9 types of computer virus and how they do their dirty work

The human head loves to categorize points, and malware is no exception. We listed here at CSO have finished our section: our malware explainer breaks down malware based on how it spreads (self-propagating worms, viruses piggybacking on other code, or sneakily disguised Trojans) as nicely as by what it does to infected devices (rootkits, adware, ransomware, cryptojacking, and malvertising, oh my).

You can obtain a ton of this type of specialized taxonomy, and there’s absolutely utility to it. In specific, it can be helpful to differentiate unique forms of malware infection vectors rather than lumping anything alongside one another as a “virus,” even with common use of the term. But we can also place as well a great deal emphasis on these types of divisions.

“A good deal of the terminology utilized to explain malware in the 90s and early 00s is continue to technically correct, but perhaps fewer applicable than it once was,” suggests Jacob Ansari, Safety Advocate and Emerging Cyber Tendencies Analyst for Schellman, a world wide unbiased protection and privateness compliance assessor. “Though malware of the prior decades got installed on the goal technique and then ran by itself without having human intervention, most modern-day assault campaigns are operated by teams of men and women, what we normally call danger actors. Attackers nevertheless attempt to evade detection and persist irrespective of defenses, and make use of a range of programming or scripting languages to produce their hostile code.”

So we questioned Ansari and other security execs about how they crack down the classes of malware they deal with. In basic, we found that there are two distinctive perspectives on malware taxonomy: you can believe of how viruses do their dirty do the job (i.e., what they do to you), or about wherever they match into an ecosystem (i.e., what they do for an attacker). 

9 popular styles of computer virus

1. Macro viruses
2. Polymorphic viruses
3. Resident viruses
4. Boot sector viruses
5. Multipartite viruses
6. Droppers
7. Beacon/payload
8. Packers
9. Command and control

Virus types defined by what they do to you
If you want a fantastic viewpoint on the distinct kinds of malware, you could do even worse than converse to anyone who writes it for a residing. That is Dahvid Schloss’s occupation: he’s the taking care of lead for offensive stability at cybersecurity specialist providers business Echelon Chance + Cyber, where by he is effective on malware intended to emulate serious menace actors to execute command-and-control platforms on his firm’s adversarial emulation and purple team engagements. He broke down the unique styles of viruses he works with by their function.

Macro viruses. “This group is probably the most common malware system in the environment,” suggests Schloss. “Approximately 92% of external assaults start off with phishing, and macros are the main of the dilemma. A macro is an automatic execution of keystrokes or mouse actions that a software can do with out consumer interaction—typically, we’re chatting about Microsoft Word/Excel macros, which can automate repetitive duties on the worksheet or doc.”

Macros are an really popular malware style. “The shipping method is plausible, specifically when it appears do the job related,” claims Schloss. “Also, the coding language (Visible Fundamental, in Microsoft’s situation) is really simplistic. So, macro viruses minimize the amount of technological innovation skill essential to compose them.”

Lauren Pearce, incident reaction lead at cloud protection company Redacted, agreed. “We continue to see important hurt from unsophisticated malware,” she claims. “The uncomplicated Office doc macro reigns supreme as an initial an infection vector.”

Polymorphic viruses. “When the macro virus is the least difficult to code, this form [the polymorphic virus] would be the most complicated due to the virus remaining specifically what its name claims: polymorphic,” states Schloss. “Each individual time the code runs, it executes marginally otherwise, and typically every single time it moves to a new equipment, its code will be slightly unique.”

You really should handle all your little ones (or your enemies) similarly, but Schloss admits that “this category of viruses is my preferred, as it is intricate and is incredibly tricky to investigate and detect.”

Resident viruses. This is a significantly pernicious class: a disembodied virus that would not exist as section of a file. “The virus itself is really executing inside the RAM of the host,” states Schloss. “The virus code is not saved in the executable that called it as a substitute it is usually saved on a website-accessible internet site or storage container. The executable that phone calls the resident code is usually published as non-malicious by intent to prevent detection by an antivirus software.”

The time period resident virus indicates the existence of a non-resident virus, of study course. Schloss defines this as “a virus that is contained within the executable that is contacting it. These viruses most generally distribute by abusing enterprise providers.”

Boot sector viruses. “This category I like to connect with the ‘nation condition cocktail,'” Schloss points out. “These forms of viruses are meant to offer the risk actor with unrestricted and deep persistence. They will infect all the way down to the computer’s learn boot history (MBR), which means that even if you reimage your equipment, the virus will persist and will be ready to execute in just the memory of the host upon boot. These types of viruses are scarce to see outside the house of country-condition menace actors, and practically usually count on a zero-working day exploit to be able to attain the amount of the MBR or are unfold via bodily media these kinds of as contaminated USB or hard drives.”

Multipartite viruses. Although some malware developers may perhaps specialize, other individuals take an “all of the earlier mentioned” tactic, attacking almost everywhere all at after. “These sorts of viruses are usually the most difficult to have and offer with,” claims Schloss. “They will infect several sections of a technique, such as memory, files, executables, and even the boot sector. We see far more and much more viruses of this wide variety, and these kinds of viruses will distribute in no matter what way they can, normally implementing a number of methods to maximize unfold.”

Styles of malware outlined by what they do for the attacker

One more way of wondering about various malware you can expect to come across is how they suit into the more substantial picture of an total assault. Keep in mind what Schellman’s Ansari reported above: present day malware is deployed by teams, and the viruses themselves can be believed of as a crew as well. “Lots of malware strategies consist of an array of components, in some cases each and every formulated independently or even sourced from other menace actors,” Ansari suggests. He breaks down some of the distinct gamers:

Droppers. “This piece of malware is meant to fall other malware onto the infected process,” Ansari stated. “Victims could get contaminated with a dropper from a hostile url, attachment, download, or the like—and it normally does not persist immediately after dropping the next stage of malware.”

“Macro malware falls into the group of a dropper,” provides Redacted’s Pearce. “It’s malware manufactured for the sole purpose of downloading and executing added malware.”

Beacon/payload. These malware sorts are the following phase in the assault. “Often mounted by a dropper, a beacon or payload is the malware that alerts back to the risk actor its recently mounted means of access,” says Ansari. “From below, an attacker can accessibility the sufferer devices via the implies recognized by the beacon and access the system, the data it has, or other methods on the community.”

Packers. These elements bundle other components, making use of cryptographic approaches as a implies of evading detection. “Some innovative malware campaigns use a sequence of packers, nested like a stacking doll,” states Ansari. “Each is made up of a different packed item, right up until the closing payload is capable to execute.”

Command and manage. Each and every staff needs a leader, and that is the position command and regulate performs for these collaborative malware elements. “These programs, in some cases named C&C, CNC, or C2, work exterior of the victim’s environment and make it possible for the threat actor to talk with the other factors of the malware campaign put in on the focus on program,” states Ansari. “When legislation enforcement targets a menace actor, they frequently seize the command and command techniques as component of their initiatives to end the threat.”

Classifying laptop viruses

In the close, what ever taxonomy we use shouldn’t be overly rigid, but should as an alternative make it much easier to communicate essential info about cyberthreats. And that indicates tailoring your language for your viewers, states Ori Arbel, CTO of CYREBRO, a safety products and services service provider.

“If I’m producing for CISOs, they would imagine about it from a danger standpoint,” he states, “though the normal public would better recognize generally used names in the information. These virus categorizations are presented from the position of perspective of what will be most conveniently understood—but performing it that way would not automatically communicate the very best actions for protection industry experts to acquire. If I’m composing for a group o
f threat intelligence professionals, I would use conditions relevant to geolocation and the attacker’s drive alternatively than what the virus actually does.”

We will finish with 1 final way to categorize viruses, 1 that definitely only can make sense from the point of view of the virus hunters them selves: viruses that are worthy adversaries, and individuals that are not. “As a reverse engineer, I acquire enjoyment from the puzzle of reversing,” says Redacted’s Pearce. “Macros present a substantial danger to a network, but they are not notably fun to reverse. I take pleasure in reversing samples that use anti-evaluation procedures to actively battle from getting reversed. Malware may perhaps use anti-debugging methods that detect and reply to a debugger by using techniques these kinds of as look at summing or timing attacks. Use of anti-assessment approaches indicate a proficient malware writer and serve to maximize the volume of time in among detection of a sample and extraction of useful indicators to counter it.”

Just mainly because your adversaries are criminals does not signify you are not able to regard them for putting delight into their function.