Question malware types and files in pc

aranclassic87

What are the names of types of malware that acess, modify, delete, or corrupt PC hdd and ssd files (Windows files and personal files, games, music, executables, ISO, IMG, RAR, ZIP, 7Z)? Does all malware have the potential to do this?

In this case, how are the malware QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml), Caller.exe (detects
Trojan.DownLoader47.36298), and Caller.exe (
TrojanPSW.Rhadamanthys) Trojan.Win32.Agent.xcajyl, Application.Fragtor.Generic are classified?

Alexandru_BD

Hello,

Not all malware modifies or deletes files directly. In this regard, malware can be classified as passive, for example spyware or information stealers (they copy data but don’t damage it), and active/destructive. The ones who fall into this category are file infectors, wipers, and ransomware. These overwrite, encrypt, or delete.

However, any malware with system-level access could potentially alter files, even if it’s not designed to.

To elaborate on the malware that does have the ability to modify, delete, or corrupt files, I think we can classify them in categories. First there are the file infectors, so the ones that attach themselves to executable files (.exe, .dll, .scr, .bat) and inject malicious code. These are known to corrupt or delete system and personal files, damage executables, and make Windows unstable.
The second category is.. a can of worms. Worms can self-replicate and spread through networks, USB drives, or email attachments. They can modify or delete files to facilitate propagation; some corrupt files to disable system defenses.
The next category is reserved for the infamous trojan family. As the name suggests, they disguise themselves as legitimate software but perform malicious operations when executed. There are multiple subtypes of this popular malware and depending on the subtype, it can access, steal, modify, or delete files. If it's a trojan downloader, it does what the name suggests, it downloads and installs other malware, like ransomware or spyware. If it's a trojan dropper, it places other malware in the system. A trojan-spy or trojan-PSW steals credentials and personal data.
Finally, a generic trojan, or trojan agent can perform any malicious function.

Moving on to the next category of malware, ransomware. This can be a real pain, as it encrypts or deletes files, demanding payment for decryption. It can inflict huge loss of important data which in many cases can no longer be recovered. Ransomware directly targets personal files, including .docx, .jpg, .zip, .7z, .iso, .mp3, and even system restore points.

Finally, there are spyware and keyloggers. These access and exfiltrate files, screenshots, or keystrokes. They don't usually corrupt files, but can access them without permission.
And a notable mention of wipers and destructive malware on this list, which intentionally overwrite, corrupt, or destroy data.

Now, the threats you mentioned can be classified as follows:

1. QtWebKit4.dll (Trojan:Win32/Wacatac.C!ml): Wacatac is a Trojan that downloads or executes secondary payloads. It can install ransomware or password stealers. It doesn’t usually infect files directly but can lead to file-damaging malware. Therefore, this is considered a trojan downloader.
2. Caller.exe (Trojan.DownLoader47.36298): This is specifically designed to fetch and install other malware. On its own, it may not corrupt files but can bring in ransomware or wipers. It also falls into the category of trojan downloaders.
3. Caller.exe (TrojanPSW.Rhadamanthys): This is actually a password stealer trojan. It's focused on stealing credentials, cryptocurrency wallets, and browser data. It generally does not corrupt files.
4. Trojan.Win32.Agent.xcajyl: A broad category for multipurpose trojans. It can execute arbitrary commands, download malware, or modify files. Its behavior depends on the payload. So, it belongs in the generic trojans/trojan agents category.
5. Application.Fragtor.Generic: I think this is actually a PUP or trojan dropper. This is often part of bundled installers. It might drop additional malware or adware, sometimes disabling security tools. Usually not destructive by itself.

To sum things up, the most dangerous malware for file destruction are ransomware, wipers, and file infectors.
The threats you listed are primarily trojans and password stealers, which can lead indirectly to data loss by installing more destructive payloads, but they don’t usually destroy or corrupt files themselves.

I hope the information is useful.

Regards