Malware Guide: Types, Families and How They Work

Malware is rarely a single file that antivirus either catches or misses: it is a chain of loaders, payloads, stolen credentials and legitimate tools, and defenders who only think in terms of "viruses" miss most of it. NIST SP 800-83 describes malware as the most common external threat to most hosts, and the families that matter today are modular services that change hands between criminal groups. This guide explains how analysts classify malware by type, family and behaviour, what the major families such as Emotet, QakBot, PlugX, NotPetya and the newer AI-assisted strains actually do, and which evasion techniques defeat signature scanning. It then covers analysis, detection with specific Windows event IDs and Microsoft Defender attack surface reduction (ASR) rules, a phased rollout, metrics and framework mapping. It is written for SOC analysts, endpoint engineers and security architects, and contains no code.

Key takeaways

• Classify by behaviour, not just by name. A family such as Emotet started as a banking trojan and became a loader for other malware, so the type label on a detection tells you less than the ATT&CK techniques it exhibits.
• Loaders are the real early warning. CISA's #StopRansomware Guide says many ransomware infections are the result of existing infections such as QakBot, Bumblebee and Emotet, so a "commodity" loader alert deserves incident-level attention.
• Evasion is the default. Packing, polymorphic code, sandbox checks and environmental keying (MITRE ATT&CK T1027, T1497, T1480.001) mean hash and signature matching must be backed by behaviour-based detection.
• Most damage is done with identities. Infostealers harvest browser passwords, cookies and tokens (T1555.003), and wipers and ransomware spread with stolen admin credentials, so credential response is part of every malware incident.
• Test controls before you trust them. Run ASR rules and application control in audit mode, measure the events (for example Defender event 1122 for audited ASR rules) and only then enforce, with a documented rollback.

How analysts classify malware

Three labels are used together. The type describes what the malware does (ransomware, remote access trojan, wiper). The family is a codebase lineage with shared code and infrastructure, such as TrickBot or ShadowPad, often with several vendor names for the same thing (QakBot is also tracked as QBot and Pinkslipbot). The behaviours are the techniques it uses, best expressed as MITRE ATT&CK technique IDs, which are stable across vendors. MITRE also assigns software IDs (S-numbers) and distinguishes "malware" from "tools": commercially sold or open-source remote access software such as Remcos (S0332) and AsyncRAT (S1087) is catalogued as a tool because it is also sold or published for legitimate use, even though it appears widely in criminal campaigns.

Major families and what they teach defenders

• Emotet (S0367): first seen in June 2014 as a banking trojan, it became a modular downloader that delivered TrickBot and IcedID. It spread through phishing attachments and links, and later moved laterally with SMB exploitation such as EternalBlue and brute-forced passwords. Its infrastructure was taken over in an international law enforcement action in January 2021, yet the family returned. Lesson: takedowns buy time, not safety.
• QakBot (S0650): active since at least 2007, it evolved from information stealer into a delivery agent for ransomware. The US Department of Justice said in August 2023 that the FBI had identified more than 700,000 infected computers and that Conti, ProLock, Egregor, REvil, MegaCortex and Black Basta had used QakBot for initial infection.
• TrickBot (S0266) and IcedID (S0483): both began as banking malware (TrickBot in September 2016, IcedID by 2017) and became loaders and reconnaissance platforms in ransomware intrusions. In May 2024 Europol's Operation Endgame targeted the dropper ecosystem, naming IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot.
• PlugX (S0013) and ShadowPad (S0596): modular backdoors used by several China-linked groups. PlugX is known for DLL side-loading through a legitimately signed executable (T1574.001). ShadowPad was first identified in July 2017 in a supply chain compromise of NetSarang software, a reminder that signed vendor updates can carry backdoors, as the SolarWinds SUNBURST compromise later showed at scale.
• Commodity RATs: njRAT (S0385, first observed 2012), Remcos (S0332) and AsyncRAT (S1087) are cheap or free, so they are used by both criminal and state-linked groups. Attribution from the RAT alone is unreliable.
• WannaCry (S0366) and NotPetya (S0368): both in 2017, both worm-like, both spreading over SMBv1 with EternalBlue (MS17-010). MITRE notes that NotPetya appears to be ransomware but "may be more appropriately thought of as a form of wiper malware", and it also spread with PsExec, WMI and credentials taken by a modified Mimikatz.
• Ukrainian wipers of 2022: WhisperGate overwrote the master boot record with a fake ransom note; HermeticWiper corrupted partitions, overwrote the master file table and disabled the Volume Shadow Copy service to frustrate recovery.

How an infection unfolds

Mapping alerts to these stages tells responders how far an attacker has got.

1. Delivery: a phishing email with an attachment or link (T1566.001), a malicious file the user opens (T1204.002), HTML or SVG smuggling that assembles the payload inside the browser (T1027.006, T1027.017), a poisoned advert or a compromised software package.
2. Execution and staging: script interpreters such as PowerShell (T1059.001) decode and run a loader; the loader fetches the next stage over HTTPS (T1105, T1071.001).
3. Persistence: registry Run keys or the Startup folder (T1547.001), services and scheduled tasks.
4. Defence evasion: process injection such as process hollowing (T1055.012), reflective code loading in memory (T1620) and DLL side-loading (T1574.001).
5. Credential access and lateral movement: browser credential theft (T1555.003), keylogging (T1056.001), LSASS memory access, then remote services with valid accounts.
6. Actions on objectives: data theft, encryption (T1486), destruction (T1485, T1561), or resource hijacking for cryptomining (T1496).

Evasion techniques analysts must recognise

ATT&CK lists 18 sub-techniques under T1027 Obfuscated Files or Information alone. The table groups the ones that most often explain why a sample was missed.

Fileless malware

Microsoft notes there is no single definition of "fileless" and splits it into three types: Type I with no file activity at all (rare, for example memory-only exploitation or firmware implants), Type II with indirect file activity (a PowerShell command stored in the WMI repository and triggered by a WMI filter), and Type III where files exist but are used in a way that file scanning cannot catch (a registry shell handler that runs a script through mshta.exe). Defences therefore move from the file to the runtime: the Antimalware Scan Interface (AMSI) passes PowerShell, Windows Script Host, JavaScript, VBScript and Office VBA content to the antimalware engine at run time, and Sysmon events 19 to 21 record WMI event filter and consumer activity.

AI-assisted malware

In July 2025 CERT-UA reported LAMEHUG, attributed with medium confidence to APT28, which used the Hugging Face API to query the Qwen 2.5-Coder-32B-Instruct model for Windows commands to collect system information and documents, then exfiltrated data over SFTP or HTTP POST. Google's Threat Intelligence Group tracks the same malware as PROMPTSTEAL and, in November 2025, also described PROMPTFLUX, an experimental VBScript dropper that asked Gemini to rewrite its own code. The defensive points are practical: the model replaces hard-coded commands but the malware still has to run commands, touch documents and send data out, and it carries an API key that can be revoked. Watch for script hosts and unsigned binaries calling LLM API endpoints, and treat leaked AI API keys as a malware enabler as well as a cost problem. See the LLMjacking Guide.

Malware analysis and sandboxing

• Triage: hash the sample, check reputation, identify file type and packer, and extract strings, URLs and certificates.
• Static analysis: examine imports, sections and embedded resources. YARA rules describe families with textual or binary patterns and are the standard way to share classification logic.
• Dynamic analysis (D3FEND D3-DA): detonate the sample in an isolated sandbox and record process, file, registry and network behaviour. CAPE (Config And Payload Extraction), derived from Cuckoo, adds automated unpacking and configuration extraction; interactive services such as ANY.RUN let an analyst click through lures that need user activity.
• Configuration extraction: for loaders and RATs, the C2 addresses, campaign IDs and encryption keys are the most actionable output.
• Handle public sandboxes carefully: uploads to public services are often visible to others, including the attacker. Use private instances for samples that contain your data, internal hostnames or targeted lures.

Prevention and detection controls

CIS Controls v8.1 Control 10 (Malware Defenses) sets the baseline: deploy and centrally manage anti-malware (10.1, 10.6), automatic signature updates (10.2), disable autorun and autoplay (10.3), scan removable media (10.4), enable anti-exploitation features (10.5) and use behaviour-based anti-malware (10.7). On Windows, Microsoft Defender ASR rules target the behaviours loaders depend on.

Pair these with application control, macro blocking, PowerShell Constrained Language Mode (as the NCSC recommends) and offline, tested backups.

What to log

• Defender antivirus (Microsoft-Windows-Windows Defender/Operational): 1116 malware detected, 1117 action taken, 1118 and 1119 action failed, 5001 real-time protection disabled, 5007 configuration changed. An unexpected 5001 or 5007 is often the first sign of tampering.
• ASR and related features (same channel): 1121 rule fired in block mode, 1122 in audit mode, 1129 user override in warn mode; network protection 1125 audit and 1126 block; controlled folder access 1123 block and 1124 audit.
• Sysmon (Microsoft-Windows-Sysmon/Operational): 1 process creation, 3 network connection, 7 image loaded, 8 CreateRemoteThread, 10 ProcessAccess (LSASS access), 11 FileCreate, 13 registry value set (Run keys), 22 DNS query, 25 process tampering (hollowing).
• Network and identity: DNS and proxy logs for newly registered domains and LLM API calls from unusual processes, plus sign-ins from new devices immediately after an endpoint detection.

Metrics that show it is working

• Coverage: percentage of managed endpoints and servers with healthy, centrally reporting EDR or anti-malware (set a target such as 98 percent; unprotected hosts are where incidents start).
• Enforcement: number of ASR rules in block mode versus audit, and the trend in 1122 audit events still unresolved.
• Dwell time: median time from first loader detection to host isolation.
• Escalation quality: percentage of loader or infostealer detections that trigger credential and session revocation within 24 hours.
• Tamper signals: count of 5001 and 5007 events not linked to an approved change.
• Recovery readiness: date of the last successful restore test from offline backups.

Rolling out malware defences

1. Inventory and coverage first: reconcile the asset inventory with the EDR console and fix unprotected hosts, especially servers and jump hosts.
2. Enable ASR rules in audit mode across all devices for two to four weeks; review 1122 events and advanced hunting data to find line-of-business applications that trigger them. Microsoft recommends auditing all but its standard protection rules before enforcement.
3. Pilot ring: move rules to block on IT and security staff devices, then a representative business ring. Add per-rule exclusions for proven false positives rather than global exclusions.
4. Broad enforcement: expand by ring. Use warn mode where users need a temporary override (warn allows a 24-hour unblock and is not available for the LSASS rule).
5. Add application control and macro policy using the same audit, pilot, enforce pattern.
6. Rollback plan: keep the previous policy version ready to redeploy, document how to set a single rule back to audit, and agree who can approve it out of hours.
7. Exercise the response: run a tabletop where a loader detection becomes a ransomware precursor.

Choosing the right approach

• Signature anti-malware versus EDR: signature engines stop known commodity files cheaply; EDR adds behaviour detection, process lineage and isolation against loaders, fileless techniques and hands-on-keyboard activity.
• ASR rules versus full application allowlisting: ASR rules block specific risky behaviours with low effort; allowlisting stops unknown executables outright but needs ongoing maintenance. Start with ASR everywhere and allowlisting on servers, kiosks and admin workstations.
• Small organisations: use the built-in platform protection with cloud management, block macros from the internet, enforce ASR standard protection rules and buy a managed detection and response service rather than building a SOC.
• Large organisations: add a private sandbox, YARA-based hunting, configuration extraction feeding blocklists, and automated playbooks that isolate the host and revoke sessions together.

Where identity fits

Infostealers take saved browser passwords, session cookies and developer tokens, and the stolen data is reused without any further malware. The Snowflake breach showed infostealer credentials opening customer data warehouses that lacked MFA. Treat an infostealer detection as a credential incident: revoke sessions and refresh tokens, rotate any API keys, SSH keys or cloud keys present on the host, and check for sign-ins from new locations. See the Leaked Credential Response Playbook and the Token and Session Security Guide. Local administrator rights and shared service account passwords are what turn one infected laptop into a NotPetya-style outbreak, so remove standing admin rights and give every device a unique, rotated local admin password, for example with Windows LAPS. Code-signing keys matter too: certificates stolen from NVIDIA in 2022 were used to sign malware, which defeats trust decisions based on signatures alone.

Framework mapping

Common failure patterns

• Closing a loader alert as "cleaned": the antivirus quarantined the file, so the ticket was closed, but the loader had already fetched its next stage. CISA advises looking for precursor dropper malware before restoring from backups.
• Containing the host but not the credentials: an infostealer is removed, yet the passwords, cookies and tokens it took remain valid. Malware that steals secrets keeps paying off long after cleanup, as the Shai-Hulud npm worm showed when stolen publishing tokens spread it to further packages.
• Ignoring servers and containers: EDR is deployed on laptops while Linux, cloud and container hosts go unmonitored. The TeamTNT worm combined cryptomining with theft of AWS credential files from exposed Docker hosts.
• Assuming destruction needs a wiper: attackers with administrative access can wipe devices through legitimate management tools, as in the Stryker Intune wiping attack. Protect device management admin roles with the same rigour as domain admin.
• Exclusions that never expire: broad folder or process exclusions added during a pilot become permanent blind spots that malware authors deliberately target.

Practitioner checklist

• Reconcile the asset inventory against EDR coverage weekly and fix gaps on servers and jump hosts first.
• Enable ASR rules in audit mode, review 1122 events, then enforce by ring with a written rollback.
• Block macros in files from the internet and route scripts through AMSI; enforce PowerShell Constrained Language Mode where possible.
• Collect Defender events 1116, 1117, 5001 and 5007 and Sysmon events 1, 3, 10, 13 and 22 centrally, and alert on tampering.
• Treat every loader, RAT or infostealer detection as a potential ransomware precursor: scope, isolate and hunt for the next stage.
• Revoke sessions and rotate tokens, API keys and SSH keys from any host where a stealer ran.
• Remove standing local admin rights and use unique, rotated local admin passwords to stop worm-style spread.
• Run a private sandbox with YARA and configuration extraction, and feed extracted C2 data into blocklists.
• Keep offline, tested backups and record the date of the last full restore test.

Standards and references

• NIST: SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops
• MITRE ATT&CK: T1027 Obfuscated Files or Information
• CISA: #StopRansomware Guide
• NCSC: Mitigating malware and ransomware attacks
• CIS: Control 10, Malware Defenses
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Fileless threats
• Google Threat Intelligence Group: Advances in Threat Actor Usage of AI Tools

Related NHI Mgmt Group resources: Leaked Credential Response Playbook · Token and Session Security Guide · ITDR Guide · Secrets Management Guide