Malware Types
Common categories of malicious software.
The main families of malicious software, each with a description and its typical delivery route: viruses, worms, trojans, ransomware, spyware, adware and rootkits, plus botnets, keyloggers, fileless malware and other types that shape incident-response vocabulary.
Use it when
- You need consistent names when writing an incident report or training material.
- You are matching a malware family to the controls that typically stop its delivery.
Watch out for
- Real malware often combines several behaviors, and vendors name families inconsistently.
- Delivery columns describe typical routes, not the only ones.
The data
15 rows
| Type | Description | Delivery |
|---|---|---|
| Virus | Malware that attaches to legitimate programs and spreads when executed. | Infected files |
| Worm | Self-replicating malware that spreads across networks. | Network exploits |
| Trojan | Malware disguised as legitimate software. | Social engineering |
| Ransomware | Encrypts files and demands payment for decryption. | Phishing, exploits |
| Spyware | Secretly monitors user activity. | Bundled software |
| Adware | Displays unwanted advertisements. | Bundled software |
| Rootkit | Hides malware presence deep in the operating system. | Exploits |
| Botnet | A network of compromised machines controlled remotely, used for DDoS, spam or proxying. | Malware infections of many hosts, exposed services |
| Keylogger | Records keystrokes to steal credentials and other input. | Trojans, malicious attachments, compromised software |
| Backdoor | Provides covert remote access that bypasses normal authentication. | Trojans, supply-chain compromise, post-exploitation implants |
| Fileless Malware | Runs in memory or through built-in tools such as scripting engines, leaving little on disk. | Phishing, exploited services, living-off-the-land techniques |
| Logic Bomb | Malicious code that triggers on a condition such as a date or a deleted account. | Insider planting, trojans |
| Cryptojacker | Uses a victim's compute to mine cryptocurrency without consent. | Malicious scripts, compromised servers and containers |
| Wiper | Destroys data or systems rather than holding them for ransom. | Targeted intrusions, spread through networks |
| Dropper / Loader | A small program whose job is to install or fetch the main payload. | Phishing attachments, malicious downloads |
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| data | type | string | Virus |
| data | description | string | Malware that attaches to legitimate programs an… |
| data | delivery | string | Infected files |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.com/api/dataset/malware-types?format=toon"
const res = await fetch( "https://yjtoon.com/static-data/dataset/malware-types.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →