MODULE 3 — Malware: Structure, Behaviour, and Evolution

Learning Objectives

By the end of this module, learners will be able to:

Define malware and distinguish between different malware categories.
Understand how malware is built, delivered, and executed within target environments.
Analyse the behaviour of common malware families such as trojans, worms, ransomware, and spyware.
Explain how modern malware evades detection and evolves through polymorphism and obfuscation.
Evaluate the impact of malware on individuals, organisations, and critical infrastructure.

Module Overview

Malware is one of the most pervasive and adaptable tools in the cyber adversary’s arsenal. It is not a single threat but a broad class of malicious software engineered to infiltrate, manipulate, or damage systems.
This module examines malware as an engineered construct: its architecture, lifecycle, propagation mechanisms, evasion strategies, and operational goals. Understanding malware behaviour is foundational for designing defensive countermeasures and incident response strategies.

1. What Is Malware?

Malware, short for malicious software, refers to any program intentionally designed to:

Disrupt operations
Steal or leak information
Encrypt or destroy data
Establish unauthorized access
Manipulate system behaviour

Malware can be simple or highly complex, autonomous or attacker-directed, opportunistic or targeted.

1.1 Key Characteristics

Malware typically:

Executes without user consent
Modifies system behaviour or files
Attempts to persist after reboot
Communicates with attackers
Conceals its presence

1.2 Why Malware Remains Dominant

Malware persists because:

It scales easily
It is low-cost for attackers
It can automate exploitation
Defensive controls vary widely in maturity

Malware remains the most common threat vector across industries.

2. Major Categories of Malware

Malware comes in many forms, each engineered for specific outcomes.

2.1 Viruses

Self-replicating programs that attach to legitimate files.
They require user action (e.g., opening a file) to spread.

Capabilities include:

File corruption
Payload delivery
System instability

2.2 Worms

Self-propagating malware that spreads autonomously across networks.
They do not require user interaction.

Notable example:
The WannaCry worm spread globally in hours by exploiting a single Windows vulnerability.

2.3 Trojans

Malicious software disguised as legitimate programs.

Types include:

Remote Access Trojans (RATs)
Banking trojans
Downloader trojans

Trojans often serve as initial access vehicles for cybercriminals.

2.4 Ransomware

Malware that encrypts data or disables systems, demanding payment for restoration.

Characteristics:

Rapid propagation
Strong cryptography
Financial extortion

Ransomware is currently the most financially damaging malware type.

2.5 Spyware

Designed to collect sensitive information such as:

Keystrokes
Screenshots
Credentials
Network traffic

Spyware is widely used for espionage and credential theft.

2.6 Rootkits

Toolsets that modify low-level system components to hide malware activity.

Capabilities:

Kernel manipulation
Process hiding
Network interception

Rootkits represent some of the most challenging threats to detect.

2.7 Bots and Botnets

Bots are infected devices controlled remotely.
A botnet is a network of such devices used for:

DDoS attacks
Spam distribution
Credential stuffing
Cryptomining

Botnets allow adversaries to scale attacks exponentially.

3. Malware Architecture and Lifecycle

Malware is constructed using modular components, each serving a functional purpose.

3.1 Dropper or Loader

Initial code that installs the main payload.

3.2 Payload

The core malicious functionality:

Encryption
Data theft
Remote access

3.3 Persistence Mechanism

Ensures malware remains operational after reboot.
Examples:

Registry modifications
Scheduled tasks
System services

3.4 Command and Control Channel

Used to receive instructions and exfiltrate data.

3.5 Evasion Techniques

Mechanisms to bypass security controls.

Understanding the lifecycle allows defenders to disrupt malware at multiple stages.

4. How Malware Spreads

Malware relies on reliable delivery channels. Common methods include:

4.1 Phishing

Email attachments or links triggering malware installation.

4.2 Exploit Kits

Web-based frameworks targeting browser or plugin vulnerabilities.

4.3 Software Vulnerabilities

Unpatched systems invite exploitation.

4.4 Removable Media

USB devices remain an effective vector.

4.5 Supply Chain Compromise

Attackers insert malware into trusted software updates.

Sophisticated actors choose delivery methods that align with their operational goals.

5. Evasion Techniques Used by Modern Malware

5.1 Obfuscation

Hiding malicious code within seemingly benign files.

5.2 Polymorphism

Constantly changing code signatures to avoid detection.

5.3 Living-off-the-Land Techniques

Using built-in system tools (e.g., PowerShell) to avoid appearing malicious.

5.4 Anti-Analysis Methods

Detecting virtual machines, sandboxes, or debugging tools.

5.5 Encryption of Communications

Hiding C2 traffic via TLS or covert channels.

Malware evolves continuously, forcing defenders to adapt detection techniques beyond simple signature matching.

6. High-Profile Malware Case Studies

6.1 WannaCry

A worm-based ransomware that exploited EternalBlue (MS17-010).
Impact:

Hundreds of thousands of infected systems
Hospitals and critical services disrupted
Billions in economic losses

6.2 Stuxnet

Highly sophisticated malware targeting industrial control systems.
Impact:

Sabotaged nuclear centrifuges
Demonstrated that malware can cause physical destruction

6.3 Emotet

A modular banking trojan turned global botnet.
Impact:

Enabled massive ransomware deployments
Generated widespread credential theft

Each case illustrates the strategic design choices behind malware.

7. Reflection Questions

Why do worms propagate faster than viruses?
Which malware category poses the biggest long-term danger?
How do evasion techniques undermine traditional antivirus approaches?
Why is ransomware more financially successful than other malware?

Summary

Malware represents a diverse and continually evolving class of cyber threats. From ransomware to rootkits and botnets, each type employs unique behaviours, lifecycles, and objectives. Understanding these structures is essential for designing defensive strategies, detecting anomalous behaviour, and responding effectively to incidents.

This foundational understanding prepares learners for upcoming modules on ransomware mechanics, botnet architecture, advanced persistent threats, and supply-chain compromises.