Malware Taxonomy: Viruses, Trojans, Ransomware and More

Malware is classified by its propagation mechanism, payload behaviour, and persistence strategy, and each category presents different investigative challenges. This topic maps the major malware families, their defining characteristics, and the typical artefacts they leave on infected systems.

Last updated: 24 Jun 2026

Malware taxonomy organises malicious software into named families based on three criteria: how it spreads (propagation mechanism), what it does once active (payload behaviour), and how it survives reboots and detection attempts (persistence strategy). The major families are viruses, worms, trojans, ransomware, spyware and adware, rootkits, and botnets, with hybrid specimens that combine traits from more than one family becoming increasingly common. For a cyber investigator, the taxonomy is not academic: each family leaves a characteristic pattern of artefacts on infected systems, and knowing which family you are dealing with tells you where to look and what evidence to preserve first.

Classifying malware correctly matters for both investigation and prosecution. The legal charge sheet, the choice of forensic tools, the scope of the search warrant, and the preservation priority all depend on understanding what the malware was designed to do. A ransomware incident and a banking trojan incident both involve malicious code on a Windows machine, but they call for different investigative sequences: ransomware demands immediate evidence preservation before decryption destroys artefacts, while a banking trojan demands network traffic capture and memory acquisition to recover credentials in transit.

The taxonomy has evolved as attackers have combined capabilities. Early viruses were purely propagating; they spread to cause damage or demonstrate capability. Modern attacks commonly deploy a dropper (trojan), which installs a rootkit (for concealment) and a bot client (for command-and-control), and may deploy ransomware as a final-stage payload after the attacker has already exfiltrated data. Understanding each component's role in that chain is the basis for reconstructing the attack timeline from forensic evidence.

Each malware family has a distinct propagation method, payload action, and persistence technique: matching the family to these three traits tells an investigator where to look for artefacts first.

By the end of this topic you will be able to:

Distinguish the major malware families by propagation mechanism, payload, and persistence strategy.
Identify the forensic artefacts each family characteristically leaves on Windows and Linux systems.
Explain how hybrid malware chains multiple family behaviours and describe the investigative sequence this demands.
Describe the cryptographic scheme used by modern ransomware and explain why decryption without the attacker's key is infeasible.
Name the primary legal provisions under which malware deployment is prosecuted in India, the US, and the UK.

Key terms

Propagation mechanism: The method by which malware copies itself to new hosts. Viruses attach to host files; worms exploit network services autonomously; trojans rely on user deception. The propagation mechanism determines the attack surface and the network-level artefacts visible during investigation.
Payload: The action the malware performs once active: data encryption (ransomware), credential theft (banking trojan), resource hijacking (cryptominer), or system destruction (wiper). The payload defines the harm and the type of evidence the victim needs to preserve.
Persistence mechanism: The technique malware uses to survive a reboot or user logout. Common methods include registry run keys, scheduled tasks, Windows services, cron jobs on Linux, and boot-sector modification. Persistence artefacts are often the most durable evidence on an infected system.
Command-and-control (C2): The channel through which an attacker sends instructions to malware on a compromised host and receives data back. C2 channels range from direct TCP connections to domain-generation algorithm (DGA) traffic, DNS tunnelling, and traffic over legitimate platforms. Network logs recording C2 traffic are primary evidence in most malware investigations.
Rootkit: Malware designed to hide its own presence by subverting the operating system's reporting functions. User-mode rootkits hook API calls; kernel-mode rootkits modify kernel data structures. Detection requires analysis from outside the infected OS, typically via bootable forensic media or hypervisor-based inspection.
Dropper: A malware component whose sole function is to deliver and install a secondary payload. The dropper itself may be a trojan, a malicious document, or a legitimate-looking installer. It commonly deletes itself after execution, leaving the secondary payload as the primary investigative target.

Viruses and worms: self-replicating malware

A virus is code that inserts a copy of itself into a host file (an executable, a document with macro support, or a boot sector) and relies on user action or file sharing to propagate. The host file must be executed for the virus to activate. File-infecting viruses append or prepend code to executables; macro viruses embed in office documents and run when the document is opened with macros enabled; boot-sector viruses overwrite the master boot record or volume boot record, running before the operating system loads. Each insertion type leaves specific artefacts: modified file hashes, anomalous file sizes, or boot-sector contents that do not match the baseline.

A worm requires no host file and no user action to spread. It is a standalone executable that exploits a vulnerability in a network service (a remote code execution flaw, a default credential, or an open share) to copy itself to the next host. The WannaCry worm (2017) exploited the EternalBlue vulnerability in Windows SMBv1 and infected hundreds of thousands of machines across 150 countries within days. The Conficker worm (2008) used multiple propagation methods simultaneously: MS08-067 (a Windows RPC vulnerability), weak network share passwords, and infected USB drives. Worm infections generate distinctive network artefacts: port-scanning traffic as the worm searches for new targets, outbound connection attempts on the exploited service port, and dropped copies of the worm binary in shared directories.

Polymorphic and metamorphic variants complicate detection. A polymorphic virus encrypts its body and changes the decryption stub with each copy, so the byte signature varies. A metamorphic virus rewrites its own code entirely between generations, with no fixed signature at all. Both evade signature-based antivirus but leave behavioural artefacts: the decryption routine executes before the payload, which appears as an anomalous code sequence in memory; metamorphic engines introduce structural patterns recognisable to heuristic analysis.

Trojans: deception-based malware

A trojan (formally, a trojan horse) disguises itself as legitimate software to persuade the user to execute it willingly. Unlike a virus, it does not self-replicate; unlike a worm, it does not exploit network vulnerabilities autonomously. Its propagation depends entirely on social engineering: the user is deceived into running a file that appears to be a game, a utility, a software crack, or a legitimate installer. Once executed, the trojan installs its payload (a keylogger, a backdoor, a bot client, or a downloader) and optionally presents the expected legitimate functionality to avoid suspicion.

Remote access trojans (RATs) give the attacker interactive control of the compromised machine: file system access, camera and microphone activation, keystroke logging, and the ability to deploy further tools. Banking trojans (such as Zeus, Dridex, and Emotet) target financial credentials by injecting malicious content into banking website sessions (web injection), redirecting transactions, or intercepting one-time passwords. Information stealers harvest browser-saved passwords, cookies, and cryptocurrency wallet files and exfiltrate them to the attacker.

Trojan artefacts on a Windows host typically include: a new or modified registry run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run or the equivalent HKLM path) pointing to the trojan binary; a scheduled task or Windows service entry; the binary itself in a user-writable directory such as %APPDATA% or %TEMP%; prefetch files confirming execution; and network connections in SIEM or firewall logs to the attacker's C2 infrastructure. Deleted files may be partially recoverable from the volume shadow copy or unallocated disk space.

Ransomware: encryption as a weapon

Ransomware encrypts victim files and demands payment for the decryption key. Modern ransomware uses a hybrid cryptographic scheme: the malware generates a unique AES-256 (or similar symmetric) key per victim, encrypts files with that key, then encrypts the symmetric key itself with the attacker's RSA or elliptic-curve public key. The attacker's matching private key is held on infrastructure outside the victim's reach. Without that private key or a flaw in the implementation, decryption is computationally infeasible. Victims are directed to a payment address, typically cryptocurrency, in an on-screen ransom note.

Double extortion ransomware, which became the dominant model after 2019, exfiltrates data before encrypting it. The attacker threatens to publish the stolen data if the ransom is not paid, creating pressure independent of whether the victim has backups. Triple extortion adds a DDoS component or targets the victim's customers and partners directly. From an investigative standpoint, double extortion means there are two incident types to investigate simultaneously: the encryption event and the prior data exfiltration, which may have occurred weeks earlier.

Ransomware investigations generate cryptocurrency tracing requirements. Ransom payments on public blockchains (Bitcoin, Monero less so) are visible on the ledger, and blockchain analytics firms track attacker wallets across victim incidents. Attribution links are established by clustering wallet addresses used across multiple attacks, connecting payment addresses to known ransomware-as-a-service (RaaS) infrastructure, and correlating on-chain flows with exchange know-your-customer data obtained via legal process.

Spyware, adware, and stalkerware

Spyware monitors user activity and exfiltrates information without the user's knowledge or consent. Keyloggers record keystrokes (capturing passwords, messages, and documents typed); screen capturers take periodic screenshots; form grabbers intercept form submissions before they are encrypted by HTTPS. Commercial spyware such as FinFisher and the NSO Group's Pegasus operate at a higher technical level, exploiting zero-day vulnerabilities to install themselves without any user interaction and concealing their presence using rootkit techniques. Pegasus has been documented on devices in multiple countries, with confirmed targets including journalists, lawyers, and human rights defenders.

Adware generates revenue by displaying unsolicited advertising, redirecting browser searches, or injecting ads into web pages. At the lower end it is a nuisance; at the higher end it modifies browser settings, installs browser extensions without consent, and exfiltrates browsing history. Stalkerware is spyware marketed for intimate partner surveillance. It is installed on the victim's device by a person with physical access and hides its presence from the device owner. Several antivirus vendors have added stalkerware detection to their products following advocacy from domestic abuse organisations.

Category	Primary action	Typical exfiltration target	Key forensic artefact
Keylogger	Records keystrokes	Passwords, messages	Log file in hidden directory; kernel hook in memory
Screen capturer	Periodic screenshots	Document contents, activity	Image files in temp directory; scheduled task or timer
Form grabber	Intercepts POST data	Login credentials	Browser hook; network traffic to C2
Commercial spyware	Zero-click install, full access	Communications, location, media	Anomalous process, modified kernel, unexpected network traffic
Stalkerware	Covert on-device install	Location, calls, messages	Hidden app with admin privileges; battery drain; MDM profile

Rootkits: hiding at the system level

A rootkit's defining function is concealment: it subverts the operating system's reporting mechanisms so that other malicious components (processes, files, network connections, registry entries) are hidden from standard tools and from the user. The level at which a rootkit operates determines both its capability and the technique required to detect it.

User-mode rootkits run with user-level privileges and hook userspace API calls (Windows Native API functions such as NtQuerySystemInformation or NtQueryDirectoryFile). When a tool calls the hooked function to list processes or files, the rootkit intercepts the result and removes its own entries before returning the list. User-mode rootkits are easier to implement and easier to detect: scanning from an account with higher privilege or from a bootable environment bypasses the hooks.

Kernel-mode rootkits run at ring 0 (the kernel's privilege level) and modify kernel data structures directly. The DKOM (Direct Kernel Object Manipulation) technique unlinks a process from the kernel's process list so it does not appear in any process enumeration, even from tools with administrator privileges, because the list itself has been altered. Driver-level rootkits load as signed or unsigned kernel drivers. Bootkit variants infect the master boot record or UEFI firmware and load before the OS, making them survive OS reinstalls. Detection of kernel-mode rootkits requires booting from trusted external media and analysing the disk offline, or using a virtual machine monitor (hypervisor) that sits below the infected OS and can inspect its memory state without trusting the OS.

Botnets, cryptominers, and the legal framework

A botnet is a network of compromised machines (bots or zombies) under centralised attacker control via a C2 channel. The attacker deploys a bot client on each victim machine, typically via a trojan or worm, and issues commands through the C2 infrastructure. Botnet uses include distributed denial-of-service (DDoS) attacks, spam and phishing campaigns, credential-stuffing attacks, and hosting infrastructure for further malware distribution. Historically, botnet C2 used dedicated IRC channels or HTTP-based control servers; modern botnets use domain generation algorithms (DGAs), peer-to-peer (P2P) architectures, and fast-flux DNS to make takedown more difficult.

Cryptominers (cryptojackers) hijack victim CPU and GPU resources to mine cryptocurrency for the attacker, generating revenue without the victim's consent. They are often less damaging in terms of data loss than other malware families but cause measurable performance degradation and electricity consumption. Wiper malware, at the opposite end of the payload spectrum, overwrites or deletes files with no recovery mechanism, often as sabotage by nation-state actors. The NotPetya wiper (2017), attributed to Russian state actors by multiple governments, caused an estimated $10 billion in damage globally by targeting Ukraine and spreading to multinational companies through supply-chain infection of accounting software.

The legal framework for malware-related offences varies by jurisdiction but converges on the same core prohibitions. In India, deploying malware is prosecuted under sections 43 and 66 of the Information Technology Act 2000, with cyberterrorism provisions under section 66F for attacks on critical infrastructure, read alongside offences under the Bharatiya Nyaya Sanhita 2023. In the United States, the Computer Fraud and Abuse Act (18 U.S.C. 1030) covers unauthorised access and damage to protected computers; ransomware deployment may also attract wire fraud and extortion charges. In the United Kingdom, the Computer Misuse Act 1990 (as amended by the Police and Justice Act 2006 and the Serious Crime Act 2015) covers unauthorised access, unauthorised modification, and supply of hacking tools. The Budapest Convention on Cybercrime (2001), ratified by over 60 states, provides the international framework that most of these national statutes implement, and its Article 24 on mutual legal assistance is the principal mechanism for cross-border evidence exchange in malware investigations.

Worked example

Investigating a hybrid ransomware-trojan incident

A company's file server shows encrypted files with a .locked extension and a ransom note. Tracing the incident from initial access through to the ransomware deployment.

The scenario: an employee received a phishing email containing a macro-enabled Word document. Opening it and enabling macros executed a VBA script that downloaded a trojan dropper. Over the following three weeks the trojan established persistence, communicated with C2 infrastructure, and eventually deployed ransomware across all network-connected drives. The investigative sequence follows the malware chain in reverse.

Preserve before touching. Acquire memory from all affected hosts before shutdown. Take forensic images of affected disks. Preserve network logs, firewall logs, and SIEM events before they roll over. Note timestamps in UTC.
Identify the ransomware family. Examine the ransom note format, file extension, and any embedded metadata. Cross-reference against public ransomware identification services (ID Ransomware, No More Ransom). Check whether a decryptor is available for the identified family.
Locate the ransomware binary. Search disk images for the executable: prefetch records, Windows event log entries (Event ID 4688: process creation), and Shimcache/Amcache entries confirm when the binary ran. The binary location (commonly %TEMP% or a user-writable path) is consistent with trojan-dropped payloads.
Trace back to the trojan dropper. The ransomware binary has a parent process recorded in memory or in process-creation event logs. Identify the dropper process. Recover the dropper binary from disk or carve it from the memory image. Analyse its network connections in firewall logs to identify the C2 IP addresses and domains.
Identify the initial access vector. Search email gateway logs for the phishing message. Recover the malicious document from email quarantine, user downloads folder, or disk carving. Check browser history and proxy logs for any download URLs. Prefetch and LNK files may confirm when the document was opened.
Map the persistence mechanism. Check registry run keys, scheduled tasks, and Windows services created in the period between initial infection and ransomware deployment. Each persistence entry is an artefact linking the trojan's presence to a specific timestamp.
Assess exfiltration. Review outbound network traffic volumes over the three-week dwell period. Large uploads to external IPs or cloud storage services during off-hours indicate data staging and exfiltration consistent with double-extortion ransomware. Correlate with file access logs if available.

Check your understanding

Question 1 of 4· 0 answered

Which of the following best distinguishes a worm from a virus?

Key Takeaways

Malware is classified by propagation mechanism, payload behaviour, and persistence strategy: viruses attach to host files, worms spread autonomously over networks, trojans rely on user deception, and ransomware encrypts data for extortion.
Modern ransomware uses a hybrid cryptographic scheme: symmetric encryption for file content, wrapped by the attacker's asymmetric public key. Without the attacker's private key or an implementation flaw, decryption is computationally infeasible.
Kernel-mode rootkits run at ring-0 privilege and can falsify the output of tools running within the infected OS. Forensic analysis requires booting from trusted external media or using a hypervisor-based approach that inspects the system from outside its own OS.
Hybrid attacks chain multiple malware families: a phishing email delivers a trojan dropper, which installs a rootkit for concealment, establishes botnet C2, and eventually deploys ransomware. Investigators must trace the chain in reverse from the visible payload back to the initial access vector.
Malware deployment is a criminal offence under India's Information Technology Act 2000 and Bharatiya Nyaya Sanhita 2023, the US Computer Fraud and Abuse Act, and the UK Computer Misuse Act 1990. The Budapest Convention on Cybercrime provides the international mutual-legal-assistance framework for cross-border investigations.

What is the difference between a virus and a worm?

A virus requires a host file and depends on user action to spread: the infected file must be executed or shared for the virus to propagate. A worm is self-contained and self-propagating; it exploits network services or vulnerabilities to copy itself to other systems without any user interaction. Both can carry destructive payloads, but their propagation mechanisms differ fundamentally, which affects where investigators look for artefacts.

How does ransomware typically encrypt victim files?

Most modern ransomware uses a hybrid cryptographic scheme. The malware generates a symmetric key (commonly AES-256) on the victim machine and uses it to encrypt files. The symmetric key is then encrypted with an asymmetric public key controlled by the attacker, so only the attacker's private key can recover it. The victim receives a ransom note with a payment address. Without the attacker's private key or a flaw in the implementation, decryption is computationally infeasible.

What forensic artefacts does a trojan typically leave?

Trojans commonly leave artefacts including new registry run keys or scheduled tasks for persistence, dropped executable or DLL files in user-writable directories, network connections to command-and-control infrastructure, prefetch records showing the trojan binary was executed, and event log entries corresponding to the process creation. Memory forensics may reveal injected code in legitimate processes if the trojan uses process injection.

What is a rootkit and why is it difficult to detect?

A rootkit is malware designed to hide its own presence and the presence of other malicious components by modifying operating system functions. User-mode rootkits hook API calls in userspace; kernel-mode rootkits modify kernel data structures or drivers and run with the highest privilege level. Because the infected OS itself is compromised, tools running on that OS may return falsified results. Detection typically requires booting from a clean external medium or using a hypervisor-based approach to inspect the system from outside its own OS.

Under which laws is deploying malware prosecuted in India, the US, and the UK?

In India, deploying malware is prosecuted under the Information Technology Act 2000 (sections 43, 66, and 66F for cyberterrorism) read with relevant provisions of the Bharatiya Nyaya Sanhita 2023. In the United States, the Computer Fraud and Abuse Act (18 U.S.C. 1030) is the primary federal statute. In the United Kingdom, the Computer Misuse Act 1990 (as amended) covers unauthorised access and modification. The Budapest Convention on Cybercrime (2001) provides the international framework that many of these national statutes implement.

Test yourself on Cyber Forensics with free, timed mocks.

Practice Cyber Forensics questions

Found this useful? Pass it along.

Spotted an error in this page? Report a correction or read our editorial standards.

Key Takeaways

Your journey to becoming a forensic professional starts here.