Disclosed system and methods for malware testing of software programs. An example method includes storing a plurality of malware trigger scenarios specifying different sets of malware trigger events known to trigger malicious behavior in software programs; in response to obtaining a software program, modifying a computer environment for operating the software program by creating malware trigger events associated with a selected one of the plurality of malware trigger scenarios; analyzing an execution of the software program in the modified computer environment in response to the malware trigger events; upon detecting that the software program exhibits malicious behavior, performing remedial actions on the software program; and upon detecting that the software program exhibits no malicious behavior, selecting a different malware trigger scenario from the plurality of malware trigger scenarios for malware testing of the software program.