T1059.003: Command and Scripting Interpreter: Windows Command Shell
Operational Executive Summary
T1059.003 (Command and Scripting Interpreter: Windows Command Shell) is classified under the Execution tactic within the MITRE ATT&CK framework. Techniques that result in adversary-controlled code running on a local or remote target system, including command-line interpreters, PowerShell payloads, and native binary proxy execution. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 164 distinct malware families, totaling over 102,767 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Command and Scripting Interpreter: Windows Command Shell to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Command and Scripting Interpreter: Windows Command Shell, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1059.003 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Command and Scripting Interpreter: Windows Command Shell to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1059/003/.
Detection Engineering & Threat Hunting
Detecting Command and Scripting Interpreter: Windows Command Shell requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1059.003 (Command and Scripting Interpreter: Windows Command Shell) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Command and Scripting Interpreter: Windows Command Shell across adjacent network segments.
Cataloged Malware Families Utilizing T1059.003 (164 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1059.003 (Command and Scripting Interpreter: Windows Command Shell):
164 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| xtrat | Rat | 35,969 | Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originall... |
| stop | Ransomware | 8,900 | STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cybe... |
| lethic | Spam Bot | 4,879 | Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eas... |
| bladabindi | Rat | 3,930 | Bladabindi (universally recognized in the cybersecurity community as njRAT) is an infamous, widely proliferated remote access trojan originally authored by an i... |
| cobaltstrike | Hacktool | 3,500 | Cobalt Strike (specifically its Beacon payload component) is the world's most ubiquitous commercial adversary simulation and post-exploitation framework. Origin... |
| razy | Infostealer | 3,391 | Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information st... |
| gandcrab | Ransomware | 2,992 | GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa... |
| chapak | Downloader | 2,254 | TrojanDownloader:Win32/Chapak (widely cataloged across threat telemetry as Trojan.Chapak, Win32/Chapak, or Downloader.Chapak) is a high-volume, multi-stage troj... |
| installcore | Pua | 1,961 | PUA:Win32/InstallCore (widely cataloged across endpoint telemetry as ADW_INSTALLCORE, PUP.Optional.InstallCore, or PUA.Win32.InstallCore) is an aggressive softw... |
| sdbot | Rat | 1,931 | SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first releas... |
| qhost | Trojan | 1,722 | Trojan:Win32/Qhost (cataloged widely across security telemetry as TROJ_QHOST, DNSChanger.Qhost, or Win32/Qhost) is a classic and persistent DNS-tampering trojan... |
| gepys | Downloader | 1,587 | Trojan:Win32/Gepys (cataloged across security vendor telemetry as Trojan.Gepys, Downloader.Gepys, or Win32/Gepys) is an aggressive Windows trojan downloader and... |
| flux | Backdoor | 1,500 | Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfac... |
| hav_rat | Rat | 1,500 | Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Troj... |
| hue | Trojan | 1,500 | Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan ... |
| icecold_reloaded | Rat | 1,500 | IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based... |
| infector_ng_2004 | Trojan | 1,500 | Infector NG 2004 (Infector Next Generation, cataloged across security telemetry as Trojan:Win32/InfectorNG2004, Virus:Win32/InfectorNG, and Trojan.Win32.Infecto... |
| vobfus | Worm | 1,484 | Vobfus (also documented across antimalware products as Win32/Vobfus, Worm:Win32/Vobfus, and WORM_VOBFUS) is a pervasive Windows worm and trojan loader developed... |
| triusor | Trojan | 1,429 | Trojan:Win32/Triusor (cataloged across security telemetry as Trojan.Triusor, Downloader.Triusor, or Win32/Triusor) is a modular Windows trojan downloader and dr... |
| zpevdo | Trojan | 1,303 | Trojan:Win32/Zpevdo (cataloged across security telemetry as Trojan.Win32.ZPEVDO, Win32/Zpevdo, or Downloader.Zpevdo) is an evasive multi-stage trojan loader and... |
| wabot | Rat | 1,185 | Trojan:Win32/Wabot is a prolific modular botnet trojan and worm designed to compromise Windows endpoints and enlist them into large-scale zombie networks for co... |
| swisyn | Trojan | 1,036 | Trojan:Win32/Swisyn (cataloged across industry vendor telemetry as TrojanDropper:Win32/Swisyn, Trojan.Win32.Swisyn, or Win32/Swisyn) is an evasive multi-stage t... |
| lamer | Worm | 894 | Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a ... |
| yakes | Trojan | 751 | Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-... |
| mira | Worm | 729 | Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm a... |
| ainslot | Trojan | 635 | Trojan:Win32/Ainslot (also cataloged in threat telemetry as Worm:Win32/Ainslot.A, TROJ_GEN.UAE171Y, or Win32/Ainslot) is a persistent Windows trojan dropper and... |
| simbot | Backdoor | 634 | Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or B... |
| detnat | Trojan | 523 | Trojan:Win32/Detnat (frequently cataloged in security telemetry as Trojan:Win32/Detnat!MTB, Trojan.Detnat, or Win32/Detnat) is an evasive multi-component backdo... |
| gandcrypt | Ransomware | 474 | Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defen... |
| zegost | Rat | 441 | Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootk... |
| skeeyah | Trojan | 440 | Trojan:Win32/Skeeyah is a widely encountered family of evasive trojan loaders and multi-stage droppers documented extensively in Microsoft Windows Defender tele... |
| ausiv | Trojan | 422 | Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that eme... |
| ekstak | Trojan | 421 | Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware f... |
| maener | Cryptominer | 387 | Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining troj... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| koobface | Worm | 350 | Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable... |
| ircbot | Rat | 348 | Backdoor:Win32/Ircbot is a foundational lineage of remote access trojans and botnet agents that utilize Internet Relay Chat (IRC) protocol channels for decentra... |
| midie | Trojan | 341 | Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader t... |
| sfone | Worm | 332 | Sfone (cataloged across security vendors as Worm:Win32/Sfone, Worm.Win32.SFONE.B, and Trojan:Win32/Sfone!pz) is a self-propagating Windows worm and trojan loade... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| snojan | Trojan | 324 | Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan... |
| dfay | Trojan | 300 | TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engine... |
| regsup | Trojan | 296 | Regsup (cataloged across security vendors as Trojan:Win32/Regsup, PUA:Win32/Regsup, and Trojan.Win32.Regsup) is a Windows trojan downloader and potentially unwa... |
| winwrapper | Pua Tool | 296 | WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-instal... |
| banload | Downloader | 288 | Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of troj... |
| ludbaruma | Worm | 283 | Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows ... |
| quasarrat | Rat | 280 | QuasarRAT (frequently tracked as Quasar, Quasar Remote Administration Tool, and Backdoor:MSIL/Quasar) is a powerful open-source remote access trojan coded in C#... |
| sytro | Worm | 273 | Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) network worm and download... |
| poison | Rat | 261 | Poison Ivy (widely known across threat intelligence teams as PIVY) is one of the most historically significant and enduring Remote Access Trojans (RATs) in cybe... |
| xmrig | Cryptominer | 248 | XMRig (cataloged across antivirus vendors as Coinminer:Win32/XMRig, Trojan.XMRig, and Riskware.XMRig) is a high-performance open-source Monero (XMR) cryptocurre... |
| disfa | Trojan | 238 | Disfa (cataloged in antivirus telemetry as Trojan:Win32/Disfa, Trojan.MSIL.Disfa, and recognized as a variant of the Bladabindi / njRAT malware family) is a .NE... |
| johnnie | Trojan | 221 | Johnnie (tracked in threat databases as Trojan:Win32/Johnnie, HackTool:Win32/Johnnie, and Worm:Win32/Johnnie) is a Windows trojan, reconnaissance hacktool, and ... |
| kolab | Worm | 219 | Kolab (cataloged across security vendors as Worm:Win32/Kolab, Net-Worm.Win32.Kolab, WORM_KOLABC, and W32/Kolab) is a prolific Windows network worm and backdoor ... |
| drolnux | Worm | 205 | Drolnux (tracked in antivirus telemetry as Worm:Win32/Drolnux, Worm:Win32/Drolnux.A, and W32/Drolnux) is a network-aware computer worm and backdoor trojan that ... |
| pioneer | File Infector | 203 | Pioneer (identified across antivirus engines as Virus:Win32/Pioneer.A, Virus.Win32.Pioneer, and PE_PIONEER) is an advanced 32-bit Windows Portable Executable (P... |
| phpw | Trojan | 195 | PHPW (cataloged in antivirus telemetry as Trojan:Win32/PHPW, Trojan.PHPW, and Backdoor:Win32/PHPW) is a Windows backdoor trojan and surveillance agent tracked s... |
| cheatengine | Pua Tool | 175 | CheatEngine (cataloged across enterprise endpoint security solutions as HackTool:Win32/CheatEngine, PUA:Win32/CheatEngine, and Riskware.CheatEngine) is a widely... |
| swrort | Backdoor | 161 | Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a stealthy Remote Access ... |
| ipamor | Backdoor | 147 | Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) is a stealthy remote acc... |
| hupigon | Rat | 146 | Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (R... |
| killproc | Trojan | 141 | Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive d... |
| cassiopeia | Backdoor | 137 | Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiopeia) is a stealthy Remot... |
| salgorea | Backdoor | 135 | Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cybe... |
| scarsi | Backdoor | 133 | Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access T... |
| hafen | Backdoor | 120 | Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Troj... |
| ardamax | Infostealer | 114 | PWS:Win32/Ardamax (commercially branded as Ardamax Keylogger) is a surveillance tool originally created in 2004 as commercial employee and parental monitoring s... |
| bitmin | Coinminer | 112 | Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of... |
| netsky | Worm | 105 | Worm:Win32/Netsky is a historically monumental, prolific mass-mailing computer worm that emerged in February 2004, causing tens of millions of dollars in global... |
| sugar | Ransomware | 80 | Sugar (tracked across cybersecurity threat intelligence feeds under aliases including Sugar Ransomware, Encoded01, and Ransom.Encoded01) is a Delphi-based Ranso... |
| netwiredrc | Rat | 72 | Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially... |
| neutrinopos | Trojan | 60 | NeutrinoPoS (also widely tracked in cyber threat intelligence as Kasidet, Trojan:Win32/Kasidet, and MWZLesson) is a notorious Point-of-Sale (PoS) malware family... |
| scarab | Ransomware | 57 | Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Rans... |
| crytex | Ransomware | 52 | Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Rans... |
| hoax | Ransomware | 48 | Hoax (cataloged across security vendors and threat intelligence databases under detections including Trojan-Ransom.Win32.Hoax, Ransom:Win32/Hoax, and Scareware.... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| regrun | Trojan | 45 | Regrun is an enduring Windows persistence and trojan family active since 2007, named after its aggressive manipulation of the Windows registry run keys. Designe... |
| pliskal | Trojan | 23 | Pliskal (tracked across enterprise antivirus research telemetry under designations including Trojan:Win32/Pliskal, Trojan:Win32/Pliskal.A, and TrojanDownloader:... |
| aenjaris | Trojan | 22 | Aenjaris (classified in antimalware research telemetry under designations including Trojan:Win32/Aenjaris, Trojan:Win32/Aenjaris.A, and Win32/Aenjaris) is a ste... |
| backboot | Trojan | 22 | Backboot (classified across antivirus vendors under signatures including Trojan:Win32/Backboot, Trojan:Win32/Backboot.A, and VirTool:Win32/Backboot) is a persis... |
| guagua | Trojan | 22 | Guagua (classified in antimalware telemetry under signatures including Trojan:Win32/Guagua, Trojan:Win32/Guagua.A, and Backdoor:Win32/Guagua) is a modular Windo... |
| kuluoz | Trojan | 22 | Kuluoz (identified across antimalware research as Trojan:Win32/Kuluoz, TrojanDownloader:Win32/Kuluoz, and closely associated with the historic Asprox botnet inf... |
| miniduke | Trojan | 22 | MiniDuke (classified across threat intelligence repositories under designations including Backdoor:Win32/MiniDuke, Trojan:Win32/MiniDuke, and Win32/MiniDuke) is... |
| pbot | Trojan | 22 | Pbot (tracked under signatures Backdoor:Win32/Pbot, Trojan:Win32/Pbot, and Win32/Pbot) is a modular Windows remote access backdoor and network proxy agent. Infi... |
| autoruns | Hacktool | 21 | AutoRuns (tracked in antimalware telemetry under signatures including HackTool:Win32/AutoRuns, VirTool:Win32/AutoRuns, and Trojan:Win32/AutoRuns) refers to weap... |
| garrun | Trojan | 21 | Garrun (identified in security research telemetry as Trojan:Win32/Garrun, Trojan:Win32/Garrun.A, and Backdoor:Win32/Garrun) is an evasive Windows trojan backdoo... |
| dexel | Trojan | 20 | Dexel (identified across antivirus research telemetry as Trojan:Win32/Dexel, TrojanDownloader:Win32/Dexel, and Backdoor:Win32/Dexel) is an evasive Windows troja... |
| dorifel | Trojan | 19 | Dorifel (also known as Quervar and classified across antivirus vendors under signatures including Trojan:Win32/Dorifel, Virus:Win32/Dorifel.A, and Worm:Win32/Do... |
| nssm | Hacktool | 15 | NSSM (Non-Sucking Service Manager, classified across antimalware engines as HackTool:Win32/NSSM, Tool:Win32/NSSM, and PUA:Win32/NSSM) is a legitimate service wr... |
| screenconnect | Hacktool | 14 | ScreenConnect (ConnectWise ScreenConnect, classified across security telemetry as Tool:Win32/ScreenConnect and RemoteAccess:Win32/ScreenConnect) is a legitimate... |
| bruteforce | Hacktool | 13 | BruteForce (classified across antivirus engines as HackTool:Win32/BruteForce and Tool:Win32/BruteForce) is a multi-protocol authentication credential-cracking t... |
| turkojan | Rat | 13 | Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its ... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| cybergate | Rat | 7 | Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ... |
| hermes | Ransomware | 7 | Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her... |
| passview | Advanced Threat | 7 | HackTool:Win32/Passview (or generic **NirSoft Password Recovery Abuse** heuristics) refers to the detection of legitimate, powerful system administration utilit... |
| netcat | Advanced Threat | 6 | HackTool:Win32/Netcat (often abbreviated as `nc` or `ncat`) is a classic example of a **'Dual-Use' or 'Living off the Land' (LotL)** utility. Netcat is a comman... |
| separ | Trojan | 5 | Trojan:Win32/Separ is an aggressive credential-stealing malware campaign renowned for its simplicity, effectiveness, and its heavy reliance on legitimate, 'dual... |
| adduser | Backdoor | 4 | Adduser (classified in antivirus detection telemetry under designations including Backdoor:Win32/Adduser, Backdoor.Win32.Adduser, and Win32/Adduser) is a intera... |
| arcdoor | Backdoor | 4 | Arcdoor (classified in antivirus detection telemetry under designations including Backdoor:Win32/Arcdoor, Backdoor.Win32.Arcdoor, and Win32/Arcdoor) is a intera... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| nukesped | Trojan | 4 | Backdoor:Win32/Nukesped is a highly sophisticated, persistent backdoor remote access trojan (RAT) heavily attributed to the **Lazarus Group (HIDDEN COBRA)**, a ... |
| tsklnk | Trojan | 4 | Trojan:Win32/Tsklnk (Task Link) is a specific classification for malware that abuses legitimate Windows Shortcut files (`.lnk`) and the Windows Task Scheduler t... |
| xrat | Trojan | 4 | Backdoor:Win32/Xrat (widely known as **XtremeRAT** or XRAT) is a highly capable, commercially available Remote Access Trojan (RAT). While originally marketed as... |
| batlauncher | Ransomware | 3 | Batlauncher (classified in antivirus detection telemetry under designations including Ransom:Win32/Batlauncher, Ransom.Win32.Batlauncher, and Win32/Batlauncher)... |
| sbdbat2exe | Advanced Threat | 3 | HackTool:Win32/Sbdbat2exe (Bat2Exe) is not a malware family in the traditional sense; it is a **Malware Creation Tool / Wrapper**. It is a utility designed to c... |
| zxshell | Backdoor | 3 | Backdoor:Win32/Zxshell is a notorious, long-standing Remote Administration Tool (RAT) and backdoor heavily utilized by numerous Chinese state-sponsored Advanced... |
| browserpassview | Infostealer | 2 | Browserpassview (classified in antivirus detection telemetry under designations including PWS:Win32/Browserpassview, PWS.Win32.Browserpassview, and Win32/Browse... |
| clearlog | Advanced Threat | 2 | HackTool:Win32/Clearlog is a critical **Heuristic Detection** specifically designed to flag executables, scripts, or command-line activity attempting to wipe th... |
| hiddeninstall | Advanced Threat | 2 | Adware:Win32/Hiddeninstall (also detected as PUP.Optional.HiddenInstall) is a generic classification for software deployment wrappers that silently install Pote... |
| hiddentears | Ransomware | 2 | Ransomware:Win32/Hiddentears is a highly significant case study in malware history. It was originally released on GitHub in August 2015 by a Turkish programmer ... |
| manuscrypt | Trojan | 2 | Trojan:Win32/Manuscrypt (also known as Volgmer or FALLCHILL) is an extremely sophisticated malware family strongly associated with the North Korean state-sponso... |
| minerbat | Trojan | 2 | Trojan:BAT/Minerbat (or simply Miner.bat) is a classification for extremely simple, script-based cryptojacking malware. Instead of complex compiled executables,... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| nirsoft | Advanced Threat | 2 | Riskware:Win32/Nirsoft refers to a highly popular suite of legitimate, incredibly useful, and free administrative utilities developed by Nir Sofer. However, bec... |
| rustock | Advanced Threat | 2 | Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 ... |
| slefdel | Ransomware | 2 | Trojan:Win32/Slefdel is a heuristic detection identifying a specific, evasive behavior common in malware droppers and initial stagers: self-deletion (`T1070.004... |
| winnti | Backdoor | 2 | Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracke... |
| blackenergy | Advanced Threat | 1 | BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an unde... |
| commandcam | Trojan | 1 | <h3>Executive Summary</h3> CommandCam is a specialized command-line utility designed to silently capture images from a connected webcam. While it has legitimate... |
| gtbot | Trojan | 1 | <h3>Executive Summary</h3> GTBot (often known as Global Threat Bot) is a legacy but highly versatile Trojan and IRC (Internet Relay Chat) Botnet client. Origina... |
| hidcon | Ransomware | 1 | HackTool:Win32/Hidcon (Hidden Console) designates utilities designed specifically to execute command-line tools, batch files, or scripts silently, without displ... |
| infinitetear | Trojan | 1 | <h3>Executive Summary</h3> InfiniteTear is a highly sophisticated, stealthy Backdoor and Remote Access Trojan (RAT) historically associated with Advanced Persis... |
| karagany | Trojan | 1 | <h3>Executive Summary</h3> Karagany is a sophisticated Backdoor Trojan historically associated with the state-sponsored Advanced Persistent Threat (APT) group k... |
| killdisk | Wiper | 1 | Trojan:Win32/KillDisk is a catastrophic industrial wiper malware family developed and deployed by Russian military intelligence hackers belonging to the Russian... |
| konni | Trojan | 1 | <h3>Executive Summary</h3> Konni is a sophisticated Remote Access Trojan (RAT) and the namesake of the Advanced Persistent Threat (APT) group that wields it. Th... |
| liudoor | Ransomware | 1 | <h3>Executive Summary</h3> Liudoor is a malicious Backdoor Trojan designed to covertly infiltrate Windows systems, establish stealthy persistence, and provide a... |
| mailpassview | Ransomware | 1 | <h3>Executive Summary</h3> Mail PassView is a legitimate, commercially available password recovery utility developed by NirSoft. However, due to its capability ... |
| messengerpass | Trojan | 1 | <h3>Executive Summary</h3> MessengerPass is a classification frequently applied to a legitimate password recovery utility developed by NirSoft, designed to extr... |
| moonpie | Trojan | 1 | <h3>Executive Summary</h3> Moonpie (sometimes associated with advanced persistent threat toolsets) is a sophisticated Backdoor and remote access trojan (RAT) de... |
| passwordfox | Ransomware | 1 | <h3>Executive Summary</h3> PasswordFox is a legitimate, commercially available password recovery utility developed by NirSoft. However, because it is designed t... |
| remexi | Trojan | 1 | <h3>Executive Summary</h3> Remexi is a sophisticated Backdoor Trojan historically attributed to the Iranian-linked Advanced Persistent Threat (APT) group known ... |
| revengerat | Ransomware | 1 | <h3>Executive Summary</h3> RevengeRAT is a highly capable, commercially available Remote Access Trojan (RAT) sold on underground cybercrime forums. It provides ... |
| rockrat | Trojan | 1 | Backdoor:Win32/Rockrat is a specific family of Remote Access Trojan (RAT) designed to provide a threat actor with complete, interactive control over a compromis... |
| shellme | Ransomware | 1 | <h3>Executive Summary</h3> Shellme is a classification applied to a category of HackTools specifically designed to establish reverse shells or bind shells. Whil... |
| shutdown | Ransomware | 1 | <h3>Executive Summary</h3> "Shutdown" (often detected as Riskware.Shutdown or Joke.Shutdown) is a classification for simple, usually non-destructive utility pro... |
| spynet | Ransomware | 1 | <h3>Executive Summary</h3> Spy-Net (often detected simply as SpyNet) is a classic, widely available Remote Access Trojan (RAT) that has been in circulation for ... |
| storm | Botnet | 1 | Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infe... |
| taskkill | Ransomware | 1 | <h3>Executive Summary</h3> The detection of "Taskkill" in a security context refers to the malicious abuse of the legitimate, built-in Windows utility `taskkill... |
| termite | Trojan | 1 | <h3>Executive Summary</h3> Termite (often associated with the NetWeaver framework) is a highly capable Remote Access Trojan (RAT) and post-exploitation toolset.... |
| winshell | Trojan | 1 | Backdoor:Win32/Winshell represents a category of Remote Access Trojans (RATs) and backdoors designed to provide an attacker with a persistent, interactive Windo... |
| younglotus | Backdoor | 1 | <h3>Executive Summary</h3> YoungLotus is a highly sophisticated Backdoor and espionage tool historically associated with targeted Advanced Persistent Threat (AP... |
| institution_2004 | Trojan | Sampled | Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delp... |
| jbonblanc | Trojan | Sampled | JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remo... |
| jps | Trojan | Sampled | JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JP... |
| lost_door | Rat | Sampled | Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Acce... |
| messiah | Trojan | Sampled | Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access troj... |
| netsphere | Trojan | Sampled | NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote admin... |
| nuclear_rat | Rat | Sampled | Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Acce... |
| prjraptor | Trojan | Sampled | PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retr... |
| schoolbus | Trojan | Sampled | Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Acces... |
| seed | Trojan | Sampled | Seed (cataloged across security software as Backdoor:Win32/Seed, Trojan.Win32.Seed, and Backdoor.Seed) is a stealthy, lightweight Remote Access Trojan developed... |
| serenity_rat | Rat | Sampled | Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in B... |
| sinique | Trojan | Sampled | Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access troja... |
| subseven | Trojan | Sampled | SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojan... |
| synrat | Trojan | Sampled | SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Ac... |
| terabit_virus_maker | Trojan | Sampled | Terabit Virus Maker (abbreviated as TVM and identified in security definitions as HackTool.Win32.Terabit) is an automated malware generation kit and script viru... |
| trojna | Trojan | Sampled | Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual... |
| uk_splitter | Trojan | Sampled | UK Splitter (specifically known across security communities as UK Splitter 1.2 and HackTool.Win32.UKSplitter) is a specialized binary joiner, executable file bi... |
| ulysses | Trojan | Sampled | Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in ... |
| vampire | Trojan | Sampled | Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 20... |
| y3k_rat | Trojan | Sampled | Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visu... |
| z_dem0n | Trojan | Sampled | Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using t... |
| zombierat | Trojan | Sampled | ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access... |