Which behavior most cleanly classifies a sample as a 'worm' rather than a 'virus'?

• 1It encrypts files for ransom
• 2It self-propagates over a network without requiring a host program or user interaction
• 3It establishes a backdoor
• 4It runs only in memory