api: YAML JSON TOON Database
version: 1.0.0
format: yaml
dataset:
  id: 2845
  slug: malware-types
  title: Malware Types
  description: Common categories of malicious software.
  summary: "The main families of malicious software, each with a description and its typical delivery route: viruses, worms, trojans, ransomware, spyware, adware and rootkits, plus botnets, keyloggers, fileless malware and other types that shape incident-response vocabulary."
  use_when:
    - You need consistent names when writing an incident report or training material.
    - You are matching a malware family to the controls that typically stop its delivery.
  caveats:
    - Real malware often combines several behaviors, and vendors name families inconsistently.
    - Delivery columns describe typical routes, not the only ones.
  related:
    - network-security-devices
    - common-vulnerabilities-owasp
    - authentication-factors
  entry_count: 15
  fields:
    - section: data
      field: type
      type: string
      example: Virus
    - section: data
      field: description
      type: string
      example: Malware that attaches to legitimate programs an…
    - section: data
      field: delivery
      type: string
      example: Infected files
  category: Cybersecurity
  category_slug: cybersecurity
  tags: security,malware,threats
  view_count: 47
  created_at: 1793403093
  updated_at: 1793403093
data:
  - type: Virus
    description: Malware that attaches to legitimate programs and spreads when executed.
    delivery: Infected files
  - type: Worm
    description: Self-replicating malware that spreads across networks.
    delivery: Network exploits
  - type: Trojan
    description: Malware disguised as legitimate software.
    delivery: Social engineering
  - type: Ransomware
    description: Encrypts files and demands payment for decryption.
    delivery: Phishing, exploits
  - type: Spyware
    description: Secretly monitors user activity.
    delivery: Bundled software
  - type: Adware
    description: Displays unwanted advertisements.
    delivery: Bundled software
  - type: Rootkit
    description: Hides malware presence deep in the operating system.
    delivery: Exploits
  - type: Botnet
    description: A network of compromised machines controlled remotely, used for DDoS, spam or proxying.
    delivery: Malware infections of many hosts, exposed services
  - type: Keylogger
    description: Records keystrokes to steal credentials and other input.
    delivery: Trojans, malicious attachments, compromised software
  - type: Backdoor
    description: Provides covert remote access that bypasses normal authentication.
    delivery: Trojans, supply-chain compromise, post-exploitation implants
  - type: Fileless Malware
    description: Runs in memory or through built-in tools such as scripting engines, leaving little on disk.
    delivery: Phishing, exploited services, living-off-the-land techniques
  - type: Logic Bomb
    description: Malicious code that triggers on a condition such as a date or a deleted account.
    delivery: Insider planting, trojans
  - type: Cryptojacker
    description: Uses a victim's compute to mine cryptocurrency without consent.
    delivery: Malicious scripts, compromised servers and containers
  - type: Wiper
    description: Destroys data or systems rather than holding them for ransom.
    delivery: Targeted intrusions, spread through networks
  - type: Dropper / Loader
    description: A small program whose job is to install or fetch the main payload.
    delivery: Phishing attachments, malicious downloads