Types of Malware: Virus, Worm, Trojan, Ransomware | AP Cybersecurity

AP Cybersecurity Topics › Types of Malware

Unit 4 • Topic 4.1 • Device Vulnerabilities and Attacks

Types of Malware Explained: Virus, Worm, Trojan, Ransomware & More

Malware is malicious software adversaries use to damage a device, steal data, or gain control. Topic 4.1 asks you to identify the type of malware from a scenario, so the exam tests whether you know each one by its defining behavior.

The malware types at a glance
Why the type matters
Real-world example
Key terms
Match it up
Check for Understanding
FAQ

9malware types to know

Spreadby user, or on its own

Goalsteal, disrupt, or control

Three malware types; the framework also covers trojans, spyware, rootkits, and more.

The malware types at a glance

Each type is defined by how it spreads or runs and what it does. The exam discriminates between them on exactly those traits, so this table is the fastest way to lock them in.

Malware	How it spreads / runs	The tell
Virus	A user runs or opens a file	Needs a click
Worm	Spreads computer to computer on its own	No human interaction
Trojan / RAT	Hidden in software that seems harmless	A RAT adds remote access
Ransomware	Encrypts the device's files	Demands payment for the key
Spyware	Tracks a user's actions	Sends data back to the adversary
Keylogger	Logs keystrokes (software or hardware)	Captures usernames and passwords
Logic bomb	Triggers when conditions are met	e.g. a specific date
Rootkit	Embeds in the operating system	Hides itself from detection
Fileless	Lives in RAM, uses legitimate programs	No file to scan

Scenario

Malware spreads across an office network on its own, with no one clicking anything. Which type is it?

Reveal answer

A worm. The defining trait is spreading from computer to computer without human interaction, unlike a virus, which needs a user to run a file.

Exam tip

Needs a click = virus, spreads alone = worm, hides in real software = trojan, encrypts for payment = ransomware, hides in the OS = rootkit, lives in RAM = fileless.

Why the type matters

Each type points to a different defense and a different indicator. Most malware is one or more files that anti-malware software can scan for by signature. Fileless malware is the hard case: with no file to scan, behavior-based detection is needed instead.

Naming the type quickly tells a defender what to look for and how to respond, which is exactly the judgment the exam scenarios test.

Scenario

Users suddenly cannot open their files and a screen demands payment for a decryption key. Which malware is this?

Reveal answer

Ransomware. It encrypts the device's files and demands payment within a time limit in exchange for the key.

Real-world example

WannaCry: a worm plus ransomware

The 2017 WannaCry outbreak combined a worm that spread across networks on its own with ransomware that encrypted files and demanded payment. It hit hospitals and businesses worldwide within hours.

Worm spread plus ransomware payload is a worst case.

Key Terms

Virus	Malware that activates when a user runs or opens a file.
Worm	Malware that spreads computer to computer on its own.
Trojan	Malware hidden in software that seems harmless; a RAT adds remote control.
Ransomware	Malware that encrypts files and demands payment.
Rootkit	Malware that controls the OS and hides itself.

Match It Up

Tap a term, then tap its definition. Correct pairs lock in green.

Term

Definition

All matched. Nice work.

Common Mistakes

Confusing viruses and worms

A virus needs a user to run a file; a worm spreads on its own.

Thinking a trojan announces itself

A trojan hides inside software that looks harmless; a RAT adds remote control.

Treating spyware and keyloggers as the same

A keylogger specifically records keystrokes; spyware is broader activity tracking.

Forgetting fileless malware

Fileless malware lives in RAM and uses legitimate programs, so file scanning may miss it.

Check for Understanding

Predict your answer before you tap. Click a choice to check it and read why.

Question 1

Which malware spreads from computer to computer without any human interaction?

B. A worm self-propagates across systems with no user action.

Question 2 Predict first

Malware that encrypts files and demands payment for the key is:

C. Ransomware encrypts files and demands payment for the decryption key.

Question 3

Which statements are true? I. A virus needs a user to run a file. II. A rootkit hides itself in the OS. III. A worm requires a user to click.

A. I and II are true; a worm spreads without user interaction, so III is false.

Question 4 Predict first

Malware hidden inside seemingly harmless software, sometimes adding remote access, is a:

B. A trojan hides in safe-looking software; a remote access trojan (RAT) adds remote control.

Question 5

Why is fileless malware harder to catch with traditional anti-malware?

A. With no file on disk, signature-based file scanning has nothing to match; behavior-based detection is needed.

Question 6

Software that triggers its effect only when a specific date is reached is a:

D. A logic bomb activates only when its set conditions, such as a date, are met.

Frequently Asked Questions

Viruses, worms, trojans (including RATs), ransomware, spyware, keyloggers, logic bombs, rootkits, and fileless malware, each defined by how it spreads and what it does.

A virus needs a user to execute or open a file to activate. A worm spreads from computer to computer on its own without human interaction.

Malicious code that lives in a device's memory and uses legitimate programs already installed, rather than a file, which makes traditional file scanning less effective at catching it.

A trojan is malware hidden in software that seems harmless. A remote access trojan (RAT) is a trojan that specifically gives the adversary remote control of the system.

← PreviousSIEM & Monitoring Next →Authentication & Hashing

Keep studying

All Topics Unit 4 Study Guide Practice Questions

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]