# What is Malware?

> Malware is software or firmware intentionally designed or modified to perform unauthorized or harmful actions in a system.

- Canonical URL: https://yellowcube.eu/glossary/malware/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It is an umbrella category for code that steals data, disrupts services, enables unauthorized control, or conceals other activity. A delivery method, language, or file type alone does not determine whether something is malware.

Labels describe different dimensions: viruses and worms replicate; Trojan horses use deceptive presentation; rootkits conceal privileged presence; spyware and ransomware describe objectives or effects. One specimen can fit several labels, while attackers can also abuse legitimate tools without installing malware.

### Key points

- **Entry and execution:** Malware may arrive through exploited software, deceptive messages, compromised updates, removable media, unsafe downloads, or prior access. Some code executes through interpreters or trusted system utilities.
- **Analysis:** Examine behavior, code, configuration changes, persistence, communications, and affected assets. Tool and researcher names may differ, so rely on observed properties rather than a family name alone.
- **Response:** Scope the activity, preserve evidence, contain harmful execution and communications, remove persistence, correct the entry path, and recover from known-good sources.
- **Important limitation:** A malware alert does not prove the actor, objective, scope, or impact. A clean scan also does not establish that a system is uncompromised; detection depends on visibility, coverage, and analytic knowledge.

### Related terms

[Computer virus](<https://yellowcube.eu/glossary/computer-virus/>) · [Computer worm](<https://yellowcube.eu/glossary/computer-worm/>) · [Trojan horse](<https://yellowcube.eu/glossary/trojan-horse/>) · [Ransomware](<https://yellowcube.eu/glossary/ransomware/>) · [Malware analysis](<https://yellowcube.eu/glossary/malware-analysis/>) · [Cryptojacking](<https://yellowcube.eu/glossary/cryptojacking/>) · [Infostealer](<https://yellowcube.eu/glossary/infostealer/>) · [Backdoor](<https://yellowcube.eu/glossary/backdoor/>)

### Sources

[NIST glossary: Malware](https://csrc.nist.gov/glossary/term/malware) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final) · [NIST SP 800-61 Rev. 3: Incident Response Recommendations](https://csrc.nist.gov/pubs/sp/800/61/r3/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.