{
    "api": "YAML JSON TOON Database",
    "version": "1.0.0",
    "format": "json",
    "dataset": {
        "slug": "malware-types",
        "title": "Malware Types",
        "description": "Common categories of malicious software.",
        "summary": "The main families of malicious software, each with a description and its typical delivery route: viruses, worms, trojans, ransomware, spyware, adware and rootkits, plus botnets, keyloggers, fileless malware and other types that shape incident-response vocabulary.",
        "use_when": [
            "You need consistent names when writing an incident report or training material.",
            "You are matching a malware family to the controls that typically stop its delivery."
        ],
        "caveats": [
            "Real malware often combines several behaviors, and vendors name families inconsistently.",
            "Delivery columns describe typical routes, not the only ones."
        ],
        "related": [
            "network-security-devices",
            "common-vulnerabilities-owasp",
            "authentication-factors"
        ],
        "category": "Cybersecurity",
        "category_slug": "cybersecurity",
        "tags": "security,malware,threats",
        "view_count": 0,
        "entry_count": 15,
        "fields": [
            {
                "section": "data",
                "field": "type",
                "type": "string",
                "example": "Virus"
            },
            {
                "section": "data",
                "field": "description",
                "type": "string",
                "example": "Malware that attaches to legitimate programs an…"
            },
            {
                "section": "data",
                "field": "delivery",
                "type": "string",
                "example": "Infected files"
            }
        ]
    },
    "data": [
        {
            "type": "Virus",
            "description": "Malware that attaches to legitimate programs and spreads when executed.",
            "delivery": "Infected files"
        },
        {
            "type": "Worm",
            "description": "Self-replicating malware that spreads across networks.",
            "delivery": "Network exploits"
        },
        {
            "type": "Trojan",
            "description": "Malware disguised as legitimate software.",
            "delivery": "Social engineering"
        },
        {
            "type": "Ransomware",
            "description": "Encrypts files and demands payment for decryption.",
            "delivery": "Phishing, exploits"
        },
        {
            "type": "Spyware",
            "description": "Secretly monitors user activity.",
            "delivery": "Bundled software"
        },
        {
            "type": "Adware",
            "description": "Displays unwanted advertisements.",
            "delivery": "Bundled software"
        },
        {
            "type": "Rootkit",
            "description": "Hides malware presence deep in the operating system.",
            "delivery": "Exploits"
        },
        {
            "type": "Botnet",
            "description": "A network of compromised machines controlled remotely, used for DDoS, spam or proxying.",
            "delivery": "Malware infections of many hosts, exposed services"
        },
        {
            "type": "Keylogger",
            "description": "Records keystrokes to steal credentials and other input.",
            "delivery": "Trojans, malicious attachments, compromised software"
        },
        {
            "type": "Backdoor",
            "description": "Provides covert remote access that bypasses normal authentication.",
            "delivery": "Trojans, supply-chain compromise, post-exploitation implants"
        },
        {
            "type": "Fileless Malware",
            "description": "Runs in memory or through built-in tools such as scripting engines, leaving little on disk.",
            "delivery": "Phishing, exploited services, living-off-the-land techniques"
        },
        {
            "type": "Logic Bomb",
            "description": "Malicious code that triggers on a condition such as a date or a deleted account.",
            "delivery": "Insider planting, trojans"
        },
        {
            "type": "Cryptojacker",
            "description": "Uses a victim's compute to mine cryptocurrency without consent.",
            "delivery": "Malicious scripts, compromised servers and containers"
        },
        {
            "type": "Wiper",
            "description": "Destroys data or systems rather than holding them for ransom.",
            "delivery": "Targeted intrusions, spread through networks"
        },
        {
            "type": "Dropper / Loader",
            "description": "A small program whose job is to install or fetch the main payload.",
            "delivery": "Phishing attachments, malicious downloads"
        }
    ]
}