api: YAML JSON TOON Database
version: 1.0.0
format: json
dataset:
  slug: malware-types
  title: Malware Types
  description: Common categories of malicious software.
  summary: "The main families of malicious software, each with a description and its typical delivery route: viruses, worms, trojans, ransomware, spyware, adware and rootkits, plus botnets, keyloggers, fileless malware and other types that shape incident-response vocabulary."
  use_when[2]: You need consistent names when writing an incident report or training material.,You are matching a malware family to the controls that typically stop its delivery.
  caveats[2]: "Real malware often combines several behaviors, and vendors name families inconsistently.","Delivery columns describe typical routes, not the only ones."
  related[3]: network-security-devices,common-vulnerabilities-owasp,authentication-factors
  category: Cybersecurity
  category_slug: cybersecurity
  tags: "security,malware,threats"
  view_count: 0
  entry_count: 15
  fields[3]{section,field,type,example}:
    data,type,string,Virus
    data,description,string,Malware that attaches to legitimate programs an…
    data,delivery,string,Infected files
data[15]{type,description,delivery}:
  Virus,Malware that attaches to legitimate programs and spreads when executed.,Infected files
  Worm,Self-replicating malware that spreads across networks.,Network exploits
  Trojan,Malware disguised as legitimate software.,Social engineering
  Ransomware,Encrypts files and demands payment for decryption.,"Phishing, exploits"
  Spyware,Secretly monitors user activity.,Bundled software
  Adware,Displays unwanted advertisements.,Bundled software
  Rootkit,Hides malware presence deep in the operating system.,Exploits
  Botnet,"A network of compromised machines controlled remotely, used for DDoS, spam or proxying.","Malware infections of many hosts, exposed services"
  Keylogger,Records keystrokes to steal credentials and other input.,"Trojans, malicious attachments, compromised software"
  Backdoor,Provides covert remote access that bypasses normal authentication.,"Trojans, supply-chain compromise, post-exploitation implants"
  Fileless Malware,"Runs in memory or through built-in tools such as scripting engines, leaving little on disk.","Phishing, exploited services, living-off-the-land techniques"
  Logic Bomb,Malicious code that triggers on a condition such as a date or a deleted account.,"Insider planting, trojans"
  Cryptojacker,Uses a victim's compute to mine cryptocurrency without consent.,"Malicious scripts, compromised servers and containers"
  Wiper,Destroys data or systems rather than holding them for ransom.,"Targeted intrusions, spread through networks"
  Dropper / Loader,A small program whose job is to install or fetch the main payload.,"Phishing attachments, malicious downloads"