How We Classify Malware

We classify by propagation (how it spreads) and by payload / purpose (what it does). A single sample often wears several hats — a dropper that installs a RAT that deploys ransomware.

• Propagation: virus, worm.
• Access and control: trojan, RAT, rootkit, botnet.
• Delivery: dropper, loader.
• Impact: ransomware, wiper.

Labels are useful shorthand, not rigid boxes.