MBCProject-mbc-markdown/xample-malware/malware-types.md

Malware Types

Many of the types and descriptions were taken from the STIX 2.1 Malware Type open vocabulary [1].

Type	Description	Malware Corpus
adware	Any software that is funded by advertising. Adware may also gather sensitive user information from a system. [1]	Geneio, SearchAwesome
backdoor	A malicious program that allows an attacker to perform actions on a remote system, such as transferring files, acquiring passwords, or executing arbitrary commands [2].	CHOPSTICK, CozyCar, GoBotKR, Heriplor, Hupigon, SYNful Knock
bootkit	A malicious program that targets the Master Boot Record of the target computer. [1]	Mebromi
bot/botnet	A program that resides on an infected system, communicating with and forming part of a botnet. The bot may be implanted by a worm or Trojan, which opens a backdoor. The bot then monitors the backdoor for further instructions. [1]	BlackEnergy, CozyCar, Drovorub, EvilBunny, Gamut (spambot), GoBotKR, Kovter (click-fraud), Kraken, Mazar BOT
ddos	A program that is used to perform a distributed denial of service attack. [1]	BlackEnergy
downloader	A small trojan file programmed to download and execute other files, usually more complex malware. [1]	Matanbuchus, YiSpecter
dropper	A type of trojan that deposits an enclosed payload (generally, other malware) onto the target computer. [1]	CozyCar, UP007, TEARDROP
exploit-kit	A software toolkit to target common vulnerabilities.
information-stealer	Malware that steals and exfiltrates information.	Redhip, Romberik, Snake
keylogger	A type of malware that surreptitiously monitors keystrokes and either records them for later retrieval or sends them back to a central collection point.[1]	Dark Comet, Snake
other	The malware doesn't fall into a defined type catagory.	BadUSB, DYEPACK
ransomware	A type of malware that encrypts files on a victim's system, demanding payment of ransom in return for the access codes required to unlock files.[1]	Conti, CryptoLocker, CryptoWall, Locky Bart, Netwalker, SamSam, WannaCry
remote-access-trojan	A remote access trojan program (or RAT), is a trojan horse capable of controlling a machine through commands issued by a remote attacker. [1]	Adwind jRAT, ElectroRAT, GravityRAT, Poison Ivy, Terminator
resource-exploitation	A type of malware that steals a system's resources (e.g., CPU cycles), such as a malicious bitcoin miner.[1]	Clipminer, WebCobra
rogue-security-software	A fake security product that demands money to clean phony infections. [1]
rootkit	A type of malware that hides its files or processes from normal methods of monitoring in order to conceal its presence and activities. Rootkits can operate at a number of levels, from the application level — simply replacing or adjusting the settings of system software to prevent the display of certain information — through hooking certain functions or inserting modules or drivers into the operating system kernel, to the deeper level of firmware or virtualization rootkits, which are activated before the operating system and thus even harder to detect while the system is running. [1]	Drovorub
screen-capture	A type of malware used to capture images from the target systems screen, used for exfiltration and command and control. [1]	Dark Comet
spyware	Software that gathers information on a user's system without their knowledge and sends it to another party. Spyware is generally used to track activities for the purpose of delivering advertising. [1]	Attor, Geneio, TrickBot
trojan	Any malicious computer program which is used to hack into a computer by misleading users of its true intent. [1]	Dark Comet, DNSChanger, Emotet (banking-trojan), Kovter, Heriplor, Trickbot (banking-trojan), Ursnif (banking-trojan)
virus	A malicious computer program that replicates by reproducing itself or infecting other programs by modifying them. [1]
webshell	A malicious script used by an attacker with the intent to escalate and maintain persistent access on an already compromised web application. [1]
wiper	Malware with the primary aim to delete files or entire disks on a machine. [1]	Mazar BOT, Shamoon
worm	A self-replicating, self-contained program that usually executes itself without user intervention. [1]	Bagle, Conficker, Stuxnet, Vobfus

References

[1] https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html

[2] M. Souppaya and K. Scarfone, "Guide to Malware Incident Prevention and Handling for Desktops and Laptops", NIST Special Publication 800-83, 2013. [Online]. Available: https://csrc.nist.gov/publications/detail/sp/800-83/rev-1/final.