Which of these software entries does ATT&CK type as Malware rather than Tool?

Why this is the answer

ATT&CK reserves Tool for software a defender, pen tester, or red teamer could legitimately use — PsExec, Mimikatz, and Impacket all carry Type: TOOL. Cobalt Strike is typed MALWARE despite being a commercial product, because ATT&CK treats it as software intended for malicious use by adversaries.