Below is a table summarising the most common malware categories, their main purpose, typical behaviour, and a real-world example for each. Some practical, scenario-based examples follow this to show how these types of malware appear in everyday incidents.
| Category | Main Purpose | Typical Behaviour | Real-World Example |
| Adware | Display unwanted advertisements | Display unwanted advertisements | Fireball |
| Spyware | Collect information secretly | Tracks browsing, records keystrokes, captures data | Hermit |
| Ransomware | Extort money by locking files or systems | Encrypts data, displays ransom note | WannaCry |
| Wiper | Destroy data or systems | Overwrites or deletes files permanently | PathWiper |
| C2 (Command & Control) | Enable remote control by an attacker | Connects to remote server, receives commands | Emotet |
| Data stealer | Steal sensitive information | Exfiltrates files, credentials, or documents | Lumma Stealer |
| Keylogger | Record user keystrokes | Captures everything typed on keyboard | Zeus |
| Cryptominer | Use resources to mine cryptocurrency | High CPU usage, slows systems, network traffic | Coinhive |
Scenario-Based Examples
Below are some simple scenarios that show how this type of malware might appear within an organisation.
- Adware: A user’s browser starts showing pop-up ads every few minutes, even when no websites are open. Security tools identify a suspicious program running in the background, which turns out to be adware.
- Spyware: An employee notices their personal emails have been accessed by someone else. Forensics show a spyware program on the workstation, which was recording keystrokes and sending the information to an attacker.
- Ransomware: Several computers display a ransom note, saying that all files have been encrypted and payment is required to unlock them. The SOC traces the incident to a ransomware attack triggered by a malicious email attachment.
- Wiper: An organisation’s servers suddenly crash, and files are overwritten with random data. Investigation reveals wiper malware designed to destroy data rather than demand a ransom.
- Command and Control (C2) malware: An endpoint is found reaching out to unfamiliar domains at odd hours. Analysts discover C2 malware that gives attackers remote access, allowing them to run commands or move files.
- Data stealer: Sensitive documents start leaking online. The incident response team finds a data stealer malware that collected files from user directories and sent them to an external server.
- Keylogger: Users report unauthorised transfers from company bank accounts. Analysis shows a keylogger running on the accountant’s computer, recording every keystroke, including passwords.
- Cryptominer: Several desktops become slow and fans are running constantly. Monitoring tools reveal high CPU usage linked to a cryptominer that hijacks the computers to mine cryptocurrency.
Malware is not just a concept found in textbooks. Security teams deal with malware categories like spyware, ransomware, wipers, data stealers, keyloggers, and remote access trojans (RATs) in real incidents. Seeing how each type appears in actual attacks helps contextualise the theory and make the patterns easier to remember. We often refer to malware that relates to or is similar to each other as part of the same malware family.
A malware family refers to a group of malicious programs that share the same origin or codebase and behave similarly. Grouping malware like this helps security teams apply known defences and improve detection and response. Below are short case studies for known malware and links to learn more.
Spyware
Case Study, Pegasus:
Pegasus is one of the most well-known spyware tools, used to target mobile phones worldwide. Attackers send a specially crafted message or exploit a vulnerability to install Pegasus silently. Once on a device, it collects text messages, location data, emails, and microphone or camera recordings. Victims range from journalists and politicians to business leaders.
MITRE ATT&CK: TA0009 (Collection), TA0010 (Exfiltration)
Ransomware
Case Study, Akira:
Akira is a modern ransomware variant known for targeting businesses, schools, and public services. Attackers use phishing emails, stolen credentials, or remote access software to breach networks. Once inside, Akira spreads, encrypts key files, and displays a ransom note demanding cryptocurrency. This group is known for threatening to leak stolen data if the ransom is not paid.
MITRE ATT&CK: TA0040 (Impact), TA0011 (Command and Control)
For example, we can observe the ransom note that the Akira ransomware leaves once a host is compromised.
Wiper
Case Study, Shamoon:
Shamoon targeted energy companies in the Middle East, most famously Saudi Aramco. The malware rapidly overwrote files with useless data, making systems unusable. Entire networks went offline, and recovery took weeks. Shamoon showed that wipers can cause as much damage as ransomware, but without demanding payment.
MITRE ATT&CK: TA0040 (Impact)
Data Stealer
Case Study, Agent Tesla:
Agent Tesla is commonly delivered by phishing emails with attachments. Once opened, it captures keystrokes, screenshots, and credentials from web browsers and email clients. The stolen data is sent to command-and-control servers controlled by the attacker. Agent Tesla has been used in thousands of global attacks and continues to evolve.
MITRE ATT&CK: TA0010 (Exfiltration)
Above, we can observe an example from a forum where a threat actor has leaked data.
Keylogger
Case Study, RedLine Stealer:
RedLine Stealer acts as both a data stealer and a keylogger. It spreads through phishing or malicious websites, then captures keystrokes, browser cookies, and cryptocurrency wallet information. The data is then exfiltrated to the attacker’s server. RedLine is commonly used by cybercriminals for credential theft and fraud.
MITRE ATT&CK: TA0006 (Credential Access) TA0010 (Exfiltration)
C2 RAT Malware
Case Study, QakBot:
QakBot, also known as QBot, has become one of the most active and dangerous malware families targeting organisations globally. Originally designed as a banking trojan, QakBot has evolved into a modular RAT used by cybercriminal groups for initial access, credential theft, and as a loader for ransomware like Black Basta. QakBot typically arrives through phishing emails with malicious attachments or links. Once inside a network, it establishes a connection to its command-and-control servers, enabling attackers to move laterally, steal data, or deploy additional malware. In 2023, QakBot was responsible for several high-profile incidents, and law enforcement agencies have issued warnings about its continued activity.
MITRE ATT&CK: TA0011 (Command and Control), TA0002 (Execution), TA0006 (Credential Access)
Malware
The word malware is derived from the term MALicious softWARE. Therefore, any software that has a malicious purpose can be considered malware. Malware is further classified into different categories based on its behaviour. However, we will not investigate the details of those in this room. Here, we will ponder the steps we will take if we suspect that we have found malware in a machine. So, let’s get started.
The purpose behind Malware Analysis
Malware analysis is an important skill. As a quick overview, Malware Analysis is performed by the following people in the Security Industry:
- Security Operations teams analyse malware to write detections for malicious activity in their networks.
- Incident Response teams analyse malware to determine what damage has been done to an environment and to remediate and revert that damage.
- Threat Hunt teams analyse malware to identify IOCs, which they use to hunt for malware in a network.
- Malware Researchers in security product vendor teams analyse malware to add detections for it in their security products.
- Threat Research teams in OS Vendors like Microsoft and Google analyse malware to discover the vulnerabilities exploited and add more security features to the OS/applications.
Overall, it seems like many different people do malware Analysis for many compelling reasons. So let’s see how to start!
Before we begin!
Malware can be as dangerous as a weapon if handled carelessly. Before starting any analysis, it’s important to understand how to work safely. Always follow these precautions to protect your system and maintain a controlled environment during your research.:
- Never analyse malware or suspected malware on a machine that does not have the sole purpose of analysing malware.
- When not analysing or moving malware samples around to different locations, always keep them in password-protected zip/rar or other archives so that we can avoid accidental detonation.
- Only extract the malware from this password-protected archive inside the isolated environment, and only when analysing it.
- Create an isolated VM specifically for malware analysis, which can be reverted to a clean slate once you are done.
- Ensure that all internet connections are closed or at least monitored.
- Once you are done with malware analysis, revert the VM to its clean slate for the next malware analysis session to avoid residue from a previous malware execution corrupting the next one.
Malware Analysis is like solving a puzzle. Different tools and techniques are used to find the pieces of this puzzle, and joining those pieces gives us the complete picture of what the malware is trying to do. Most of the time, you will have an executable file (also called a binary or a PE file. PE stands for Portable Executable), a malicious document file, or a Network Packet Capture (pcap). The Portable Executable is the most prevalent type of file analysed while performing Malware Analysis.
To find the different puzzle pieces, you will often use various tools, tricks, and shortcuts. These techniques can be grouped into the following two categories:
- Static Analysis
- Dynamic Analysis
Static Analysis
When malware is analysed without being executed, it is called Static Analysis. In this case, the different properties of the PE file are analysed without running it. Similarly, in the case of a malicious document, exploring the document’s properties without analysing it will be considered Static Analysis. Examples of static analysis include checking for strings in malware, checking the PE header for information related to different sections, or looking at the code using a disassembler. We will look at some of these techniques later in the room.
Malware often uses techniques to avoid static analysis. Some of these techniques use obfuscation, packing, or other means of hiding their properties. To circumvent these techniques, we often use dynamic analysis.
Dynamic Analysis
Malware faces a dilemma. It has to execute to fulfil its purpose, and no matter how much obfuscation is added to the code, it becomes an easy target for detection once it runs.
Static analysis might provide us with crucial information regarding malware, but sometimes that is not enough. We might need to run the malware in a controlled environment to observe what it does in these cases. Malware can often hide its properties to thwart Static Analysis. However, in most of those cases, Dynamic Analysis can prove fruitful. Dynamic analysis techniques include running the malware in a VM, either in a manual fashion with tools installed to monitor the malware’s activity or in the form of sandboxes that perform this task automatically. We will learn about some of these techniques later in this room. Once we run the malware in a controlled environment, we can use our knowledge from the Windows Forensics rooms to identify what it did in our environment. The advantage here is that since we control the environment, we can configure it to avoid noise, like activity from a legitimate user or Windows Services. Thus, everything we observe in such an environment points to malware activity, making it easier to identify what the malware did in this scenario.
Malware, however, often uses techniques to prevent an analyst from performing dynamic analysis. Since most dynamic analyses are performed in a controlled environment, most methods to bypass dynamic analysis include detecting the environment in which they are being run. Therefore, in these cases, the malware uses a different, benign code path if it identifies that it is being run in a controlled environment.
Advanced Malware Analysis
Advanced malware analysis techniques are used to analyse malware that evades basic static and dynamic analysis. Disassemblers and debuggers are used to perform advanced malware analysis. Disassemblers convert the malware’s code from binary to assembly so that an analyst can look at the instructions of the malware statically. Debuggers attach to a program and allow the analyst to monitor the instructions in malware while it is running. A debugger allows the analyst to stop and run the malware at different points to identify interesting pieces of information while also providing an overview of the memory and CPU of the system. We will not cover advanced malware analysis in this room. However, it will be covered in a future module targeting malware analysis.
Threat actors use Living Off the Land techniques because built-in tools are already trusted, widely available, and often allowed by default controls, so malicious activity can hide among normal operations. These techniques let attackers run code without dropping obvious new binaries, carry out stepwise workflows, and reuse legitimate credentials, all of which reduce noise and slow detection. Using native utilities also makes it easier to persist and move across systems while appearing like routine admin work.
Commonly abused tools provide scripting, management, file handling, or scheduling capabilities, which match common attacker needs like execution, persistence, reconnaissance, and lateral movement. Examples include:
- PowerShell is used for in-memory scripting, remote downloads, and automation.
- WMIC or WMI is used to run commands locally or on remote hosts and to query system state.
- Certutil is used to fetch files and encode or decode payloads.
- Mshta is used to run HTA content or an inline script delivered by a document or link.
- Rundll32 is used to invoke DLL exports or trigger URL handlers.
- Scheduled tasks (schtasks) are used to run code at logon or on a schedule for persistence.
Operators also abuse signed admin utilities from the Sysinternals suite, for example PsExec for remote execution, and Autoruns for persistence discovery and manipulation, because those tools blend with legitimate admin workflows.
Living Off the Land methods are not limited to Windows; similar approaches exist on Unix and Linux, and public collections document common patterns for both platforms, for example, LOLBAS for Windows and GTFOBins for Unix. Knowing which tools are most likely to be misused, and the typical goals behind those uses, helps defenders tune logging, capture full command lines and process trees, and prioritise alerts when normally benign binaries behave in clearly malicious ways.
Some measures we can take to reduce the attack surface and improve response include the following:
- Apply layered defensive controls that combine endpoint, network, and identity protections.
- Implement application control policies such as AppLocker or Windows Defender Application Control to define which scripts and executables are permitted to run.
- Enforce/Use the principles of least privilege by ensuring only administrators can access or use system management utilities.
- Configure network rules and DNS filters to block or redirect connections to domains and IPs known for malicious activity.
- Maintain clear containment playbooks that outline the steps for isolating compromised systems and revoking exposed credentials.
- Regularly review and update access permissions, logging coverage, and control lists to adapt to new attack methods.
Living Off the Land methods are not limited to individual attackers or small operations. Many organised threat groups, both state-sponsored and financially motivated, depend on these techniques to keep a low profile. Using built-in and trusted binaries allows them to operate with fewer alerts from security tools and less chance of being blocked by application control policies.
The following examples show how known groups applied these tools in real-world operations between 2022 and 2024. Each example highlights the tools, the purpose of their use, and the advantage gained by the attackers.
APT29 (Nobelium) – PowerShell and WMI for Persistence and Execution
APT29 has used fileless techniques that combine PowerShell with WMI event subscriptions to persist and execute code without dropping obvious binaries on disk. For example, this detailed technical write-up shows how a WMI event subscription was created to run a PowerShell payload stored in WMI. The payload was read, decrypted, and executed from WMI properties, and the approach left minimal on-disk artefacts.
For the WMI event subscription technique itself, see the MITRE ATT&CK entry for WMI event subscriptions T1546.003, which documents how adversaries can create filters, consumers, and bindings to trigger code execution on specified events.
BlackCat (ALPHV) Ransomware – Built-in Tools for Lateral Movement
BlackCat/ALPHV actors have used built-in tools like PowerShell for scripting and defence disabling, PsExec from the Sysinternals suite for remote execution and lateral movement, and certutil to fetch or decode payloads on hosts. Official advisories and national cybersecurity posts, as well as others like this one, describe ALPHV activity that includes using PsExec and PowerShell for execution and lateral spread and using certutil-style techniques for handling files.
Cobalt Strike loaders: QakBot and IcedID
Multiple incident reports and detection guides note that loaders such as QakBot, IcedID, and others have been used to stage and deliver Cobalt Strike beacons, and that attackers often use signed Windows binaries like rundll32.exe and mshta.exe to execute or bootstrap those payloads in memory, making execution appear to involve legitimate processes. Detection writeups and threat reports document rundll32 and mshta being used to run DLL exports or HTA/JavaScript that then launch or drop Cobalt Strike beacons.