Ransomware
A ransomware works by infecting a company network or a personal computer, and it will start by disabling any security software that is installed to avoid detection. Once the ransomware has disabled any security software, it will target all files on the main drive (C:\) and encrypt them. Depending on the features of the ransomware, it could have network share encryption, mounting network shares and encrypting them, bypassing authenticated shares etc., it will execute those features and encrypt anything that it can. After it is done encrypting everything (usually using AES-256), it will drop a ransom note in every folder that is successfully encrypted, which will provide instructions on how to pay the ransom fee. With some ransomwares, there is a online web panel, that the attacker can access to see information about the systems that are infected, and to manage the ransomware itself. With these online web panels for managing the ransomware, they often use RSA key pair exchange with RSA 4096 encryption to ensure that the attacker remains anonymous, and extra protection. Depending on the ransomware features, if the ransom is not paid within a certain amount of time, the files could be permanently deleted, or published online on a leaks' website. After the fee has been paid, the decryption key, as well as a decryptor will be provided to the victim of the ransomware attack, and they will put that key into the decryptor, it will then decrypt all files that were encrypted by the ransomware. Usual methods of infection with a ransomware is by using a botnet, and botnets are grown through the use of other malwares, such as trojans, worms etc. The ransomware will be dropped onto the zombie computers, and it will start encrypting all the files on the system. Another method of infection is by paying someone in a company to execute it on their company device, which will then spread to the rest of the company network.
Trojans
A trojan works by disguising itself as a legitimate software, but the payload of the trojan can be anything, such as a spyware, a keylogger, a ransomware, an infostealer etc, literally any malware can be a payload to the trojan. The trojan tricks the user into downloading it and executing it by pretending to be a real software, or a real software that has been hijacked. Once the trojan has been executed, it will start executing the payload, and it will start doing whatever the payload is supposed to do. Depending on the features of the trojan, it could have a feature where by it will persist and survive reboots of the system, so that it can continue to do its suspicious things. Usual spreading methods of a trojan is through phishing emails, where the attacker will send a fake email pretending to be a legitimate company, and the email will ask the victim to download an attachment, which would be the trojan, and then tell the victim to execute the program attachment.
Virus
A virus works by infecting a system and then spreading to other systems, and to do this, it attaches itself to a hosts file, or the boot loader of the system to allow it to self replicate. Once the virus has been executed, it will start spreading to other files and attaching itself to them, and when those files are executed, it will also execute the virus.
Spyware
Spyware works by infecting a network or system, and running silently in the background, usually without the user knowing. It usually infects the system through phishing emails, or by the user downloading a program that has spyware secretly bundled with it. Once the spyware has been executed on the system, it will hide itself as a background process, and begin gathering information on the victim. Some methods of gathering information with a spyware include; keyloggers, infostealers, screen monitoring, camera monitoring, microphone monitoring, and monitoring network traffic. The spyware will then send any information that it has gathered to the attacker, and the attacker will then use any information that they get, they will likely use it to extort the victim, or sell the information to other cybercriminals, for them to use as blackmail/extortion material.
Info Stealer
The way an information stealer (infostealer) works is by infecting a target company or individual's system, it usually infects the system through phishing emails or malicious software that has been disguised as something legitimate, or sometimes it can be dropped by a trojan malware or a loader/dropper malware. Once the infostealer has been executed on the system, it will do similar operations as a spyware. It will start gathering information on the company or individual, and send any gathered data to a C2 server. Most common information that is targetted by a stealer malware, would be stuff like credit card numbers, banking information, crypto wallets, crypto wallet seeds, browser cookies, and any other kind of sensitive information that the attacker can use to extort the victim, or just sell the information on tor.
Worm
A worm malware works by infecting a system. It infects systems by exploiting software vulnerabilities, and it is fully autonomous, however sometimes it will need an entry point, meaning the user would need to open an attachment of some kind to begin the spreading of it. Since a worm is autonomous, it means that it does not require any kind of user interaction to spread, apart from the initial infection. Once the worm has infected a system, it will start rapidly spreading through any way it can, such as email, instant messaging, file transfer networks and over the network itself. A worm also self replicates like a virus, but it does not require user interaction to spread and self replicate. More advanced worms can have features such as a C2 server, to receive any updates or commands from the attacker, such as new exploits to use to make it harder to detect and stop.