/egress filter; sinkhole; patch |
| Fileless | Lives in memory / scripts / legitimate tools (LOLBins) | Script logging, AMSI, EDR behaviour |
| Wiper | Destroys data (sometimes disguised as ransomware) | Offline backups; immutable copies; IR drills |
Thodkyaat: naav kam, behaviour jast – encrypt karto ka? Lateral jato ka? C2 boltoy ka? Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Delivers trojanised "free tool" / cracked installer | Block untrusted downloads; SmartScreen / reputation; allowlisting |
| Uses worm-style lateral after foothold | Network segmentation; patch critical SMB/RDP bugs; EDR lateral alerts |
| Prefers fileless PowerShell / WMI to dodge old AV | Script block logging; AMSI; EDR behaviour rules; Constrained Language Mode where fit |
Ravindra Bagale's Tip
Students say "virus = all malware". Be precise in interviews: a virus infects a host file, a worm spreads by itself, a trojan pretends to be useful, ransomware encrypts and extorts. Exact definitions > scary stories. Remember this.
Ravindra Bagale's Tip – मराठी
Students "virus = सगळे malware" म्हणतात. Interview मध्ये clear बोला: virus host file ला, worm स्वतः पसरतो, trojan उपयोगी असल्याचे भासवतो, ransomware encrypt/extort. Exact definition > भीतीदायक गोष्टी. हे लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "virus = सारा malware". Interview में clear बोलो: virus host file को, worm खुद फैलता है, trojan उपयोगी होने का दिखावा करता है, ransomware encrypt/extort. Exact definition > डरावनी कहानियाँ. यह याद रखो.
Lab
Notes madhe 10-row table: type | one-line def | one Blue control. Fictional Sahyadri Traders Pune – Shraddha Bagale (accounts) cracked "PDF merger" install keli. Kontya type chi suspicion? 5 sentences liha (trojan / PUP path).
Real incident: WannaCry (2017)
WannaCry was a worm-like ransomware outbreak that spread widely using a Windows SMB vulnerability (EternalBlue-class). Public reporting (national CERTs, Microsoft, major outlets) stressed unpatched systems and rapid east-west spread. Defence theme: timely patching, network segmentation, disable unused SMBv1, backups that ransomware cannot reach. Source: Microsoft security response and CERT advisories (verify current pages).