9 types of computer virus and how they do their dirty work

The human head loves to categorize matters, and malware is no exception. We in this article at CSO have done our part: our malware explainer breaks down malware primarily based on how it spreads (self-propagating worms, viruses piggybacking on other code, or sneakily disguised Trojans) as effectively as by what it does to contaminated equipment (rootkits, adware, ransomware, cryptojacking, and malvertising, oh my).

You can come across a ton of this sort of technical taxonomy, and there’s definitely utility to it. In individual, it can be helpful to differentiate distinctive styles of malware an infection vectors fairly than lumping all the things collectively as a “virus,” despite preferred usage of the term. But we can also place too considerably emphasis on these kinds of divisions.

“A whole lot of the terminology utilized to describe malware in the 90s and early 00s is still technically accurate, but probably less appropriate than it at the time was,” states Jacob Ansari, Safety Advocate and Rising Cyber Trends Analyst for Schellman, a global independent protection and privateness compliance assessor. “When malware of the prior decades obtained installed on the goal system and then ran by itself without human intervention, most modern day attack campaigns are operated by teams of persons, what we commonly get in touch with risk actors. Attackers however endeavor to evade detection and persist inspite of defenses, and make use of a assortment of programming or scripting languages to produce their hostile code.”

So we asked Ansari and other protection professionals about how they crack down the types of malware they offer with. In normal, we identified that there are two different views on malware taxonomy: you can assume of how viruses do their dirty do the job (i.e., what they do to you), or about wherever they in good shape into an ecosystem (i.e., what they do for an attacker). 

9 widespread sorts of computer virus

1. Macro viruses
2. Polymorphic viruses
3. Resident viruses
4. Boot sector viruses
5. Multipartite viruses
6. Droppers
7. Beacon/payload
8. Packers
9. Command and control

Virus types described by what they do to you
If you want a good standpoint on the distinct forms of malware, you could do even worse than discuss to somebody who writes it for a living. That’s Dahvid Schloss’s job: he is the controlling lead for offensive stability at cybersecurity skilled companies agency Echelon Threat + Cyber, where he performs on malware meant to emulate authentic risk actors to execute command-and-handle platforms on his company’s adversarial emulation and purple staff engagements. He broke down the various types of viruses he works with by their function.

Macro viruses. “This group is almost certainly the most prevalent malware method in the entire world,” claims Schloss. “Approximately 92% of exterior attacks begin with phishing, and macros are the main of the challenge. A macro is an automatic execution of keystrokes or mouse steps that a system can do without having user interaction—typically, we are conversing about Microsoft Word/Excel macros, which can automate repetitive jobs on the worksheet or document.”

Macros are an very typical malware type. “The shipping technique is believable, primarily when it seems perform connected,” claims Schloss. “Also, the coding language (Visible Primary, in Microsoft’s situation) is quite simplistic. Thus, macro viruses reduce the volume of engineering talent necessary to generate them.”

Lauren Pearce, incident reaction direct at cloud stability company Redacted, agreed. “We continue on to see major damage from unsophisticated malware,” she says. “The very simple Business office doc macro reigns supreme as an first infection vector.”

Polymorphic viruses. “Whilst the macro virus is the best to code, this kind [the polymorphic virus] would be the most sophisticated due to the virus becoming exactly what its title claims: polymorphic,” suggests Schloss. “Every single time the code runs, it executes a bit in another way, and commonly each and every time it moves to a new machine, its code will be a little bit diverse.”

You should take care of all your youngsters (or your enemies) equally, but Schloss admits that “this classification of viruses is my most loved, as it is intricate and is exceptionally tricky to examine and detect.”

Resident viruses. This is a especially pernicious class: a disembodied virus that will not exist as section of a file. “The virus alone is essentially executing within the RAM of the host,” says Schloss. “The virus code is not stored inside of the executable that identified as it as an alternative it’s generally saved on a world wide web-available site or storage container. The executable that phone calls the resident code is generally published as non-malicious by intent to stay away from detection by an antivirus software.”

The term resident virus implies the existence of a non-resident virus, of study course. Schloss defines this as “a virus that is contained in the executable that is contacting it. These viruses most typically unfold by abusing enterprise solutions.”

Boot sector viruses. “This class I like to contact the ‘nation condition cocktail,'” Schloss describes. “These styles of viruses are intended to supply the risk actor with unrestricted and deep persistence. They will infect all the way down to the computer’s master boot document (MBR), this means that even if you reimage your device, the virus will persist and will be in a position to execute inside the memory of the host on boot. These styles of viruses are rare to see exterior of nation-state risk actors, and almost constantly depend on a zero-day exploit to be able to attain the stage of the MBR or are distribute by physical media this sort of as contaminated USB or tough drives.”

Multipartite viruses. When some malware builders may perhaps focus, some others choose an “all of the earlier mentioned” method, attacking just about everywhere all at as soon as. “These styles of viruses are ordinarily the toughest to comprise and offer with,” suggests Schloss. “They will infect various sections of a system, including memory, documents, executables, and even the boot sector. We see additional and much more viruses of this range, and these kinds of viruses will spread in whichever way they can, typically employing many methods to increase spread.”

Kinds of malware defined by what they do for the attacker

A further way of thinking about unique malware you can expect to experience is how they in good shape into the greater photo of an all round attack. Keep in mind what Schellman’s Ansari reported previously mentioned: contemporary malware is deployed by groups, and the viruses them selves can be believed of as a staff as perfectly. “A lot of malware strategies consist of an array of components, often each and every developed individually or even sourced from other menace actors,” Ansari claims. He breaks down some of the various gamers:

Droppers. “This piece of malware is supposed to fall other malware onto the contaminated procedure,” Ansari explained. “Victims may possibly get infected with a dropper from a hostile website link, attachment, download, or the like—and it typically does not persist just after dropping the next phase of malware.”

“Macro malware falls into the classification of a dropper,” provides Redacted’s Pearce. “It is really malware manufactured for the sole reason of downloading and executing extra malware.”

Beacon/payload. These malware kinds are the next phase in the attack. “Usually installed by a dropper, a beacon or payload is the malware that alerts back again to the menace actor its newly mounted implies of access,” claims Ansari. “From below, an attacker can access the victim programs as a result of the implies proven by the beacon and obtain the technique, the information it has, or other units on the network.”

Packers. These factors package other parts, making use of cryptographic strategies as a signifies of evading detection. “Some subtle malware campaigns use a series of packers, nested like a stacking doll,” says Ansari. “Each and every is made up of one more packed product, right up until the closing payload is ready to execute.”

Command and control. Each group requirements a chief, and which is the role command and management performs for these collaborative malware parts. “These methods, often known as C&C, CNC, or C2, run exterior of the victim’s surroundings and allow the risk actor to converse with the other factors of the malware campaign set up on the target system,” suggests Ansari. “When legislation enforcement targets a danger actor, they frequently seize the command and command devices as element of their endeavours to halt the risk.”

Classifying computer system viruses

In the finish, regardless of what taxonomy we use shouldn’t be extremely rigid, but really should instead make it a lot easier to talk essential data about cyberthreats. And that suggests tailoring your language for your viewers, claims Ori Arbel, CTO of CYREBRO, a stability expert services provider.

“If I’m producing for CISOs, they would assume about it from a danger standpoint,” he suggests, “while the typical general public would improved have an understanding of normally applied names in the news. These virus categorizations are offered from the place of perspective of what will be most simply understood—but carrying out it that way would not automatically talk the very best steps for security pros to consider. If I’m producing for a group of danger intelligence pros, I would use phrases relevant to geolocation and the attacker’s drive somewhat than what the virus truly does.”

We are going to conclude with a single last way to categorize viruses, a single that actually only tends to make sense from the point of view of the virus hunters them selves: viruses that are worthy adversaries, and all those that are not. “As a reverse engineer, I acquire pleasure from the puzzle of reversing,” says Redacted’s Pearce. “Macros present a important menace to a network, but they are not especially enjoyable to reverse. I love reversing samples that use anti-evaluation methods to actively battle in opposition to getting reversed. Malware may perhaps use anti-debugging approaches that detect and answer to a debugger by using procedures this kind of as test summing or timing assaults. Use of anti-examination approaches show a experienced malware creator and serve to raise the total of time in in between detection of a sample and extraction of helpful indicators to counter it.”

Just simply because your adversaries are criminals would not necessarily mean you are not able to respect them for putting satisfaction into their work.