{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/malware","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/malware/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/malware/"},"term":{"en":"Malware","da":"Malware"},"aka":{"en":["malicious software"],"da":["skadelig software"]},"domain":["security"],"cluster":"fundamentals","layer":"host","status":"current","era":1990,"summary":{"en":"Harmful software that sneaks onto a computer or phone to steal, spy, damage or take control.","da":"Skadelig software, der sniger sig ind på en computer eller telefon for at stjæle, spionere, ødelægge eller tage kontrollen."},"body":{"formal":{"en":"Any program written to act against the interests of the device's owner - including viruses, worms, spying software and ransomware - usually running without the user knowing and spread through attachments, downloads or unpatched flaws.","da":"Ethvert program, der er skrevet til at handle imod ejerens interesser - herunder virus, orme, spyware og ransomware - og som typisk kører, uden at brugeren ved det, og spredes via filer i mails, downloads eller huller, der ikke er lukket."},"plain":{"en":"A stranger hiding in your house who reads your letters, copies your keys or quietly breaks things.","da":"En fremmed, der gemmer sig i dit hus og læser dine breve, kopierer dine nøgler eller stille og roligt ødelægger ting."},"inPractice":{"en":"A finance clerk in a municipality opens a fake invoice attached to an email, and a hidden program starts sending the passwords saved in her browser to an attacker.","da":"En medarbejder i en kommunes økonomiafdeling åbner en falsk faktura vedhæftet en mail, og et skjult program begynder at sende de adgangskoder, der er gemt i hendes browser, til en angriber."},"whyItMatters":{"en":"Once harmful software runs inside the organisation, it can do anything the user can - and often much more.","da":"Når skadelig software først kører inde i organisationen, kan den gøre alt, hvad brugeren kan - og ofte meget mere."}},"deepDive":{"en":"Malware is an umbrella term for a wide taxonomy distinguished by propagation and purpose rather than by any single trait. A virus attaches itself to a host file and spreads when that file is executed; a worm is self-propagating and needs no host, historically spreading across networks by exploiting remote services; a trojan masquerades as legitimate software; a rootkit hides its presence by subverting the operating system, sometimes at kernel or firmware level; and a bot enrols the host into a command-and-control (C2) botnet. Ransomware, spyware, keyloggers, cryptominers and wipers are categories defined by payload. Modern samples are usually multi-stage: a small loader or dropper establishes a foothold and then pulls further modules, so the initially delivered file often contains little of the final capability.\n\nDetection has moved through three broad generations. Signature-based antivirus matches known byte patterns or file hashes and is fast but blind to novel or repacked samples; heuristic and static analysis inspect structure and suspicious API imports; behaviour-based endpoint detection and response (EDR) watches runtime actions - process injection, credential access, mass file encryption - and can catch previously unseen malware by what it does. Attackers respond with evasion: packers and crypters that obfuscate the binary, polymorphic and metamorphic code that changes its own form, sandbox-detection that stays dormant under analysis, and increasingly fileless techniques that run entirely in memory or abuse legitimate tools already on the host (the living-off-the-land pattern), leaving little for a file scanner to find.\n\nDelivery today is dominated by phishing attachments and links, malicious or compromised websites (drive-by downloads), trojanised software and updates, and exploitation of unpatched internet-facing services. Once running, malware typically establishes persistence (registry run keys, scheduled tasks, services), beacons to C2 infrastructure over HTTPS or DNS to blend with normal traffic, and may attempt to disable security tooling. The MITRE ATT&CK matrix catalogues these behaviours as techniques, which is why defenders increasingly hunt for behavioural indicators and TTPs rather than relying on static indicators of compromise such as hashes, which change trivially between samples.\n\nContainment rests on layered controls: application allow-listing so only approved binaries execute, least privilege so a payload inherits limited rights, network segmentation to limit spread, prompt patching to close exploited flaws, and tested offline backups so a wiper or ransomware event is recoverable. A common misconception is that malware requires the user to run an executable; macro-enabled documents, script interpreters, browser exploits and supply-chain compromises all execute code without a deliberate double-click. Malware is one mechanism a threat uses; it is distinct from the vulnerability it may exploit to gain entry, and from the human-driven attack techniques, such as lateral movement, that a foothold then enables.","da":"Malware er en paraplybetegnelse for en bred taksonomi, der skelnes efter spredningsmåde og formål snarere end ét enkelt træk. En virus hægter sig på en værtsfil og spreder sig, når filen køres; en orm er selvspredende og har ingen vært, men bredte sig historisk over netværk ved at udnytte fjerntjenester; en trojaner udgiver sig for at være legitim software; et rootkit skjuler sin tilstedeværelse ved at undergrave styresystemet, undertiden på kerne- eller firmwareniveau; og en bot indruller værten i et command-and-control-botnet (C2). Ransomware, spyware, keyloggere, cryptominers og wipers er kategorier defineret ved deres payload. Moderne malware er typisk flertrins: en lille loader eller dropper skaffer fodfæste og henter derefter yderligere moduler, så den først leverede fil ofte rummer lidt af den endelige funktionalitet.\n\nDetektion har bevæget sig gennem tre grove generationer. Signaturbaseret antivirus matcher kendte bytemønstre eller filhashes og er hurtig, men blind for nye eller ompakkede prøver; heuristik og statisk analyse inspicerer struktur og mistænkelige API-kald; adfærdsbaseret endpoint detection and response (EDR) overvåger handlinger under kørsel - procesinjektion, adgang til loginoplysninger, masse-kryptering af filer - og kan fange hidtil uset malware ud fra, hvad den gør. Angribere svarer igen med evasion: packere og cryptere, der slører binæren, polymorf og metamorf kode, der ændrer sin egen form, sandbox-detektion, der holder sig i dvale under analyse, og i stigende grad fileless teknikker, der kører helt i hukommelsen eller misbruger legitime værktøjer, der allerede findes på værten (living-off-the-land-mønstret), så en filscanner har lidt at finde.\n\nLevering domineres i dag af phishing-vedhæftninger og -links, ondsindede eller kompromitterede websteder (drive-by downloads), trojaniseret software og opdateringer samt udnyttelse af upatchede internetvendte tjenester. Når malware først kører, etablerer den typisk persistens (registry run-nøgler, planlagte opgaver, tjenester), sender beacons til C2-infrastruktur over HTTPS eller DNS for at gå i ét med normal trafik og kan forsøge at slå sikkerhedsværktøjer fra. MITRE ATT&CK-matrixen katalogiserer denne adfærd som teknikker, og derfor jager forsvarere i stigende grad adfærdsindikatorer og TTP'er frem for at læne sig på statiske kompromitteringsindikatorer som hashes, der ændrer sig trivielt mellem prøver.\n\nInddæmning hviler på lagdelte kontroller: application allow-listing, så kun godkendte programmer kører, least privilege, så en payload arver begrænsede rettigheder, netværkssegmentering for at begrænse spredning, hurtig patching for at lukke udnyttede fejl, og testede offline-backups, så en wiper- eller ransomwarehændelse kan genoprettes. En udbredt misforståelse er, at malware kræver, at brugeren kører en eksekverbar fil; makroaktiverede dokumenter, script-fortolkere, browser-exploits og supply chain-kompromitteringer eksekverer alle kode uden et bevidst dobbeltklik. Malware er én mekanisme, en trussel bruger; den er forskellig fra den sårbarhed, den kan udnytte for at komme ind, og fra de menneskestyrede angrebsteknikker, fx lateral bevægelse, som et fodfæste derefter muliggør."},"edges":[{"type":"requires","to":"security/endpoint","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"exploits","to":"security/vulnerability","why":{"en":"It often gets in through unpatched software or by tricking a user into running it.","da":"Den kommer ofte ind via software, der ikke er opdateret, eller ved at narre en bruger til at køre den."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/data-breach","why":{"en":"Much harmful software exists to copy data out of the organisation.","da":"Meget skadelig software findes netop for at kopiere data ud af organisationen."},"confidence":"high","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST Glossary - Malware","url":"https://csrc.nist.gov/glossary/term/malware","tier":"standard","publisher":"NIST"}],"draft":true}