Step 168. Malware Structure: Trojans and Ransomware — Dissecting Without Building

Level 2 — Introduction to Security and Attack Skill Basics | Difficulty ★★★☆☆ | Estimated time: 3 hours

Prerequisites: Step 167 (social engineering) complete. You know phishing is an "intrusion path."

What you need: a text editor (for building the classification table), internet search (for reading public analysis reports)
Chapter type: today is a [concept] chapter. There is no exercise that creates or runs malware. We proceed only with structural explanation, text diagrams, and reading public analysis results.
Ethical/legal boundary: writing or distributing malware is a serious crime under telecommunications law, and the excuse "I made it for study" doesn’t work. Downloading samples is also off-limits at this stage — today is entirely structural understanding and defender-perspective analysis.

Malware news comes out every week, but few people actually know "what it looks like inside." Trojans, worms, and ransomware get mixed together in the news as if they were similar words, but their structures are completely different — they reproduce differently, hide differently, and make money differently.

Today you dissect malware into four kinds and draw the lifecycle every malware shares (intrusion → execution → persistence → objective). At the end, you take apart ransomware’s encryption flow as a concept diagram. You won’t write a single line of code, but when you’re done, malware analysis reports will start to read — that’s today’s goal.

1. Learning Objectives

By the end of this chapter, you will be able to:

Distinguish viruses/worms/Trojans/ransomware by the criterion of reproduction method
Explain malware’s 4-stage lifecycle and point out the detection points of each stage
Explain why downloaders, droppers, and C2 communication split into stages
Explain ransomware’s encryption flow (hybrid encryption) with a concept diagram
Know how to read public analysis reports and sandbox reports

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Concept-focused + one read-only measurement (Windows registry query)
Today’s commands	`reg query "HKCU\...\Run"` (read-only — a look at a persistence location)
Concepts needed	the 4-way malware classification, lifecycle, payload staging, hybrid encryption, sandboxes
Today’s artifact	one classification table + a lifecycle diagram + a ransomware encryption concept map

2-1. Dissecting the Four Kinds — The Criterion Is "How It Reproduces"

Kind	Reproduction/intrusion method	Disguise	Representative case
Virus	Parasitic on a host file — spreads only when that file runs	The host itself	Early boot/file infectors
Worm	Self-replicates and spreads over the network — no host needed	None	WannaCry (propagation part)
Trojan	Doesn’t reproduce — the user installs it themselves as a "legitimate program"	Masquerades as a normal app	Fake utilities, cracked software
Ransomware	After intrusion, encrypts files as hostages	Varies	WannaCry (encryption part), LockBit

How to read it: the classification criterion is not "what it does" but "how it spreads." This is why WannaCry spans two cells — the part that self-propagated over the network was a worm, and the part that encrypted files and demanded money was ransomware. Real malware is often a combination like this.

2-2. The 4-Stage Lifecycle — Every Malware’s Common Skeleton

① Intrusion  →  ② Execution  →  ③ Persistence  →  ④ Objective
(phishing, vulns)   (user click)   (survives reboot)   (encryption, theft, C2)

① Intrusion: mostly Step 167’s phishing, or an unpatched vulnerability. The boundary of technology and psychology meets here.
② Execution: a macro in a document, an attached executable, etc. The scene of "a normal program spawning a strange child process."
③ Persistence: devices that survive reboot — Windows Run keys, service registration, Linux cron. The defender’s key detection point.
④ Objective: file encryption (ransom), information theft (spyware), remote control (C2 communication).

Each stage is a defender’s opportunity. The reason for memorizing the lifecycle is that defense is knowing "where it can be cut." ① is handled by phishing training and patching, ② by execution policy, ③ by monitoring auto-start locations, ④ by blocking external communication and backups. The damage completes only if all four stages are pierced — cut any one and it stops. Defense gets four chances.

Conversely, the attacker must succeed at all four stages. This asymmetry — attack needs every stage, defense needs one cut — is the real reason to learn the lifecycle.

2-3. Why Split into Stages — Downloaders and Droppers

Real malware’s first infiltrating piece is small. A downloader is a stage-1 of tens of KB that, after intrusion, downloads the main body (the stage-2 payload) from the internet. A dropper carries the main body inside itself and lays it down.

The reason for splitting stages is detection evasion. A small, simple stage-1 rarely matches antivirus signatures, and the main body is fetched when needed, making analysis harder too. And the source of the commands the main body receives is the C2 (Command & Control) server — the headquarters the malware periodically asks for "the next job." The suspicious connections in a sandbox report’s network section are mostly this.

2-4. Ransomware’s Encryption Flow — Why Recovery Fails

Ransomware’s strength comes from legitimate uses of cryptography. Let’s look at the concept map.

[Victim PC]                                    [Attacker]
① Generate a symmetric key (AES) on the infected PC
② Encrypt files at high speed with the symmetric key  ← the point files get locked
③ Encrypt the symmetric key with the attacker's public key (RSA)  ← the key's key
④ Delete the original symmetric key
⑤ Display the ransom note                The private key exists only here

The core is ③~④. Even the symmetric key that locked the files gets locked with the attacker’s public key, and the private key that opens it exists only on the attacker’s server. This is hybrid encryption — fast symmetric for the bulk, safe public-key for the key. The same principle as the web’s TLS (Steps 110–111), used for the opposite purpose.

So defense’s conclusion is not "decrypt" but "roll back" — offline backups. Not breaking the encryption but returning to the state before the lock is the only certain response.

2-5. WannaCry — The Incident That Became a Textbook

2017’s WannaCry packed nearly every concept in this chapter into one incident. It was a combination — a worm that self-propagated through an SMB vulnerability (EternalBlue) + ransomware that encrypted files — and it paralyzed hospitals and companies worldwide.

And the famous scene discovered by analyst Marcus Hutchins: the malware, on execution, tried to connect to a specific domain and was designed to stop spreading if a response came back. He registered that unregistered domain and made it respond, and the spread stopped — the famous kill switch. An incident where an analyst who read the malware’s logic turned that logic back on it. In today’s mission you read the related report yourself.

3. Follow Along

3-1. Completing the Classification Table

Rewrite 2-1’s table without looking at the book, then add one case to each cell. Practice asking yourself the criterion questions.

"Does it spread by itself?" → yes: worm / no: next question
"Is it parasitic on a host file?" → yes: virus
"Does the user install it believing it’s a normal program?" → yes: Trojan
"Is the objective file encryption + ransom?" → yes: ransomware

How to read it: ransomware is classified by objective, not reproduction method — its axis differs from the other three. That’s why combinations like "worm + ransomware" hold — discovering that the classification table’s axes differ is half of today’s understanding.

Other names appearing in the news fit this table too. Spyware (secretly exfiltrates information) and keyloggers (eavesdrop on input) are variants of the objective column, and a backdoor (a secretly opened rear door) is one form of ④ objective. Whenever you meet a new name, decompose it with two questions — "how does it get in, and what does it do once in?" Most resolve into combinations of this table.

3-2. A Look at a Persistence Location — The Run Key (Read-Only Measurement)

Let’s confirm that ③ persistence isn’t abstract. The place where Windows writes the list of programs auto-run at every login — one of malware’s most beloved addresses. Read only. Add or delete nothing.

Input

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"

Output (measured 2026-09-09 — personal environment; some entries may differ for you):

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    OneDrive    REG_SZ    "C:\...\OneDrive.exe" /background
    KakaoTalk    REG_SZ    "C:\Program Files\Kakao\KakaoTalk\KakaoTalk.exe" -bystartup
    MicrosoftEdgeAutoLaunch_...    REG_SZ    "...\msedge.exe" --no-startup-window --win-session-start

How to read it: everything visible is legitimate software — that’s the point. This location is a shared entrance used by the legitimate and the malicious alike, so antivirus and EDR watch this key for changes. If there’s an entry you don’t recognize on your screen, that’s the starting point of persistence detection. The Linux counterparts are crontab -l and /etc/cron.d/ (it connects to why cron appeared as privilege-escalation material in Steps 97–99).

3-3. Reading a Public Analysis Report — WannaCry

Search "WannaCry analysis" or "WannaCry technical analysis" and pick one report from a security company (e.g., Kaspersky, Talos). Three things to find while reading:

Intrusion/spread path: which vulnerability it spread through (a real case of ①)
Kill switch: how the domain-check logic is described
IoCs (indicators of compromise): the hash/domain/IP list at the report’s end — the list defenders share as "look for this"

How to read it: understanding only half at first is normal. The goal of report reading is not understanding everything but seeing "in what order (the lifecycle) the analyst tells the story."

3-4. Browsing a Sandbox Report

A sandbox is a facility that runs a suspicious file in an isolated virtual machine and records its behavior. Public services like any.run and Hybrid Analysis publish analysis results of samples others uploaded — we only read results, running nothing.

Three sections to read in a report:

File activity: which files it created and modified (traces of ② execution)
Registry: did it touch Run keys? (traces of ③ persistence — the very address from 3-2)
Network: where did it connect? (candidates for ④ C2)

How to read it: read the three sections connected to lifecycle numbers. A sandbox report is really "a lifecycle observation record." You, who learned the lifecycle today, already have the reading frame for this report.

One caution. "Uploading" a file to a sandbox service yourself and "viewing" published results are different. Upload a suspicious internal company document to a public sandbox, and that document can become visible to the whole world — at this stage, view only.

3-5. Ransomware Defense — From Concepts to My Own Checklist

Apply the defense derived from the structure to your own environment.

Backup check: are copies of important files outside this computer (an external drive kept detached, or cloud versioning)? — ransomware encrypts connected backup disks too
Macros blocked by default: are macros in downloaded Office documents disabled by default? (a setting that cuts ② execution)
Suspicious-attachment procedure: confirm that Step 167’s channel-separation principle is the procedure that cuts ① intrusion

One more. Patch management — the SMB vulnerability WannaCry exploited already had a security update two months before the incident. The paralyzed systems were mostly ones that "put off the update." If backup is the after-the-fact response, patching is the before-the-fact block. The two aren’t substitutes — they’re a set.

4. Missions & Exercises

Mission — Completing the Malware Structure Document

Close the book and rewrite the four-kind classification table — each row including its "criterion question" and one case
Draw the 4-stage lifecycle diagram, and under each stage write one line: "how a defender cuts it here"
Redraw 2-4’s ransomware concept map in your own words, and write "why backup is the only certain response" grounded in the map’s ③④
Read one WannaCry analysis report and record answers to 3-3’s three items, with title and source
Open one public sandbox report and annotate the three sections (file/registry/network) with lifecycle numbers

Exercises

Exercise 1. Explain the difference between a worm and a virus using the concept of a "host."

Exercise 2. Explain why a downloader stays small, from the perspective of the defender’s signature detection.

Exercise 3. Explain why persistence is a "detection point" for defenders — why does malware need it, and why does that need become a weakness?

Exercise 4. Explain why ransomware uses both a symmetric key and a public key (hybrid), in terms of each key’s properties.

5. Model Answers & Completion Criteria

Mission Model Answer

Example of a lifecycle + cut-points diagram:

① Intrusion — phishing mail/vulnerabilities   → cut: channel-separation procedure, patching
② Execution — macros/attachment execution     → cut: macro blocking, execution policy
③ Persistence — Run keys/service registration → cut: auto-start location monitoring (the address you saw today)
④ Objective — encryption/C2 communication     → cut: offline backups, anomalous outbound-traffic blocking

How to verify: ① Does each classification-table row include a "criterion question"? ② Does every stage of the diagram have a cut method attached — an empty stage means that concept is under-understood? ③ Does the ransomware explanation reach "without the attacker’s private key it can’t be opened"? ④ Does the report record have a source and mention the kill switch?

Exercise Answers

Answer 1. A virus is parasitic on a host file and spreads only when that file runs or is passed along. A worm self-replicates without a host and spreads over the network. The practical difference is speed — a worm doesn’t wait for human action, so it can spread worldwide in hours, like WannaCry.

Answer 2. Signature detection looks for the fingerprints of known code. The smaller and simpler stage-1 is, the fewer fingerprints it has and the easier it is to mutate, so it evades detection. The main body is fetched after intrusion, so at static-analysis time it effectively doesn’t exist.

Answer 3. Malware must survive reboots, so it must register itself with an auto-start mechanism (Run keys, services, cron). But those locations are well-known and monitorable — "to survive it must register, and registering makes it visible." A mandatory action becoming a trace is exactly why it’s a defender’s target.

Answer 4. A symmetric key (AES) is fast but has a key-delivery problem; a public key (RSA) is slow but safe to publish. Ransomware locks the bulk of files with the fast symmetric key and locks just that one key with the public key. The same combination as TLS — the standard solution for gaining both speed and safe key delivery, abused.

Completion Criteria Checklist

[ ] I can rewrite the four-kind classification table without the book
[ ] I can state the 4-stage lifecycle and each stage’s cut point
[ ] I can explain the roles of downloader/dropper/C2
[ ] I can draw ransomware’s hybrid-encryption concept map
[ ] I confirmed with my own eyes what a Run key (or cron) actually looks like
[ ] I read one WannaCry report and can explain the kill switch
[ ] I can connect a sandbox report’s three sections to the lifecycle
[ ] I can state why creating malware/running samples is outside this stage’s scope

6. Common Pitfalls & Fixes

Wall 1. The classification criteria keep mixing

Symptom: phrases like "Trojan ransomware" confuse you.
Cause: Trojan (intrusion method) and ransomware (objective) are different classification axes.
Fix: always separate the two questions — "how did it get in" (intrusion) and "what does it do once in" (objective). Real cases are almost all combinations, so the axes must be split for the news to read accurately.

Wall 2. I feel like deleting something while looking at the Run key

Symptom: an unrecognized entry triggers deletion urges.
Cause: 3-2 is an observation exercise. Unknown ≠ malicious (it could be legitimate software’s auto-update helper, etc.).
Fix: don’t delete. For suspicious entries, today’s scope ends at searching the name to confirm its identity. Delete the wrong one and legitimate programs break.

Wall 3. The report is too hard

Symptom: assembly, hashes, protocol analysis pour out.
Cause: professional reports are for professionals. A normal reaction.
Fix: do "targeted reading," finding only 3-3’s three items. Skipping paragraphs you don’t know is fine. Harvesting only the sentences that hook onto the lifecycle skeleton is today’s reading method.

Wall 4. I want to upload a sample to a sandbox myself

Symptom: curiosity — you want to obtain real malware and analyze it.
Cause: a natural desire as learning deepens, but it crosses this stage’s boundary.
Fix: downloading and running samples comes after a dedicated isolated environment and analysis training. For now, reading public results others uploaded is enough — and it’s also the everyday reading of working analysts.

Wall 5. The thought "now that I know the structure, I could build one"

Symptom: after drawing the concept map, implementation becomes imaginable.
Cause: evidence your understanding deepened — but depth of understanding and permission to execute are unrelated.
Fix: writing malware is a crime regardless of purpose. This structural knowledge’s legitimate output is not construction but defense design and report reading — today’s mission is exactly that output.

7. Summary

Today’s Concepts

Concept	One-line explanation
Virus	Parasitic on a host file — reproduces only when the host runs
Worm	Self-propagates over the network with no host — a different speed
Trojan	Disguised as a normal program — the user installs it themselves
Ransomware	Encrypts files as hostages — classified by objective
Lifecycle	Intrusion → execution → persistence → objective; each stage is a cut point
Downloader/dropper	A staged structure where a small stage-1 brings in the main body
C2	Malware’s headquarters — caught by network traces
Hybrid encryption	Symmetric for the files, public-key for that key — backup is the only answer
IoC	Indicators of compromise (hashes, domains, IPs) — the defender’s shared list
Kill switch	WannaCry’s spread-stopping logic — the case where analysis became a counterattack

Today’s Commands

Command/tool	What it does
`reg query "HKCU\...\Run"`	Read Windows auto-start locations (read-only)
`crontab -l`	The Linux persistence counterpart
any.run / Hybrid Analysis	Viewing public analysis results from sandboxes
Security-company analysis reports	An incident’s dissection record, narrated in lifecycle order

An Instinct More Important Than Commands

Today’s core insight is the structure that "malware’s needs are its weaknesses." To reproduce it must show on the network; to survive it must show in registration locations; to fulfill its objective it must show in files and external communication. Perfect concealment is impossible — and so defense evolves toward "watching behavior." The seed of behavior-based detection, which you’ll learn at the next stage, is exactly today’s lifecycle.

And the lesson ransomware left: nobody breaks modern cryptography head-on. Only those who bypass it (rolling back with backups) and those who cut it beforehand (blocking at the intrusion/execution stages) win. Knowing the structure is not for attacking — it’s for knowing where to cut.

Once every box is checked, Step 168 is complete. Click the checkbox in the sidebar to save your progress.