Loading module…
Loading module…
Module 1 of 6
This course teaches malware analysis from the defender's and analyst's point of view — how to understand malicious software in order to detect it, respond to it, and defend against it. It explains how malware works at the level a defender needs, and it does not provide instructions for creating malware.
Malware — malicious software — is the weaponized code that turns an intrusion into damage: the ransomware that encrypts your files, the infostealer that harvests your passwords, the backdoor that gives an attacker lasting control. To defend against it, an analyst must first be able to classify it, because classification is not academic labeling — it is the act of determining what a piece of malware does, and what it does dictates how you detect it, how much damage it can cause, and how you respond. A defender who can look at a threat and correctly place it — "this is an infostealer with a persistence mechanism, delivered by a loader" — already knows most of what they need to do about it, because the classification carries the behavior, and the behavior carries the defense. This module builds the taxonomy that makes the rest of the course possible: the organized way of thinking about the kinds of malware and what distinguishes them.
The purpose of malware classification is not to memorize names but to reason about behavior and defense, because malware of the same functional type behaves the same way and is defended against the same way regardless of its specific name — so classification is the bridge from an unknown sample to a known response. When a defender encounters a new threat, the specific malware may be unfamiliar, but if they can classify it — this is ransomware, this is an infostealer, this is a rootkit — they immediately inherit a large body of knowledge about how that type operates, how it is detected, and how it is countered. Classification is a compression of experience: everything the security community has learned about a category applies to any new member of it, so placing a sample in its category is how a defender applies collective knowledge to an individual threat.
This is why the taxonomy is organized around function rather than around vendors' product names or malware "family" names. Family names (the specific names given to particular malware strains) are useful for tracking and intelligence, but they do not tell you what to do — two strains with different names may be functionally identical, and knowing the name without knowing the function is knowing nothing actionable. Function, by contrast, is directly tied to defense: ransomware's function (encrypting data for extortion) dictates that backups are the primary defense; an infostealer's function (harvesting credentials) dictates that credential rotation and monitoring are the response; a rootkit's function (hiding at a deep level) dictates the detection challenge and the rebuild-not-clean response. Throughout this course, then, the operative question about any malware is what does it do? — because the answer to that question is simultaneously the classification and the beginning of the defense. A defender who thinks in functional categories can meet a threat they have never seen before and still know how to fight it, because they recognize what kind of thing it is. That transfer — from category knowledge to individual response — is the entire value of taxonomy.
Key Insight: Classify malware by function, not name, because same-function malware behaves and is defended the same way regardless of its specific name — classification compresses the community's collective experience and applies it to an unknown sample. Family names track strains but do not tell you what to do; function is directly tied to defense (ransomware → backups, infostealer → credential rotation, rootkit → rebuild). The operative question about any malware is always "what does it do?"
The most important organizing distinction in all of malware taxonomy is between propagation — how the malware spreads and arrives — and payload — what it does once it is running — because these are independent dimensions, and separating them is what lets you reason clearly about a threat that combines a spreading method with a malicious function. A single piece of malware has both: it must get onto systems somehow (propagation), and it must do something harmful once there (payload). The classic malware type-names (virus, worm, trojan) actually describe propagation — how the malware spreads — while the harmful functions (ransomware, spyware, backdoor) describe payload — what it does. Conflating the two is a common confusion, and keeping them separate is the key to a clear taxonomy.
The independence of the two axes is the crucial point, because it means they combine freely: any propagation method can carry any payload. A worm (self-spreading propagation) can carry a ransomware payload — spreading itself across a network and encrypting each machine it reaches, which is exactly how the most devastating ransomware outbreaks worked. A trojan (disguised propagation) can carry an infostealer payload — a program that looks legitimate but harvests credentials once run. The same ransomware payload can be delivered by a worm, a trojan, or a manual attacker; the same worm propagation can carry ransomware, a botnet agent, or a wiper. So describing a threat fully means naming both dimensions: how it spreads and what it does. This separation is not pedantry — it directly shapes defense, because the two axes are defended differently. Propagation is countered by controlling how malware arrives and spreads (email filtering, patching the vulnerabilities worms exploit, segmentation to limit spread — the network-defense course). Payload is countered by limiting what malware can do once running and recovering from its effects (least privilege, backups against ransomware, monitoring for exfiltration). A complete defense addresses both axes, and a clear analysis always distinguishes them: when you meet a threat, ask separately how it got here and how it spreads, and what it does now that it is here — because those two questions have two different sets of answers and two different sets of defenses.
Key Insight: The master distinction is propagation (how malware spreads and arrives) vs payload (what it does once running) — independent dimensions that combine freely: any propagation can carry any payload (a worm can carry ransomware; a trojan can carry an infostealer). The classic names (virus/worm/trojan) describe propagation; the harmful functions (ransomware/spyware/backdoor) describe payload. They are defended differently — propagation by controlling arrival and spread, payload by limiting capability and recovering — so a complete analysis and defense addresses both.
The propagation axis has three classic types plus a modern delivery vocabulary, and each describes a distinct mechanism of arrival and spread that a defender must understand because each is countered differently. A virus is malware that attaches itself to a legitimate file or program and spreads when that host file is run or shared — it cannot spread on its own; it needs the infected host to be executed or copied, like a biological virus needing a cell. Viruses were the dominant early form and require a carrier; their defense centers on scanning files and controlling what runs. A worm is malware that spreads by itself, without needing a host file or user action, by exploiting vulnerabilities or using network connections to copy itself from machine to machine autonomously. The worm's self-propagation is what makes it so dangerous: it can spread across a whole network at machine speed with no human involvement, which is why worm outbreaks can be explosive. Worms are countered by patching the vulnerabilities they exploit and by segmentation that limits how far they can spread (the network-defense course's blast-radius reduction).
A trojan (Trojan horse) is malware disguised as something legitimate, which the user is tricked into running themselves — it does not spread automatically or infect files; it relies on deception to get the user to execute it, exactly like the mythological horse. Trojans are the propagation type most tied to the human layer (social engineering), because their whole method is convincing a person to run them, so their defense centers on user awareness and controlling what users can run. Beyond these three classic types, modern malware analysis uses a delivery vocabulary for the components that get malware onto a system: a dropper is a program whose job is to deliver and install other malware (it "drops" the real payload); a loader is similar, fetching and running additional malware, often from the internet, so the initial file is small and innocuous while the real payload arrives later; and an exploit is the use of a vulnerability to gain the initial execution that lets malware run at all. This delivery vocabulary matters because modern attacks are staged (Section 6): the thing that first arrives is often just a small loader whose only job is to bring in the real malware, which means the initial artifact a defender sees may reveal little about the ultimate payload. Recognizing propagation and delivery mechanisms tells a defender how a threat arrives and spreads — the first half of understanding it, and the half that determines how to stop it from getting in and getting around.
Key Insight: Propagation has three classic types plus delivery components. Virus: attaches to a host file, spreads only when that file runs or is shared (needs a carrier). Worm: spreads by itself across networks by exploiting vulnerabilities, at machine speed with no user action (countered by patching and segmentation). Trojan: disguised as legitimate so the user runs it themselves (the human-layer/social-engineering type). Delivery vocabulary: droppers install other malware, loaders fetch the real payload later (so the first artifact reveals little), exploits provide the initial execution. How a threat arrives and spreads determines how to stop it entering and moving.
The payload axis — what the malware actually does once running — is where the harm lives, and knowing the major payload types is knowing the range of damage malware can cause and therefore the range of defenses and responses required. Several payload types are foundational. Ransomware encrypts the victim's data (or locks their systems) and demands payment for restoration — its function is extortion through denied access, which makes backups the primary defense (Module 5 covers its architecture in depth). Spyware and infostealers covertly gather information — an infostealer specifically harvests credentials, financial data, session tokens, and other valuable data from an infected device (the source of the stealer logs from the dark-web course), and its function is theft of information, defended by credential protection and monitoring. Remote-access trojans (RATs) and backdoors give the attacker ongoing remote control of the infected system — their function is persistent access, turning the victim's machine into something the attacker operates at will, which is why they are so dangerous and why detecting and removing them is a priority.
Other payloads complete the range. Rootkits are malware designed to hide their own presence (and often other malware) at a deep level of the system, so their function is concealment and persistence (Section 5), making them especially hard to detect and remove. Botnet agents turn the infected machine into part of a network of compromised machines (a botnet) controlled by the attacker for coordinated tasks — sending spam, launching denial-of-service attacks, mining cryptocurrency — so their function is conscription of the machine's resources. Wipers destroy data outright, with no ransom and no recovery — their function is pure destruction, often for sabotage, and they are among the most damaging because there is nothing to pay and nothing to restore. Cryptominers hijack the machine's computing power to mine cryptocurrency for the attacker — their function is theft of computing resources, less immediately destructive but a persistent drain. And adware and similar forcibly display advertising or redirect the user — the least harmful category but still an unwanted compromise. The reason to know these types is direct: the payload determines both the harm and the response. Ransomware means restore from backups; an infostealer means rotate credentials and hunt for what was taken; a RAT means eradicate the access and rebuild; a wiper means invoke disaster recovery. Identifying the payload is identifying what the malware is doing to you and therefore what you must do about it.
Key Insight: Payload types define the harm and the response: ransomware (encrypts/locks for extortion → backups), spyware/infostealers (harvest credentials, financial data, session tokens → credential protection and monitoring), RATs/backdoors (persistent remote control → eradicate and rebuild), rootkits (hide their presence deeply → hard detection, rebuild), botnet agents (conscript the machine for spam/DoS/mining), wipers (destroy data outright for sabotage → disaster recovery), cryptominers (steal computing power), and adware. Identifying the payload identifies what the malware is doing to you and what you must do about it.
Beyond propagation and payload, two cross-cutting properties appear across many malware types and are central to how dangerous a piece of malware is: persistence (how it survives) and stealth (how it hides) — and understanding their mechanisms is essential because they determine whether malware can be easily removed or becomes a lasting, invisible problem. Persistence is the malware's ability to survive events that would otherwise remove it — a reboot, a user logout, sometimes even a partial cleanup. Malware achieves persistence by embedding itself where the system will automatically run it again: configuring itself to launch at startup, installing itself as a system service, or hooking into legitimate processes that run regularly. The mechanism matters to a defender because it is the reason "just restart it" or "just delete the file" often fails — a persistent piece of malware has arranged to reinstall or relaunch itself, so removing it requires finding and eliminating the persistence mechanism, not just the running copy. This is why the eradication phase of incident response (network-defense course) insists on thoroughness: a missed persistence mechanism means the malware returns.
Stealth is the malware's ability to avoid detection — by security software, by the user, and by an analyst. Malware achieves stealth through several mechanisms worth understanding. It may hide its files and processes (the rootkit function, operating at a deep enough level to make itself invisible to normal inspection — a rootkit can intercept the system's own reporting so that when you ask "what is running?", it removes itself from the answer). It may be fileless, operating only in memory without writing a file to disk, so that file-scanning detection has nothing to find — an increasingly common technique precisely because it defeats the traditional file-based defenses. It may obfuscate or encrypt its own code so that signatures cannot match it (the evasion of the network-defense IDS course) and analysts cannot easily read it. And it may detect analysis — recognizing when it is running in a sandbox or being examined and altering its behavior to appear benign (Module 3 covers this). The reason persistence and stealth are treated as cross-cutting properties rather than types is that they can attach to almost any payload: ransomware, infostealers, RATs, and botnet agents all benefit from persisting and hiding, and the most dangerous malware combines a harmful payload with strong persistence and strong stealth. A defender assessing a threat must therefore ask not only what it does and how it spreads, but how it survives and how it hides — because those two properties determine how hard it will be to detect and to remove, which is often the difference between a quick cleanup and a deep, damaging compromise.
Key Insight: Two cross-cutting properties determine how dangerous malware is: persistence (surviving reboots/logout/cleanup by embedding where the system re-runs it — startup entries, services, process hooks; the reason deleting the file often fails and eradication must be thorough) and stealth (avoiding detection by hiding files/processes as a rootkit, being fileless/memory-only to defeat file scanning, obfuscating code to defeat signatures, and detecting analysis to appear benign). Both attach to almost any payload, and the most dangerous malware combines a harmful payload with strong persistence and stealth. Always ask how a threat survives and hides, not just what it does.
A defender must update the mental image of malware from a single self-contained program to the modern reality: malware is typically modular and multi-stage — assembled from components delivered in sequence — and this structure, which mirrors the cybercrime economy from the dark-web course, changes how malware is analyzed and defended. The old model was a single file that did everything. The modern model is a chain: an initial small component (a loader or dropper, Section 3) arrives first, its only job being to establish a foothold and fetch the next stage; that stage may fetch further components; and the actual payload arrives late, downloaded and run only after the earlier stages have prepared the ground. This staging is deliberate and serves the attacker in several ways. It keeps the initial artifact small and innocuous (a tiny loader is easier to slip past defenses than a full malware suite), it lets the attacker decide the payload after seeing what they have compromised (fetch ransomware if the target is valuable, an infostealer otherwise), and it makes the malware flexible and updatable (the components can be swapped without redelivering the initial foothold).
This modularity connects directly to the malware-as-a-service economy: the components are often built by different specialists and combined, exactly as the cybercrime-as-a-service module described — a loader from one source, a payload bought from another, delivered through infrastructure rented from a third. Malware is a supply chain, not a single artifact. The defensive implications are significant and worth drawing out. First, the initial artifact reveals little: catching a loader tells you an attack is underway but not necessarily what the ultimate payload will be, so analysis must consider the whole chain, not just the first file. Second, detection has multiple opportunities: because the attack unfolds in stages over time, each stage (the loader arriving, the fetch of the next stage, the payload executing) is a chance to detect and interrupt — which connects to the attack-path chokepoints of the threat-modeling course. Third, the network is part of the malware: because stages are fetched over the network, network monitoring (the network-defense course) can catch the fetches and the command-and-control that staged malware depends on, even when the files themselves are stealthy. The modern defender therefore thinks of a malware infection not as "a bad file was run" but as "a multi-stage operation is unfolding," which reframes both analysis (understand the whole chain) and defense (multiple interruption points across the stages). Seeing malware as modular and staged is seeing it accurately — and it is what connects malware analysis to the systems view that runs through this whole curriculum.
Key Insight: Modern malware is modular and multi-stage — a small loader/dropper arrives first and fetches later stages, with the real payload downloaded late — mirroring the malware-as-a-service supply chain (components from different specialists combined). This lets the initial artifact stay small and innocuous, lets the attacker choose the payload after seeing the target, and makes the malware updatable. Defensively: the first artifact reveals little (analyze the whole chain), each stage is a detection opportunity, and the network is part of the malware (staged fetches and C2 are catchable by network monitoring). See an infection as an unfolding multi-stage operation, not a single bad file.
Pulling the module together, classification is the foundation of malware defense because the type of malware determines its behavior, and its behavior determines the detection and response — so accurate classification is the first and most consequential analytic act, from which the right defense follows. Everything in this module serves that chain: propagation type tells you how it arrives and spreads (and therefore how to stop entry and limit spread), payload type tells you what harm it does (and therefore what response and recovery it requires), and the cross-cutting properties of persistence and stealth tell you how hard it will be to detect and remove (and therefore how thorough your eradication must be). A defender who can place a threat on all these dimensions — this is a worm-propagated ransomware with strong persistence, or this is a trojan-delivered infostealer that is fileless and stealthy — has already derived most of the defensive response from the classification itself.
This is why malware analysis (the subject of the rest of the course) begins with and constantly returns to classification. The analytic techniques you will learn — static analysis (Module 2), behavioral analysis (Module 3), reverse engineering (Module 4) — are all, in large part, methods for determining a sample's classification: what it does, how it spreads, how it persists, how it hides. And the applications — understanding ransomware (Module 5), hunting for malware (Module 6) — all rest on knowing what type of thing you are dealing with. The systems-thinking connection that unifies this curriculum applies here too: malware is not a random collection of bad programs but a structured space of functional types, and understanding the structure lets a defender reason about any individual member of it, including ones never seen before. Just as the threat-modeling course taught you to reason about adversaries by category, and the network-defense course taught you to reason about attacks by their stage, malware taxonomy teaches you to reason about malicious code by its function — so that a new, unknown sample is not a mystery but a member of a known category whose behavior and defense you already understand. That is the power classification gives a defender: it turns the endless, ever-changing flood of specific malware into a finite, comprehensible set of types, each with known behavior and known defenses, so that keeping up with malware becomes a matter of classifying the new against the understood rather than starting from zero with every threat.
Key Insight: Classification is the foundation of malware defense because type determines behavior and behavior determines detection and response — so placing a sample on every dimension (propagation, payload, persistence, stealth) derives most of the defense from the classification itself. The analytic techniques of the course (static, behavioral, reverse engineering) are largely methods for determining classification. Taxonomy turns the endless flood of specific malware into a finite set of known functional types, so a new sample is not a mystery but a member of a category whose behavior and defense you already understand.
You can now classify malware by what it does. The rest of the course is about how you determine that classification and what to do with it — the analytic techniques. The next module begins with the first and safest: static analysis, examining a malware sample without running it. By inspecting the file itself — its structure, its contents, its clues — an analyst can learn a great deal about what a sample is and does before ever letting it execute, which is both the starting point of analysis and the safest one. It is how you begin to answer "what does it do?" for a specific, unknown sample in front of you.