39.1 What Is Malware – Types for Defenders
Malware = software designed to harm, spy, encrypt, or control systems without honest user intent. Types (Blue vocabulary):
| Type | Simple idea | Blue focus |
|---|---|---|
| Virus | Needs a host file; spreads when that file runs / is shared | Scan files; block autorun; least privilege |
| Worm | Self-spreads over network (often no user click) | Patch, segment, block lateral SMB/RDP |
| Trojan | Looks useful; hides payload (fake tool, cracked installer) | Reputation, allowlisting, signed software |
| Ransomware | Encrypts / locks; demands payment | Backups, EDR, least privilege, isolate |
| Spyware | Steals keystrokes, cookies, files | EDR, MFA, browser hardening |
| Adware | Aggressive ads / unwanted PUPs | Browser hygiene; remove PUPs |
| Rootkit | Hides itself / other malware deep in OS | Boot integrity, offline scan, reimage |
| Botnet | Many infected hosts obey a C2 (command and control) | DNS/egress filter; sinkhole; patch |
| Fileless | Lives in memory / scripts / legitimate tools (LOLBins) | Script logging, AMSI, EDR behaviour |
| Wiper | Destroys data (sometimes disguised as ransomware) | Offline backups; immutable copies; IR drills |
Thodkyaat: naav kam, behaviour jast – encrypt karto ka? Lateral jato ka? C2 boltoy ka? Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Delivers trojanised "free tool" / cracked installer | Block untrusted downloads; SmartScreen / reputation; allowlisting |
| Uses worm-style lateral after foothold | Network segmentation; patch critical SMB/RDP bugs; EDR lateral alerts |
| Prefers fileless PowerShell / WMI to dodge old AV | Script block logging; AMSI; EDR behaviour rules; Constrained Language Mode where fit |
Ravindra Bagale's Tip
Students "virus = sagla malware" mhantat. Interview madhe clear bola: virus host file, worm self-spread, trojan fake useful, ransomware encrypt/extort. Exact definition > scary stories. He lakshat theva.
Lab
Notes madhe 10-row table: type | one-line def | one Blue control. Fictional Sahyadri Traders Pune – Shraddha Bagale (accounts) cracked "PDF merger" install keli. Kontya type chi suspicion? 5 sentences liha (trojan / PUP path).
Real incident: WannaCry (2017)
WannaCry was a worm-like ransomware outbreak that spread widely using a Windows SMB vulnerability (EternalBlue-class). Public reporting (national CERTs, Microsoft, major outlets) stressed unpatched systems and rapid east-west spread. Defence theme: timely patching, network segmentation, disable unused SMBv1, backups that ransomware cannot reach. Source: Microsoft security response and CERT advisories (verify current pages).