A junior SOC analyst pulls up a ticket: an email attachment got flagged by a multi-engine scan, "Trojan.GenericKD.33705107" from three engines, "Gen:Variant.Razy.12345" from two more, everything else called it clean. Stand-up is in ten minutes and the lead wants to know two things: what is this, and what do we do about it. The label on the ticket answers neither. That's not a fluke of this one sample, it's what a generic heuristic name actually is.
"GenericKD," "Razy," "Kryptik," names like these aren't a curated taxonomy an analyst assigned after studying the sample. They're auto-generated by a vendor's static heuristic engine catching suspicious opcodes, packer signatures, or entropy patterns, one vendor's pattern-matcher naming a completely unrelated binary the same generic string somewhere else in the world. Two different vendors routinely give the same sample two different generic names, and neither name says what the program actually does once it runs. Treating the AV label as the classification is where a lot of triage stalls out.
What actually separates malware into meaningfully different families is behavior, and it comes down to four questions you can usually answer from a sandbox run or a careful static read, not from a signature string:
Does it replicate on its own, copying itself across shares, removable media, or the network, or does it stay put and rely on something else (a phishing click, a dropper) to move it? That's the line between worm-like spread and trojan-style delivery.
What persistence mechanism does it install, if any: a Run key, a scheduled task, a service? The choice tells you what privilege the installation needed and how deeply it's trying to survive a reboot.
What's the payload actually for: encrypting files for ransom, quietly maintaining remote access (a backdoor or RAT), or harvesting credentials to exfiltrate (an infostealer)? These are different goals with different urgency.
Does it beacon out to a remote server on a schedule, or does it operate fully offline once triggered? Plenty of ransomware doesn't need live C2 to do its damage; plenty of RATs are useless without it.
Those four answers, not the AV string, are what should drive your response. A self-propagating sample means immediate segmentation, you're racing the spread and every reachable host is a suspect until proven clean. A quiet backdoor with no propagation means the opposite instinct: slow down, don't tip off whoever's on the other end, preserve volatile evidence, and hunt for lateral movement that may have already happened before anyone noticed the alert. Ransomware with no meaningful C2 dependency means the fight is backup and recovery, not a race to find and block a command server that was never load-bearing to begin with.
The AV label is a starting point for a signature lookup at best. The four axes above are what a real classification looks like, and they're exactly the ground the Malware Analysis Book for Beginners covers, 123 pages and 16 chapters on malware families, Windows internals, persistence and C2 traffic, written for someone starting from zero rather than someone who already knows what a PE header is: https://resources.codelivly.com/product/malware-analysis-for-beginners/
