Classifying Core Malware: Taxonomy of Infection Mechanisms

Fri Sep 18 2026

The Data Model

Malware is not a monolith. The term covers distinct classes of malicious software that differ fundamentally in how they reach a target, when they activate, and what techniques they use to stay hidden. Understanding those differences matters — detection strategy depends entirely on which category you’re hunting.

The code models each threat as a structured record with typed enumerations for propagation mode and evasion technique:

@dataclass
class MalwareCategory:
    name: str
    description: str
    propagation: PropagationMode
    execution_trigger: str
    primary_evasion: EvasionTechnique
    secondary_evasions: List[EvasionTechnique]
    detection_difficulty: str

PropagationMode and EvasionTechnique are Enum types that mirror categories found in the MITRE ATT&CK framework’s Defense Evasion tactic — each value is a recognized anti-analysis technique rather than an informal label.

Five threats enter the system, each with its own classification profile:

Virus — Attaches to legitimate executable files or boot sectors. Requires a host file; triggered when a user runs it. Defends itself through polymorphic mutation: each new infection carries a different binary signature.

Trojan (Trojan Horse) — Masquerades as legitimate software, does not self-replicate. Lives entirely in memory after installation, touching no disk beyond the initial drop. Detection requires behavioral analysis.

Rootkit — Operates at kernel or hypervisor level (Ring 0). Rewrites system structures like process tables and file listings to hide itself and whatever accompanies it. Standard AV cannot see past Ring 0 hooks; detection requires out-of-band forensics.

Logic Bomb — Embedded inside otherwise benign software, lying dormant until a specific condition fires. Its primary evasion is environment-awareness — it checks whether the host is a sandbox or VM and refrains from detonating if analysis infrastructure is detected.

Backdoor — Opens a covert channel for persistent remote access, typically installed by another malware type. Persists as a listening service or periodic beacon to a command-and-control server, evading detection by mimicking legitimate admin traffic patterns.

Running it

The script iterates through all five categories, printing each threat’s full profile followed by a cross-reference matrix:

Category      Propagation                     Trigger                             Primary Evasion               
----------------------------------------------------------------------------------------------------------------
Virus         file infection (overwrites/inserUser runs the infected host program;polymorphic mutation of signat
Trojan (Trojanrelies on social engineering / uUser installs/runs the disguised propacking + runtime unpacking to
Rootkit       exploits OS/hypervisor-level accLoaded early in boot via driver explkernel-mode driver (Ring 0) hi
Logic Bomb    latent payload activated by specConditional: time-based (e.g. 'afterenvironment-aware: only runs w
Backdoor      covert channel (DNS, ICMP tunnelPersistent service — listens for inclateral movement mimicking leg

The matrix reveals structural patterns across the taxonomy:

Virus and Trojan both use packing as a primary or secondary evasion because they must survive initial download analysis before spreading.
Only Rootkit reaches Ring 0 directly — its ROOTKIT_KERNEL evasion is in a class by itself, rewriting system structures at the lowest privilege level.
Logic Bomb and Backdoor share environment-aware detection (CONDITIONAL) as a secondary or primary technique, checking sandbox/VM presence to avoid analysis.
Detection difficulty scales with access level: moderate for file-level threats, high for memory-resident ones, very high for kernel-level or conditionally-triggered payloads.

Takeaway

Malware classification is not about naming — it’s about mapping the chain from how it arrives to how it hides. A Virus needs a host file and polymorphic mutation. A Trojan needs user deception and lives in memory. A Rootkit rewrites the OS itself. A Logic Bomb waits for permission. A Backdoor mimics your own tools.

Detection strategy flows directly from that mapping: signature scanning against viruses, behavioral analysis for Trojans, out-of-band forensics for rootkits, conditional logic inspection for bombs, and traffic baseline comparison for backdoors. Get the classification wrong and you’re looking for the wrong thing.