What Is Malware?

Malware is any software written to cause harm — to steal data, deny access, take control or consume resources. The term covers an enormous range and the traditional categories within it have become less useful than they once were.

Modern samples are modular. A single intrusion may involve a loader, a remote access component, a credential stealer and an encryption payload, assembled from separately maintained parts. Asking which category it belongs to is less informative than asking how it arrived and what it can do.

Delivery and capability, rather than taxonomy

Delivery determines which control would have stopped it: email attachment, web exploitation, poisoned installer, compromised update, removable media, or hands-on deployment by an intruder already inside.

Capability determines the consequence: does it steal credentials, does it move laterally, does it stage data for exfiltration, does it destroy. Those two questions map directly to controls and to response priority in a way the category name does not.

Malware as a service

The ecosystem has specialised. Access brokers obtain and sell footholds. Loader operators deliver other people's payloads for a fee. Development groups license their tooling to affiliates who operate it.

That division of labour is why a single compromised machine frequently hosts several unrelated payloads, and why an initial commodity infection can be followed weeks later by a serious targeted intrusion — the access was resold.

Why signature detection stopped being sufficient

Samples are recompiled, packed and obfuscated automatically, so the file differs for every target and no hash matches. A great deal of malicious activity uses no distinctive file at all, running in memory or through tooling already installed.

Behavioural detection asks what the software does rather than what it is, which is why endpoint detection replaced signature scanning as the primary control.

The controls that matter most

Patching, which removes the exploitation route. No standing local administrator rights, which limits what a successful execution achieves. Application control, so unapproved executables do not run at all.

Then behavioural detection for what gets through, and outbound network control, because most payloads are useless without reaching their infrastructure.

Response, and what gets skipped

Isolating the host and removing the payload is the visible part. The parts routinely missed are establishing how it arrived, checking whether credentials on that machine were stolen, and searching the estate for the same indicators.

That last step is the difference between cleaning one machine and finding the other eleven. See malware analysis for how the indicators are obtained quickly.

Sandbox analysis and its limits

Automated execution in an isolated environment produces behavioural reports quickly and is routinely evaded. Samples check for virtualisation artefacts, analysis tooling, small disks, absent user activity and insufficient elapsed time, then behave harmlessly when they find any of it.

Others require an operator command before acting, or only activate under conditions the sandbox does not reproduce — a specific domain membership, a particular language setting, a target geography. A clean sandbox verdict is therefore weak evidence, and it is frequently reported as conclusive.

Where to start

Establish whether application control is in place anywhere in your estate. It is the control with the largest gap between how effective it is and how widely it is deployed.

See prevention and recovery. GuardsArm delivers managed detection and response.