What is malware?¶

Malware is software or code used to perform unauthorised, harmful or deceptive activity.

Avoid the dangerous assumption¶

The dangerous assumption is that malware is one single thing with one predictable effect.

It is not.

Malware may be designed to:

• steal information
• record keystrokes
• take remote control
• download further code
• encrypt files
• disrupt services
• hide activity
• create persistence
• use the device as part of a botnet
• consume computing resources.

The label may describe purpose, behaviour or family. Terms such as trojan, spyware, downloader and ransomware may overlap because one item can perform several functions.

For investigators, the important questions are:

• what was present
• whether it executed
• what it was capable of doing
• what it actually did
• which account or device context it used
• what evidence remains.

Do not assume that finding a malicious file proves compromise. The file may have been downloaded, blocked, quarantined, partially written or never executed.

Equally, the absence of a known malware file does not prove no compromise occurred. An offender may have used scripts, memory-only techniques, legitimate tools or remote access.

Preserve the original file where lawful and safe, together with file path, timestamps, hash values, detection records, process activity, network connections and any analyst findings.

Do not open or test suspected malware on an ordinary investigative device.

Malware evidence may help establish method, capability, sequence and affected systems. It will not automatically identify the offender, prove every capability was used or show who initiated execution.

Operational takeaway¶

Establish what code was present, whether it executed and what behaviour followed before describing a system as compromised by malware.