| Type | Description | Examples |
|---|
| Worms | Spreads independently without the need of a host file or user interaction | Wannacry |
| Trojans | Malicious software designed as legitimate programs to trick users into running it | Zbot |
| Ransomware | Encrypts files or locks users out of the system and demands a ransom to access the files/system | Lockbit |
| Rootkits | A type of malware that provides admin access to a system while hiding its presence | 2005 Sony BMG Rootkit |
| Bootkits | A type of rootkit that infects the MBR (master boot record); this allows the malware to be loaded before the OS starts | Mebromi |
| Botnets | A collection of compromised computers/devices (zombies) remotely controlled by an attacker; typically used for DDoS attacks | Mirai |
| Keyloggers | Records all the keystrokes that a user makes | SpyEye |
| Stealers | Focuses on stealing certain information off a user’s system, such as passwords, credit cards, or personal information | Emotet |
| Polymorphic | Changes its code or appearance after spreading, preventing detection from signature-based detectors | Storm Worm |
| Metamorphic | Like polymorphic but changes the entire code base each iteration | Simile |
| RAT | Remote Access Trojan, or Remote Access Tool; used to provide the attacker with complete control of the system. Typically comes with a keylogger. | DarkComet |
| Logic Bomb | Malicious code that lies dormant until triggered when a specific condition happens | Farewell Dossier |
| Data Wipers | Arguably the most destructive on this list; designed to completely destroy or corrupt the system | Shamoon |
| Dropper | Typically a small initial stage of a larger attack; designed to covertly install other malware onto the system | Dridex |