CompTIA Security+ Preparation · lesson 16 of 45 · 25 min
Malware Categories
Virus — attaches to legitimate files and spreads when the infected file is executed. Requires human action to spread. Can corrupt files, steal data, or deliver payloads.
Worm — self-replicating malware that spreads across networks without human interaction. Exploits vulnerabilities to propagate. Example: WannaCry (2017) spread via EternalBlue SMB exploit.
Trojan (Trojan Horse) — disguised as legitimate software. Does not self-replicate. User is tricked into installing it. Often creates backdoors or downloads additional malware.
Ransomware — encrypts victim’s files and demands payment for the decryption key. Modern ransomware also exfiltrates data (double extortion). Example: REvil, LockBit, Ryuk.
Rootkit — hides its presence and other malware from the OS and security tools. Operates at kernel level. Very difficult to detect and remove. May require OS reinstall.
Spyware — secretly monitors user activity and sends data to the attacker. Captures keystrokes, screenshots, browsing history, credentials.
Keylogger — records keystrokes to capture passwords, credit card numbers, and other sensitive input. Can be software or hardware.
Botnet — network of compromised computers (bots/zombies) controlled by a command-and-control (C2) server. Used for DDoS attacks, spam, cryptocurrency mining, credential stuffing.
RAT (Remote Access Trojan) — gives the attacker full remote control of the infected system. Often used for espionage and data theft.
Fileless malware — lives in memory (RAM) rather than on disk. Uses legitimate tools (PowerShell, WMI) to execute. Harder to detect with traditional antivirus.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Malware Types
Which malware spreads across networks without human interaction?
- Virus
- Worm
- Trojan
- Spyware
Answer: Worm
Worms self-replicate and spread autonomously by exploiting network vulnerabilities — no user action required.
Ransomware’s primary action is:
- Stealing credentials
- Encrypting files and demanding payment
- Hiding from antivirus
- Creating a botnet
- Answer: Encrypting files and demanding payment
Ransomware encrypts the victim’s files and demands a ransom for the decryption key. Modern variants also steal data. A rootkit is dangerous because:
- It spreads via email
- It hides itself and other malware from the OS and security tools
- It encrypts files
- It requires internet access
- Answer: It hides itself and other malware from the OS and security tools
Rootkits operate at kernel level — they can hide processes, files, and network connections from the OS and security software. Fileless malware is harder to detect because:
- It uses strong encryption
- It runs in memory using legitimate tools — no files on disk
- It spreads via USB
- It disables the network
- Answer: It runs in memory using legitimate tools — no files on disk
Traditional AV scans files on disk — fileless malware leaves no files, using PowerShell or WMI to execute in memory. A botnet is controlled by:
- The infected user
- A command-and-control (C2) server
- The antivirus vendor
- The ISP
- Answer: A command-and-control (C2) server
Botnets receive instructions from a C2 server — the attacker sends commands to all bots simultaneously. A Trojan differs from a virus because:
- Trojans spread automatically
- Trojans are disguised as legitimate software and do not self-replicate
- Trojans encrypt files
- Trojans only affect mobile devices
- Answer: Trojans are disguised as legitimate software and do not self-replicate
Trojans rely on users installing them (thinking they are legitimate) — they do not self-replicate like viruses or worms. Double extortion ransomware:
- Encrypts files twice
- Encrypts files AND exfiltrates data — threatening to publish if ransom is not paid
- Demands two separate ransoms
- Infects two systems simultaneously
Answer: Encrypts files AND exfiltrates data — threatening to publish if ransom is not paid Modern ransomware groups steal data before encrypting — even if victims restore from backup, they still face data exposure threats. A keylogger captures:
- Network traffic
- Keystrokes to steal passwords and sensitive input
- Screenshots only
- File system changes
- Answer: Keystrokes to steal passwords and sensitive input
Keyloggers record every keystroke — passwords, credit card numbers, messages — and send them to the attacker.
A virus requires human action to spread (e.g., opening an infected file).
- True
- False
Answer: True
Viruses attach to files and spread when infected files are executed — they require human action, unlike worms which spread automatically.
A RAT (Remote Access Trojan) gives the attacker:
- Encrypted communications
- Full remote control of the infected system
- Access to the victim’s email only
- DDoS capability
- Answer: Full remote control of the infected system
RATs provide complete remote access — attackers can execute commands, access files, activate webcams, and move laterally.
Previous lesson: Social engineering: phishing, vishing, pretexting, BEC
Back to CompTIA Security+ Preparation
Next lesson: Application attacks: SQL injection, XSS, CSRF, buffer overflow, directory traversal