T1059: Command and Scripting Interpreter
Operational Executive Summary
T1059 (Command and Scripting Interpreter) is classified under the Execution tactic within the MITRE ATT&CK framework. Techniques that result in adversary-controlled code running on a local or remote target system, including command-line interpreters, PowerShell payloads, and native binary proxy execution. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 388 distinct malware families, totaling over 4,913 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Command and Scripting Interpreter to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Command and Scripting Interpreter, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1059 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Command and Scripting Interpreter to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1059/.
Detection Engineering & Threat Hunting
Detecting Command and Scripting Interpreter requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1059 (Command and Scripting Interpreter) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Command and Scripting Interpreter across adjacent network segments.
Cataloged Malware Families Utilizing T1059 (388 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1059 (Command and Scripting Interpreter):
388 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| erazer | Trojan | 1,500 | Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive dis... |
| erazer_lite | Trojan | 1,500 | Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase... |
| agen | Trojan | 1,335 | Agen (classified in antivirus detection telemetry under designations including Trojan:Win32/Agen, Trojan.Win32.Agen, and Win32/Agen) is a multi-stage trojan eng... |
| chir | Worm | 99 | Chir (extensively documented as Virus:Win32/Chir.B@mm, W32.Chir, and Runouce) is a historic, highly aggressive mass-mailing worm and polymorphic file infector f... |
| chopper | Backdoor | 14 | Chopper (widely tracked across cybersecurity research, CISA advisories, and EDR platforms as China Chopper, Backdoor:Win32/Chopper, and Trojan:ASP/Chopper) is a... |
| exescript | Ransomware | 12 | HackTool:Win32/Exescript (or similar detections) often refers to utilities designed to compile standard scripts (like VBScript, Batch, or PowerShell) into stand... |
| webdown | Ransomware | 12 | TrojanDownloader:Win32/Webdown is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole pur... |
| autit | Trojan | 11 | Autit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autit, Trojan.Win32.Autit, and Win32/Autit) is a multi-stage trojan... |
| gendwnurl | Ransomware | 11 | TrojanDownloader:Win32/Gendwnurl is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole p... |
| koutodoor | Backdoor | 11 | Backdoor:Win32/Koutodoor is a persistent, stealthy backdoor designed to breach endpoint defenses, establish a long-term foothold, and allow remote threat actors... |
| multidl | Trojan | 11 | TrojanDownloader:Win32/Multidl is a generic heuristic detection used by antivirus engines to identify malicious stagers whose primary function is to establish a... |
| mirc | Trojan | 10 | HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the... |
| ubot | Trojan | 8 | <h3>Executive Summary</h3> UBot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader a... |
| mosucker | Trojan | 5 | Backdoor:Win32/Mosucker is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive acce... |
| snare | Trojan | 5 | Backdoor:Win32/Snare is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive access ... |
| aotoit | Ransomware | 3 | Aotoit (classified in antivirus detection telemetry under designations including Ransom:Win32/Aotoit, Ransom.Win32.Aotoit, and Win32/Aotoit) is a crypto-ransomw... |
| gate | Ransomware | 3 | Trojan:Win32/Gate is a persistent, stealthy backdoor trojan designed to silently breach endpoint defenses, establish long-term persistence, and open a covert co... |
| bisonal | Trojan | 2 | Bisonal (classified in antivirus detection telemetry under designations including Trojan:Win32/Bisonal, Trojan.Win32.Bisonal, and Win32/Bisonal) is a multi-stag... |
| flawedammyy | Ransomware | 2 | Backdoor:Win32/Flawedammyy is a highly prevalent Remote Access Trojan (RAT) that gained massive notoriety due to its heavy deployment by the cybercriminal syndi... |
| plead | Trojan | 2 | Backdoor:Win32/Plead is a custom, highly evasive remote access trojan (RAT) heavily utilized by the state-sponsored cyber-espionage group BlackTech (also known ... |
| agiala | Ransomware | 1 | Agiala (classified in antivirus detection telemetry under designations including Ransom:Win32/Agiala, Ransom.Win32.Agiala, and Win32/Agiala) is a crypto-ransomw... |
| akcom | Ransomware | 1 | Akcom (classified in antivirus detection telemetry under designations including Ransom:Win32/Akcom, Ransom.Win32.Akcom, and Win32/Akcom) is a crypto-ransomware ... |
| aksula | Ransomware | 1 | Aksula (classified in antivirus detection telemetry under designations including Ransom:Win32/Aksula, Ransom.Win32.Aksula, and Win32/Aksula) is a crypto-ransomw... |
| alvabrig | Ransomware | 1 | Alvabrig (classified in antivirus detection telemetry under designations including Ransom:Win32/Alvabrig, Ransom.Win32.Alvabrig, and Win32/Alvabrig) is a crypto... |
| amtgimon | Ransomware | 1 | Amtgimon (classified in antivirus detection telemetry under designations including Ransom:Win32/Amtgimon, Ransom.Win32.Amtgimon, and Win32/Amtgimon) is a crypto... |
| animus | Ransomware | 1 | Animus (classified in antivirus detection telemetry under designations including Ransom:Win32/Animus, Ransom.Win32.Animus, and Win32/Animus) is a crypto-ransomw... |
| anprot | Ransomware | 1 | Anprot (classified in antivirus detection telemetry under designations including Ransom:Win32/Anprot, Ransom.Win32.Anprot, and Win32/Anprot) is a crypto-ransomw... |
| aseye | Ransomware | 1 | Aseye (classified in antivirus detection telemetry under designations including Ransom:Win32/Aseye, Ransom.Win32.Aseye, and Win32/Aseye) is a crypto-ransomware ... |
| asianraw | Ransomware | 1 | Asianraw (classified in antivirus detection telemetry under designations including Ransom:Win32/Asianraw, Ransom.Win32.Asianraw, and Win32/Asianraw) is a crypto... |
| asym | Ransomware | 1 | Asym (classified in antivirus detection telemetry under designations including Ransom:Win32/Asym, Ransom.Win32.Asym, and Win32/Asym) is a crypto-ransomware desi... |
| atmrod | Ransomware | 1 | Atmrod (classified in antivirus detection telemetry under designations including Ransom:Win32/Atmrod, Ransom.Win32.Atmrod, and Win32/Atmrod) is a crypto-ransomw... |
| atmulator | Ransomware | 1 | Atmulator (classified in antivirus detection telemetry under designations including Ransom:Win32/Atmulator, Ransom.Win32.Atmulator, and Win32/Atmulator) is a cr... |
| atomicrat | Backdoor | 1 | Atomicrat (classified in antivirus detection telemetry under designations including Backdoor:Win32/Atomicrat, Backdoor.Win32.Atomicrat, and Win32/Atomicrat) is ... |
| atomix | Ransomware | 1 | Atomix (classified in antivirus detection telemetry under designations including Ransom:Win32/Atomix, Ransom.Win32.Atomix, and Win32/Atomix) is a crypto-ransomw... |
| babel | Ransomware | 1 | Babel (classified in antivirus detection telemetry under designations including Ransom:Win32/Babel, Ransom.Win32.Babel, and Win32/Babel) is a crypto-ransomware ... |
| babonock | Ransomware | 1 | Babonock (classified in antivirus detection telemetry under designations including Ransom:Win32/Babonock, Ransom.Win32.Babonock, and Win32/Babonock) is a crypto... |
| bacalid | Ransomware | 1 | Bacalid (classified in antivirus detection telemetry under designations including Ransom:Win32/Bacalid, Ransom.Win32.Bacalid, and Win32/Bacalid) is a crypto-ran... |
| bamital | Ransomware | 1 | Bamital (classified in antivirus detection telemetry under designations including Ransom:Win32/Bamital, Ransom.Win32.Bamital, and Win32/Bamital) is a crypto-ran... |
| bamsupr | Ransomware | 1 | Bamsupr (classified in antivirus detection telemetry under designations including Ransom:Win32/Bamsupr, Ransom.Win32.Bamsupr, and Win32/Bamsupr) is a crypto-ran... |
| bandok | Trojan | 1 | Bandok (classified in antivirus detection telemetry under designations including Trojan:Win32/Bandok, Trojan.Win32.Bandok, and Win32/Bandok) is a multi-stage tr... |
| batton | Ransomware | 1 | Batton (classified in antivirus detection telemetry under designations including Ransom:Win32/Batton, Ransom.Win32.Batton, and Win32/Batton) is a crypto-ransomw... |
| beastdoor | Backdoor | 1 | Beastdoor (classified in antivirus detection telemetry under designations including Backdoor:Win32/Beastdoor, Backdoor.Win32.Beastdoor, and Win32/Beastdoor) is ... |
| bedefco | Ransomware | 1 | Bedefco (classified in antivirus detection telemetry under designations including Ransom:Win32/Bedefco, Ransom.Win32.Bedefco, and Win32/Bedefco) is a crypto-ran... |
| benban | Ransomware | 1 | Benban (classified in antivirus detection telemetry under designations including Ransom:Win32/Benban, Ransom.Win32.Benban, and Win32/Benban) is a crypto-ransomw... |
| bertle | Ransomware | 1 | Bertle (classified in antivirus detection telemetry under designations including Ransom:Win32/Bertle, Ransom.Win32.Bertle, and Win32/Bertle) is a crypto-ransomw... |
| bhosta | Ransomware | 1 | Bhosta (classified in antivirus detection telemetry under designations including Ransom:Win32/Bhosta, Ransom.Win32.Bhosta, and Win32/Bhosta) is a crypto-ransomw... |
| bhxu | Ransomware | 1 | Bhxu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bhxu, Ransom.Win32.Bhxu, and Win32/Bhxu) is a crypto-ransomware desi... |
| binderon | Ransomware | 1 | Binderon (classified in antivirus detection telemetry under designations including Ransom:Win32/Binderon, Ransom.Win32.Binderon, and Win32/Binderon) is a crypto... |
| bindex | Ransomware | 1 | Bindex (classified in antivirus detection telemetry under designations including Ransom:Win32/Bindex, Ransom.Win32.Bindex, and Win32/Bindex) is a crypto-ransomw... |
| bindjpg | Trojan | 1 | Bindjpg (classified in antivirus detection telemetry under designations including Trojan:Win32/Bindjpg, Trojan.Win32.Bindjpg, and Win32/Bindjpg) is a multi-stag... |
| bitrepeyp | Ransomware | 1 | Bitrepeyp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitrepeyp, Ransom.Win32.Bitrepeyp, and Win32/Bitrepeyp) is a cr... |
| bkff | Ransomware | 1 | Bkff (classified in antivirus detection telemetry under designations including Ransom:Win32/Bkff, Ransom.Win32.Bkff, and Win32/Bkff) is a crypto-ransomware desi... |
| bnqp | Ransomware | 1 | Bnqp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bnqp, Ransom.Win32.Bnqp, and Win32/Bnqp) is a crypto-ransomware desi... |
| bototer | Trojan | 1 | Bototer (classified in antivirus detection telemetry under designations including Trojan:Win32/Bototer, Trojan.Win32.Bototer, and Win32/Bototer) is a multi-stag... |
| bredolab | Trojan | 1 | Bredolab (classified in antivirus detection telemetry under designations including Trojan:Win32/Bredolab, Trojan.Win32.Bredolab, and Win32/Bredolab) is a multi-... |
| bridex | Ransomware | 1 | Bridex (classified in antivirus detection telemetry under designations including Ransom:Win32/Bridex, Ransom.Win32.Bridex, and Win32/Bridex) is a crypto-ransomw... |
| broskod | Ransomware | 1 | Broskod (classified in antivirus detection telemetry under designations including Ransom:Win32/Broskod, Ransom.Win32.Broskod, and Win32/Broskod) is a crypto-ran... |
| btcon | Trojan | 1 | Btcon (classified in antivirus detection telemetry under designations including Trojan:Win32/Btcon, Trojan.Win32.Btcon, and Win32/Btcon) is a multi-stage trojan... |
| bumat | Ransomware | 1 | Bumat (classified in antivirus detection telemetry under designations including Ransom:Win32/Bumat, Ransom.Win32.Bumat, and Win32/Bumat) is a crypto-ransomware ... |
| burden | Ransomware | 1 | Burden (classified in antivirus detection telemetry under designations including Ransom:Win32/Burden, Ransom.Win32.Burden, and Win32/Burden) is a crypto-ransomw... |
| burnwoo | Ransomware | 1 | Burnwoo (classified in antivirus detection telemetry under designations including Ransom:Win32/Burnwoo, Ransom.Win32.Burnwoo, and Win32/Burnwoo) is a crypto-ran... |
| cachedis | Ransomware | 1 | Cachedis (classified in antivirus detection telemetry under designations including Ransom:Win32/Cachedis, Ransom.Win32.Cachedis, and Win32/Cachedis) is a crypto... |
| carrobat | Ransomware | 1 | Carrobat (classified in antivirus detection telemetry under designations including Ransom:Win32/Carrobat, Ransom.Win32.Carrobat, and Win32/Carrobat) is a crypto... |
| caxnet | Ransomware | 1 | Caxnet (classified in antivirus detection telemetry under designations including Ransom:Win32/Caxnet, Ransom.Win32.Caxnet, and Win32/Caxnet) is a crypto-ransomw... |
| ceram | Ransomware | 1 | Ceram (classified in antivirus detection telemetry under designations including Ransom:Win32/Ceram, Ransom.Win32.Ceram, and Win32/Ceram) is a crypto-ransomware ... |
| cfms | Ransomware | 1 | Cfms (classified in antivirus detection telemetry under designations including Ransom:Win32/Cfms, Ransom.Win32.Cfms, and Win32/Cfms) is a crypto-ransomware desi... |
| chinbo | Ransomware | 1 | <h3>Executive Summary</h3> Chinbo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| ciadoor | Trojan | 1 | <h3>Executive Summary</h3> CiaDoor is a stealthy Remote Access Trojan (RAT) and backdoor designed to provide threat actors with persistent, unauthorized adminis... |
| cinmus | Ransomware | 1 | <h3>Executive Summary</h3> Cinmus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| client | Trojan | 1 | <h3>Executive Summary</h3> In the context of malware taxonomy, "Client" is a generic classification denoting the client-side executable of a Remote Access Troja... |
| cliptoshuffler | Trojan | 1 | <h3>Executive Summary</h3> Cliptoshuffler (often referred to simply as a "Clipper") is a highly specialized and stealthy Trojan engineered specifically to steal... |
| coced | Ransomware | 1 | <h3>Executive Summary</h3> Coced is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor an... |
| code | Ransomware | 1 | Trojan:Win32/Code (or Exploit:JS/Code, Script:VBS/Code) is a generic classification denoting the detection of malicious scripting or raw exploit code, rather th... |
| conju | Ransomware | 1 | <h3>Executive Summary</h3> Conju is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| corpse | Ransomware | 1 | <h3>Executive Summary</h3> Corpse is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| covus | Ransomware | 1 | <h3>Executive Summary</h3> Covus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| cqst | Ransomware | 1 | <h3>Executive Summary</h3> Cqst is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| cromptui | Ransomware | 1 | <h3>Executive Summary</h3> Cromptui is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| cryptominer | Trojan | 1 | <h3>Executive Summary</h3> "Cryptominer" (often flagged as Riskware.CoinMiner, Trojan.Miner, or PUA.Miner) is a generic detection classification for software th... |
| cshv | Ransomware | 1 | <h3>Executive Summary</h3> Cshv is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| cussteel | Advanced Threat | 1 | <h3>Executive Summary</h3> Cussteel is a malicious Information Stealer (Info-stealer) designed to covertly infiltrate Windows systems and harvest highly sensiti... |
| cvky | Ransomware | 1 | <h3>Executive Summary</h3> Cvky is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| cxkh | Ransomware | 1 | <h3>Executive Summary</h3> Cxkh is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| cxkj | Ransomware | 1 | <h3>Executive Summary</h3> Cxkj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| dalatar | Ransomware | 1 | <h3>Executive Summary</h3> Dalatar is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| dalt | Ransomware | 1 | <h3>Executive Summary</h3> Dalt is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| darkcyrene | Ransomware | 1 | <h3>Executive Summary</h3> Darkcyrene is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downlo... |
| darsing | Ransomware | 1 | <h3>Executive Summary</h3> Darsing is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| datpol | Ransomware | 1 | <h3>Executive Summary</h3> Datpol is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| davy | Ransomware | 1 | <h3>Executive Summary</h3> Davy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| deau | Ransomware | 1 | <h3>Executive Summary</h3> Deau is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a reliable backdoo... |
| defsel | Ransomware | 1 | <h3>Executive Summary</h3> Defsel is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| destructbot | Ransomware | 1 | <h3>Executive Summary</h3> Destructbot is a highly aggressive classification of malware that functions as both a botnet agent and a destructive "wiper." Unlike ... |
| devilz | Ransomware | 1 | <h3>Executive Summary</h3> Devilz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| diamin | Ransomware | 1 | <h3>Executive Summary</h3> Diamin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| dicsor | Ransomware | 1 | <h3>Executive Summary</h3> Dicsor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| district | Ransomware | 1 | <h3>Executive Summary</h3> District is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| ditertag | Ransomware | 1 | <h3>Executive Summary</h3> Ditertag is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| dluca | Ransomware | 1 | <h3>Executive Summary</h3> Dluca is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| dlzp | Ransomware | 1 | <h3>Executive Summary</h3> Dlzp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| donise | Ransomware | 1 | <h3>Executive Summary</h3> Donise is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| donloz | Ransomware | 1 | <h3>Executive Summary</h3> Donloz is a malicious downloader Trojan engineered to stealthily infiltrate a target system, establish a hidden foothold, and subsequ... |
| donn | Ransomware | 1 | <h3>Executive Summary</h3> Donn is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| dorgam | Ransomware | 1 | <h3>Executive Summary</h3> Dorgam is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| doser | Trojan | 1 | <h3>Executive Summary</h3> Doser is a classification assigned to a specific category of malicious utilities (HackTools) and Trojans designed to execute Denial o... |
| dowanun | Ransomware | 1 | <h3>Executive Summary</h3> Dowanun is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| downexec | Ransomware | 1 | <h3>Executive Summary</h3> "Downexec" (often classified as Trojan.Downloader.Downexec) is a fundamental, yet highly effective, Trojan Downloader explicitly desi... |
| dragonbot | Trojan | 1 | Backdoor:Win32/Dragonbot is a versatile and persistent Remote Access Trojan (RAT) and botnet client. It provides an attacker with comprehensive, interactive con... |
| dsbot | Trojan | 1 | <h3>Executive Summary</h3> DSBot is a malicious Trojan with robust botnet capabilities, designed to covertly infiltrate Windows systems, establish deep persiste... |
| duduunion | Ransomware | 1 | <h3>Executive Summary</h3> Duduunion is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| dungcoi | Ransomware | 1 | <h3>Executive Summary</h3> Dungcoi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| dunik | Ransomware | 1 | <h3>Executive Summary</h3> Dunik is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| duon | Ransomware | 1 | <h3>Executive Summary</h3> Duon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| dzan | Ransomware | 1 | <h3>Executive Summary</h3> Dzan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| effbee | Ransomware | 1 | <h3>Executive Summary</h3> Effbee is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| elite | Ransomware | 1 | <h3>Executive Summary</h3> Elite is a classification commonly associated with highly destructive ransomware variants (often adopting the "Elite" moniker in thei... |
| emathi | Ransomware | 1 | <h3>Executive Summary</h3> Emathi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| emudbot | Ransomware | 1 | <h3>Executive Summary</h3> Emudbot is a persistent trojan designed to recruit infected endpoints into a distributed botnet architecture. Once a machine is compr... |
| esendi | Ransomware | 1 | <h3>Executive Summary</h3> Esendi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| eskimo | Ransomware | 1 | Backdoor:Win32/Eskimo is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True ... |
| estrella | Ransomware | 1 | <h3>Executive Summary</h3> Estrella is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| exchanger | Ransomware | 1 | <h3>Executive Summary</h3> Exchanger is a broad classification often applied to malware, typically trojans or potentially unwanted applications (PUAs), that fac... |
| exksws | Ransomware | 1 | <h3>Executive Summary</h3> Exksws is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| fakedos | Trojan | 1 | <h3>Executive Summary</h3> FakeDoS is a deceptive malware family categorized as a Trojan, often masquerading as a legitimate network testing tool or a "stress t... |
| fakeplayer | Trojan | 1 | <h3>Executive Summary</h3> FakePlayer is a classification for a widespread category of Trojans that utilize social engineering—specifically, masquerading as req... |
| fbng | Ransomware | 1 | <h3>Executive Summary</h3> Fbng is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| fire | Ransomware | 1 | <h3>Executive Summary</h3> Fire (often detected generically as Virus.Win32.Fire or Trojan.Fire) represents an older class of malicious software that exhibits cl... |
| foler | Ransomware | 1 | <h3>Executive Summary</h3> Foler is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| folstart | Ransomware | 1 | <h3>Executive Summary</h3> Folstart is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| food | Ransomware | 1 | <h3>Executive Summary</h3> Food (often classified generically as Trojan.Food or under broad heuristic signatures) is a malicious Trojan designed to covertly inf... |
| fosniw | Ransomware | 1 | <h3>Executive Summary</h3> Fosniw is a hybrid threat that combines the persistence and payload delivery mechanisms of a Trojan with the rapid propagation capabi... |
| frethoq | Ransomware | 1 | <h3>Executive Summary</h3> Frethoq is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| frosparf | Ransomware | 1 | <h3>Executive Summary</h3> Frosparf is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| gaofenq | Ransomware | 1 | <h3>Executive Summary</h3> Gaofenq is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| garvi | Ransomware | 1 | <h3>Executive Summary</h3> Garvi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| gdsda | Ransomware | 1 | <h3>Executive Summary</h3> Gdsda is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| gendelfan | Ransomware | 1 | <h3>Executive Summary</h3> Gendelfan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| genericrxat | Ransomware | 1 | <h3>Executive Summary</h3> GenericRXAT is a broad, heuristic detection name used by antivirus engines to identify a file exhibiting suspicious, Trojan-like beha... |
| genericrxcd | Ransomware | 1 | <h3>Executive Summary</h3> GenericRXCD is a broad, heuristic detection name used by antivirus engines to identify a file exhibiting suspicious, Trojan-like beha... |
| genericrxch | Ransomware | 1 | <h3>Executive Summary</h3> "GenericRxch" (often displayed as Generic.Rxch or Trojan.GenericRxch) is a broad, machine-generated heuristic detection signature uti... |
| genericrxcs | Ransomware | 1 | <h3>Executive Summary</h3> "GenericRxcs" (often displayed as Trojan.GenericRxcs or Heur.GenericRxcs) is a broad, machine-generated heuristic detection signature... |
| genericrxet | Ransomware | 1 | <h3>Executive Summary</h3> Genericrxet is a heuristic identifier frequently used by security engines to flag generic Trojan or Ransomware behaviors. The "rxet" ... |
| genericrxgq | Ransomware | 1 | <h3>Executive Summary</h3> "GenericRxgq" (often displayed as Trojan.GenericRxgq or Heur.GenericRxgq) is a broad, machine-generated heuristic detection signature... |
| genericrxgr | Ransomware | 1 | <h3>Executive Summary</h3> "GenericRxgr" (often displayed as Generic.Rxgr or Trojan.GenericRxgr) is a broad, machine-generated heuristic detection signature uti... |
| gentromal | Ransomware | 1 | <h3>Executive Summary</h3> Gentromal (often displayed as Trojan.Gentromal or Generic.Gentromal) is a broad, machine-generated heuristic detection signature util... |
| ggdoor | Trojan | 1 | <h3>Executive Summary</h3> GGDoor is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to compro... |
| giri | Ransomware | 1 | <h3>Executive Summary</h3> Giri is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| globim | Ransomware | 1 | <h3>Executive Summary</h3> Globim is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| gosys | Ransomware | 1 | <h3>Executive Summary</h3> Gosys is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| gplyra | Ransomware | 1 | <h3>Executive Summary</h3> Gplyra is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| gpukj | Ransomware | 1 | <h3>Executive Summary</h3> Gpukj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| grandcrap | Ransomware | 1 | <h3>Executive Summary</h3> Grandcrap (often a detection alias or misspelling of the highly notorious <strong>GandCrab</strong> ransomware family) represents a s... |
| graz | Ransomware | 1 | <h3>Executive Summary</h3> Graz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| gruel | Advanced Threat | 1 | <h3>Executive Summary</h3> Gruel is a classic, highly destructive Worm and Virus dating back to the early 2000s. Often categorized as "joke" or "nuisance" malwa... |
| haed | Ransomware | 1 | <h3>Executive Summary</h3> Haed is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| haknata | Ransomware | 1 | <h3>Executive Summary</h3> Haknata is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| hamer | Ransomware | 1 | <h3>Executive Summary</h3> Hamer is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| hamweq | Ransomware | 1 | <h3>Executive Summary</h3> Hamweq (often associated with the extensive IRCBot or AutoRun worm families) is a self-replicating malicious Worm and Botnet agent. D... |
| hangup | Ransomware | 1 | <h3>Executive Summary</h3> Hangup is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| heriplor | Ransomware | 1 | <h3>Executive Summary</h3> Heriplor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| hioles | Ransomware | 1 | <h3>Executive Summary</h3> Hioles is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a backdoor for remote... |
| honk | Ransomware | 1 | <h3>Executive Summary</h3> Honk is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| hookmoot | Ransomware | 1 | <h3>Executive Summary</h3> Hookmoot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| hqsi | Ransomware | 1 | <h3>Executive Summary</h3> Hqsi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| iczu | Ransomware | 1 | <h3>Executive Summary</h3> Iczu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| imps | Ransomware | 1 | <h3>Executive Summary</h3> Imps is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| inor | Ransomware | 1 | <h3>Executive Summary</h3> Inor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| inrogatio | Ransomware | 1 | <h3>Executive Summary</h3> Inrogatio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| insebro | Ransomware | 1 | <h3>Executive Summary</h3> Insebro is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| jakuz | Ransomware | 1 | <h3>Executive Summary</h3> Jakuz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| jevafus | Ransomware | 1 | <h3>Executive Summary</h3> Jevafus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| jinda | Ransomware | 1 | <h3>Executive Summary</h3> Jinda is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| jusabli | Ransomware | 1 | <h3>Executive Summary</h3> Jusabli is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| kabymj | Ransomware | 1 | <h3>Executive Summary</h3> Kabymj is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| kastenl | Ransomware | 1 | <h3>Executive Summary</h3> Kastenl is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| kavos | Ransomware | 1 | <h3>Executive Summary</h3> Kavos is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| keenm | Ransomware | 1 | <h3>Executive Summary</h3> Keenm is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| kelvir | Trojan | 1 | <h3>Executive Summary</h3> Kelvir is a widespread and aggressive family of Worms that primarily propagate by exploiting instant messaging networks, most notably... |
| keydoor | Backdoor | 1 | <h3>Executive Summary</h3> Keydoor is a highly specialized malware family that combines the stealth capabilities of a sophisticated backdoor with the data-harve... |
| kheagol | Ransomware | 1 | <h3>Executive Summary</h3> Kheagol is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| killapp | Ransomware | 1 | <h3>Executive Summary</h3> KillApp (often detected as Riskware.KillApp, Tool.KillApp, or Trojan.KillApp) identifies a specific class of malicious utilities or s... |
| kiser | Ransomware | 1 | <h3>Executive Summary</h3> Kiser is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| klozet | Ransomware | 1 | <h3>Executive Summary</h3> Klozet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| komilet | Ransomware | 1 | <h3>Executive Summary</h3> Komilet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| korad | Ransomware | 1 | <h3>Executive Summary</h3> Korad is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| krachulka | Ransomware | 1 | <h3>Executive Summary</h3> Krachulka is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| kranet | Trojan | 1 | <h3>Executive Summary</h3> Kranet is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into ... |
| kryptstarter | Ransomware | 1 | <h3>Executive Summary</h3> Kryptstarter (often referred to as Kryptik or Kryptik.Starter) is a generic classification for a malicious downloader or initial acce... |
| kura | Trojan | 1 | Backdoor:Win32/Kura is a versatile and persistent Remote Access Trojan (RAT) and botnet client. It provides an attacker with comprehensive, interactive control ... |
| lanxue | Ransomware | 1 | <h3>Executive Summary</h3> Lanxue is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| lemoore | Ransomware | 1 | <h3>Executive Summary</h3> Lemoore is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| linkhortry | Ransomware | 1 | <h3>Executive Summary</h3> Linkhortry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downlo... |
| litmus | Ransomware | 1 | <h3>Executive Summary</h3> Litmus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| liusky | Ransomware | 1 | <h3>Executive Summary</h3> Liusky is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| lockyc | Ransomware | 1 | <h3>Executive Summary</h3> Lockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware... |
| loops | Ransomware | 1 | <h3>Executive Summary</h3> Loops is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| loring | Ransomware | 1 | <h3>Executive Summary</h3> Loring is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| losabel | Ransomware | 1 | <h3>Executive Summary</h3> Losabel is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| lowzones | Ransomware | 1 | <h3>Executive Summary</h3> Lowzones is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| loyeetro | Ransomware | 1 | <h3>Executive Summary</h3> Loyeetro is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| lozer | Ransomware | 1 | <h3>Executive Summary</h3> Lozer is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, and act as a reliable backdo... |
| lucky | Ransomware | 1 | <h3>Executive Summary</h3> Lucky is a destructive Ransomware family, closely related to (and often considered a variant or evolution of) the notorious Satan ran... |
| luminorat | Trojan | 1 | Backdoor:Win32/Luminorat (LuminosityLink RAT) is a highly capable, commercially marketed Remote Access Trojan. Originally sold under the guise of legitimate sys... |
| mailbot | Ransomware | 1 | <h3>Executive Summary</h3> Mailbot is a malicious Trojan with robust botnet capabilities, specifically engineered to convert infected Windows systems into high-... |
| malkryp | Ransomware | 1 | <h3>Executive Summary</h3> Malkryp (often identified as Malkryp, MalKrypt, or similar variations) is a malicious Trojan designed to covertly infiltrate Windows ... |
| malwar | Ransomware | 1 | <h3>Executive Summary</h3> "Malwar" is a highly generic heuristic identifier often utilized by antivirus engines to flag a file that exhibits suspicious, Trojan... |
| malxmr | Advanced Threat | 1 | <h3>Executive Summary</h3> MalXMR is a pervasive and highly optimized malicious cryptocurrency miner (cryptojacking malware) specifically engineered to illicitl... |
| meinv | Ransomware | 1 | <h3>Executive Summary</h3> Meinv is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| meno | Ransomware | 1 | <h3>Executive Summary</h3> Meno is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| milicry | Ransomware | 1 | <h3>Executive Summary</h3> Milicry is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and extort ... |
| mmorpg | Trojan | 1 | <h3>Executive Summary</h3> MMORPG (often detected as Trojan.PWS.MMORPG or Spyware.MMORPG) is a specialized class of Password Stealing Trojans (PWS) engineered s... |
| mmxmr | Trojan | 1 | <h3>Executive Summary</h3> MMXMR is a specialized malicious cryptocurrency miner (cryptojacking malware) explicitly designed to illicitly mine Monero (XMR). By ... |
| mozla | Trojan | 1 | <h3>Executive Summary</h3> Mozla is a highly deceptive Trojan designed to exploit user trust by masquerading as legitimate components of the Mozilla Firefox web... |
| msilbot | Ransomware | 1 | <h3>Executive Summary</h3> MSILBot (often detected as MSIL.Trojan or MSIL.Bot) refers to a broad category of botnet malware and remote access trojans (RATs) tha... |
| muma | Ransomware | 1 | <h3>Executive Summary</h3> Muma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| mupx | Trojan | 1 | <h3>Executive Summary</h3> Mupx is a malicious threat that combines the persistence and self-replication capabilities of a network worm with the payload deliver... |
| murka | Ransomware | 1 | <h3>Executive Summary</h3> Murka is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting as... |
| musclecar | Ransomware | 1 | <h3>Executive Summary</h3> Musclecar is a malicious Trojan and Backdoor designed to covertly infiltrate Windows systems, establish persistence, and act as a rel... |
| naffy | Ransomware | 1 | <h3>Executive Summary</h3> Naffy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| nagram | Ransomware | 1 | <h3>Executive Summary</h3> Nagram is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| netdevil | Trojan | 1 | <h3>Executive Summary</h3> NetDevil is a legacy, yet highly capable, Remote Access Trojan (RAT) that gained prominence in the early to mid-2000s. Engineered to ... |
| newheur | Ransomware | 1 | <h3>Executive Summary</h3> "NewHeur" (often displayed as Generic.NewHeur or Trojan.NewHeur) is a broad, machine-generated heuristic detection signature utilized... |
| nilaspo | Ransomware | 1 | <h3>Executive Summary</h3> Nilaspo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| nion | Ransomware | 1 | <h3>Executive Summary</h3> Nion is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| nistio | Ransomware | 1 | <h3>Executive Summary</h3> Nistio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| nitter | Ransomware | 1 | <h3>Executive Summary</h3> Nitter is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| npgi | Ransomware | 1 | <h3>Executive Summary</h3> Npgi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| nussamoc | Ransomware | 1 | <h3>Executive Summary</h3> Nussamoc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| oasisminus | Ransomware | 1 | <h3>Executive Summary</h3> Oasisminus is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downlo... |
| obrypser | Ransomware | 1 | <h3>Executive Summary</h3> Obrypser is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| oflwr | Ransomware | 1 | <h3>Executive Summary</h3> Oflwr is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| omyaamfbexii | Ransomware | 1 | <h3>Executive Summary</h3> "Omyaamfbexii" is a generic detection identifier rather than a distinct, named malware family. It is typically generated automaticall... |
| optix | Trojan | 1 | <h3>Executive Summary</h3> Optix (most commonly referring to Optix Pro) is a notorious and highly capable Remote Access Trojan (RAT) that gained prominence in t... |
| orcusrot | Backdoor | 1 | Backdoor:Win32/Orcusrot is a detection name associated with variants or heavily customized builds of the 'Orcus RAT'. Originally marketed as a 'Remote Administr... |
| oremu | Ransomware | 1 | <h3>Executive Summary</h3> Oremu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| otorunq | Trojan | 1 | <h3>Executive Summary</h3> Otorunq is a network worm and trojan that utilizes the legacy Windows `autorun.inf` feature for aggressive lateral movement and propa... |
| oxynoxy | Ransomware | 1 | <h3>Executive Summary</h3> Oxynoxy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| oyom | Ransomware | 1 | <h3>Executive Summary</h3> Oyom is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| pabin | Ransomware | 1 | <h3>Executive Summary</h3> Pabin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| padmer | Ransomware | 1 | <h3>Executive Summary</h3> Padmer is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| pastraw | Ransomware | 1 | <h3>Executive Summary</h3> Pastraw is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| pasur | Ransomware | 1 | <h3>Executive Summary</h3> Pasur is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| pclnt | Trojan | 1 | <h3>Executive Summary</h3> Pclnt is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to comprom... |
| penzievs | Ransomware | 1 | <h3>Executive Summary</h3> Penzievs is a highly evasive Trojan designed to establish a covert backdoor on compromised Windows systems. While occasionally acting... |
| pepex | Ransomware | 1 | <h3>Executive Summary</h3> Pepex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| perez | Ransomware | 1 | <h3>Executive Summary</h3> Perez is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| petal | Ransomware | 1 | <h3>Executive Summary</h3> Petal is a malicious Trojan engineered to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| phires | Ransomware | 1 | <h3>Executive Summary</h3> Phires is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| phnu | Ransomware | 1 | <h3>Executive Summary</h3> Phnu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| phpain | Ransomware | 1 | <h3>Executive Summary</h3> Phpain is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| phtg | Ransomware | 1 | <h3>Executive Summary</h3> PHTG is a generic threat identifier utilized by various antivirus and endpoint detection engines to classify software that exhibits s... |
| pidmecc | Ransomware | 1 | <h3>Executive Summary</h3> Pidmecc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| pipo | Ransomware | 1 | <h3>Executive Summary</h3> Pipo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| pitin | Ransomware | 1 | <h3>Executive Summary</h3> Pitin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| plasma | Ransomware | 1 | Backdoor:Win32/Plasma (often referring to the 'Plasma RAT') is a sophisticated Remote Access Trojan frequently sold on underground hacking forums. It provides a... |
| platan | Ransomware | 1 | <h3>Executive Summary</h3> Platan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| plugs | Ransomware | 1 | <h3>Executive Summary</h3> Plugs is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| pondfull | Ransomware | 1 | <h3>Executive Summary</h3> Pondfull is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| porex | Ransomware | 1 | <h3>Executive Summary</h3> Porex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| potukorp | Ransomware | 1 | <h3>Executive Summary</h3> Potukorp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| poxters | Ransomware | 1 | <h3>Executive Summary</h3> Poxters is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| prex | Ransomware | 1 | <h3>Executive Summary</h3> Prex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| procgmar | Ransomware | 1 | <h3>Executive Summary</h3> Procgmar is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| proteus | Ransomware | 1 | <h3>Executive Summary</h3> Proteus represents a sophisticated, multi-purpose Botnet and Trojan framework designed to subjugate infected Windows systems. Once a ... |
| psshell | Ransomware | 1 | <h3>Executive Summary</h3> PSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish... |
| pulobe | Ransomware | 1 | <h3>Executive Summary</h3> Pulobe is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| puontib | Ransomware | 1 | <h3>Executive Summary</h3> Puontib is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| purgory | Ransomware | 1 | <h3>Executive Summary</h3> Purgory is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| pyme | Ransomware | 1 | <h3>Executive Summary</h3> Pyme is a malicious program that exhibits characteristics of both a Trojan and a Worm. It is designed to covertly infiltrate Windows ... |
| qdownb | Ransomware | 1 | <h3>Executive Summary</h3> Qdownb is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| ragua | Ransomware | 1 | <h3>Executive Summary</h3> Ragua is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| ranion | Ransomware | 1 | <h3>Executive Summary</h3> Ranion is a Ransomware-as-a-Service (RaaS) platform that emerged on the dark web, offering cybercriminals a highly accessible, low-ba... |
| ranna | Ransomware | 1 | <h3>Executive Summary</h3> Ranna is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| rapidpass | Ransomware | 1 | <h3>Executive Summary</h3> Rapidpass is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| rasch | Ransomware | 1 | <h3>Executive Summary</h3> Rasch is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| redgirl | Ransomware | 1 | <h3>Executive Summary</h3> Redgirl is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| remote | Trojan | 1 | Backdoor:Win32/Remote (and similar variants like RemoteAdmin or RemoteAccess) is a broad, generic detection category used by antivirus engines to flag Remote Ac... |
| remotehack | Trojan | 1 | <h3>Executive Summary</h3> RemoteHack is a broad classification for a suite of Remote Access Trojans (RATs) and remote administration HackTools. These tools are... |
| remoxec | Trojan | 1 | <h3>Executive Summary</h3> Remoxec is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows work... |
| reposfxg | Ransomware | 1 | <h3>Executive Summary</h3> Reposfxg is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| retribution | Ransomware | 1 | <h3>Executive Summary</h3> Retribution is a destructive family of Ransomware designed to infiltrate Windows systems, rapidly encrypt valuable user data, and ext... |
| reymbz | Ransomware | 1 | <h3>Executive Summary</h3> Reymbz is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| reyptson | Ransomware | 1 | <h3>Executive Summary</h3> Reyptson is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| rialega | Trojan | 1 | <h3>Executive Summary</h3> Rialega is a malicious Trojan engineered to compromise Windows environments, acting primarily as an initial access broker and downloa... |
| ridnu | Ransomware | 1 | <h3>Executive Summary</h3> Ridnu is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| rozenaa | Ransomware | 1 | <h3>Executive Summary</h3> Rozenaa is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| rvrat | Trojan | 1 | <h3>Executive Summary</h3> RvRAT is a highly capable Remote Access Trojan (RAT) engineered to provide attackers with covert, persistent, and fully interactive c... |
| sadredi | Ransomware | 1 | <h3>Executive Summary</h3> Sadredi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| safebreas | Ransomware | 1 | <h3>Executive Summary</h3> Safebreas is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| sakto | Ransomware | 1 | <h3>Executive Summary</h3> Sakto is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| sankei | Ransomware | 1 | <h3>Executive Summary</h3> Sankei is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| sbdld | Trojan | 1 | <h3>Executive Summary</h3> SBDLD (often classified as Trojan.Downloader.SBDLD) is a malicious Trojan explicitly designed to act as a stealthy vanguard for subse... |
| scarcruft | Trojan | 1 | <h3>Executive Summary</h3> ScarCruft (also known widely as APT37, Reaper, or Group123) is a highly capable, state-sponsored Advanced Persistent Threat (APT) gro... |
| scomma | Ransomware | 1 | <h3>Executive Summary</h3> Scomma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| scoopy | Ransomware | 1 | <h3>Executive Summary</h3> Scoopy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| scrami | Ransomware | 1 | <h3>Executive Summary</h3> Scrami is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| sdrop | Ransomware | 1 | <h3>Executive Summary</h3> Sdrop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| selcry | Ransomware | 1 | <h3>Executive Summary</h3> Selcry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| sennoma | Ransomware | 1 | <h3>Executive Summary</h3> Sennoma is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| senta | Ransomware | 1 | <h3>Executive Summary</h3> Senta is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| sfdld | Ransomware | 1 | <h3>Executive Summary</h3> Sfdld (often classified as Downloader.Sfdld) is a malicious Trojan specifically engineered to act as a stealthy delivery mechanism fo... |
| sfuzuan | Ransomware | 1 | <h3>Executive Summary</h3> Sfuzuan is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| sharer | Trojan | 1 | <h3>Executive Summary</h3> Sharer (often detected as Worm.P2P.Sharer or Trojan.Sharer) represents a family of legacy worms specifically engineered to exploit th... |
| shell | Backdoor | 1 | <h3>Executive Summary</h3> "Shell" is a broad, generic classification used by security engines to identify a malicious script or executable designed to provide ... |
| shellcodef | Ransomware | 1 | <h3>Executive Summary</h3> ShellcodeF (or generic detections like Exploit:Win32/Shellcode) is a heuristic detection applied to a highly malicious component of a... |
| shellme | Ransomware | 1 | <h3>Executive Summary</h3> Shellme is a classification applied to a category of HackTools specifically designed to establish reverse shells or bind shells. Whil... |
| siho | Ransomware | 1 | <h3>Executive Summary</h3> Siho is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| sillyp2p | Ransomware | 1 | <h3>Executive Summary</h3> SillyP2P is a classic classification for a family of computer worms designed to propagate rapidly across Peer-to-Peer (P2P) file-shar... |
| sisron | Ransomware | 1 | <h3>Executive Summary</h3> Sisron is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| sloddat | Ransomware | 1 | <h3>Executive Summary</h3> Sloddat is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| sneepy | Trojan | 1 | <h3>Executive Summary</h3> Sneepy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable backdoor a... |
| snow | Ransomware | 1 | <h3>Executive Summary</h3> Snow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate ... |
| sonbokli | Ransomware | 1 | <h3>Executive Summary</h3> Sonbokli is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| spamer | Trojan | 1 | <h3>Executive Summary</h3> Spamer (often detected as Riskware.Spamer, Tool.Spammer, or Trojan-Spammer) refers to a specialized category of illicit utility softw... |
| spamha | Trojan | 1 | <h3>Executive Summary</h3> Spamha is a specialized Trojan and Spambot designed to hijack the network resources of infected Windows systems. Once deployed, it si... |
| specx | Ransomware | 1 | <h3>Executive Summary</h3> Specx is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| spook | Ransomware | 1 | Backdoor:Win32/Spook is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True t... |
| staget | Ransomware | 1 | <h3>Executive Summary</h3> Staget is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| strat | Ransomware | 1 | <h3>Executive Summary</h3> Strat is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| subroate | Ransomware | 1 | <h3>Executive Summary</h3> Subroate is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| suixin | Trojan | 1 | <h3>Executive Summary</h3> Suixin is a malicious Trojan and Spyware application designed to covertly infiltrate Windows systems, establish persistence, and harv... |
| suviapen | Ransomware | 1 | <h3>Executive Summary</h3> Suviapen is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| swog | Ransomware | 1 | <h3>Executive Summary</h3> Swog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| talmad | Ransomware | 1 | <h3>Executive Summary</h3> Talmad is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| tartober | Ransomware | 1 | <h3>Executive Summary</h3> Tartober is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| tcdrop | Ransomware | 1 | <h3>Executive Summary</h3> Tcdrop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| teambot | Ransomware | 1 | <h3>Executive Summary</h3> TeamBot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tear | Trojan | 1 | <h3>Executive Summary</h3> Tear is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows worksta... |
| tedroo | Ransomware | 1 | <h3>Executive Summary</h3> Tedroo is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| tgrandongc | Ransomware | 1 | <h3>Executive Summary</h3> Tgrandongc is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downlo... |
| tierry | Ransomware | 1 | <h3>Executive Summary</h3> Tierry is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| tikoog | Ransomware | 1 | <h3>Executive Summary</h3> Tikoog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| tinclex | Ransomware | 1 | <h3>Executive Summary</h3> Tinclex is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tivmonk | Ransomware | 1 | <h3>Executive Summary</h3> Tivmonk is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tobor | Trojan | 1 | <h3>Executive Summary</h3> Tobor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into a... |
| tomegun | Ransomware | 1 | <h3>Executive Summary</h3> Tomegun is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tosthin | Ransomware | 1 | <h3>Executive Summary</h3> Tosthin is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| totbrick | Ransomware | 1 | <h3>Executive Summary</h3> Totbrick is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| tracur | Ransomware | 1 | <h3>Executive Summary</h3> Tracur is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| trilon | Ransomware | 1 | <h3>Executive Summary</h3> Trilon is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| trioris | Ransomware | 1 | <h3>Executive Summary</h3> Trioris is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tron | Ransomware | 1 | <h3>Executive Summary</h3> Tron is a sophisticated Botnet and Trojan framework designed to subjugate infected Windows systems. Once a machine is compromised, Tr... |
| troxa | Ransomware | 1 | <h3>Executive Summary</h3> Troxa is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| tukrina | Ransomware | 1 | <h3>Executive Summary</h3> Tukrina is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| tyuimoi | Ransomware | 1 | <h3>Executive Summary</h3> Tyuimoi is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| udslee | Ransomware | 1 | <h3>Executive Summary</h3> Udslee is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| urcs | Ransomware | 1 | <h3>Executive Summary</h3> URCS (often associated with the URC Bot) is a sophisticated Remote Access Trojan (RAT) and Botnet framework engineered to provide att... |
| uruasy | Ransomware | 1 | <h3>Executive Summary</h3> Uruasy is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| vakcune | Ransomware | 1 | <h3>Executive Summary</h3> Vakcune is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| virgilio | Ransomware | 1 | <h3>Executive Summary</h3> Virgilio is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| vitruvian | Ransomware | 1 | <h3>Executive Summary</h3> Vitruvian is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloa... |
| vixup | Ransomware | 1 | <h3>Executive Summary</h3> Vixup is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| vortex | Ransomware | 1 | <h3>Executive Summary</h3> Vortex is a destructive family of Ransomware (closely related to or derived from the AES-NI ransomware family) designed to infiltrate... |
| votchsys | Ransomware | 1 | <h3>Executive Summary</h3> Votchsys is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| vtub | Advanced Threat | 1 | <h3>Executive Summary</h3> Vtub is a malicious network worm designed to propagate rapidly across local area networks (LANs) and removable media. While it freque... |
| walerlop | Ransomware | 1 | <h3>Executive Summary</h3> Walerlop is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| wansrog | Ransomware | 1 | <h3>Executive Summary</h3> Wansrog is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| wavipeg | Ransomware | 1 | <h3>Executive Summary</h3> Wavipeg is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| webbrowserpassview | Trojan | 1 | <h3>Executive Summary</h3> WebBrowserPassView is a legitimate password recovery utility created by NirSoft. It is designed to extract and display all passwords ... |
| whiteice | Ransomware | 1 | <h3>Executive Summary</h3> WhiteIce is a malicious downloader Trojan engineered to stealthily infiltrate a target system, establish a hidden foothold, and subse... |
| windang | Trojan | 1 | <h3>Executive Summary</h3> Windang is a malicious Trojan with robust botnet capabilities, designed to covertly infiltrate Windows systems, establish deep persis... |
| winiga | Ransomware | 1 | <h3>Executive Summary</h3> Winiga is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| woripecs | Ransomware | 1 | <h3>Executive Summary</h3> Woripecs is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| xcomp | Ransomware | 1 | <h3>Executive Summary</h3> Xcomp is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| xxyeut | Ransomware | 1 | <h3>Executive Summary</h3> Xxyeut is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| yolov | Ransomware | 1 | <h3>Executive Summary</h3> Yolov is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| yuri | Trojan | 1 | <h3>Executive Summary</h3> Yuri is a highly dangerous Remote Access Trojan (RAT) and Backdoor. Its primary objective is to silently infiltrate a Windows worksta... |
| zanoza | Trojan | 1 | <h3>Executive Summary</h3> Zanoza (Russian for "splinter") is a malicious Trojan designed to covertly infiltrate Windows systems, establish deep persistence, an... |
| zdowbot | Trojan | 1 | <h3>Executive Summary</h3> Zdowbot is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and conscript the endpoint into... |
| zenfly | Ransomware | 1 | <h3>Executive Summary</h3> Zenfly is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader... |
| zilix | Ransomware | 1 | <h3>Executive Summary</h3> Zilix is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| zjek | Ransomware | 1 | <h3>Executive Summary</h3> Zjek is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| zonebac | Ransomware | 1 | <h3>Executive Summary</h3> Zonebac is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloade... |
| zonobindi | Ransomware | 1 | Backdoor:Win32/Zonobindi is a versatile and persistent Remote Access Trojan (RAT). It provides an attacker with comprehensive, interactive control over a compro... |
| zudochka | Ransomware | 1 | <h3>Executive Summary</h3> Zudochka is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable download... |
| zvrek | Ransomware | 1 | <h3>Executive Summary</h3> Zvrek is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader ... |
| zxor | Ransomware | 1 | <h3>Executive Summary</h3> Zxor is a malicious Trojan designed to covertly infiltrate Windows systems, establish persistence, and act as a reliable downloader f... |
| a_311_death | Banking Trojan | Sampled | A-311 Death is a seminal Remote Administration Tool (RAT) and Trojan active during the early-to-mid 2000s threat landscape. Operating primarily as an invasive s... |
| acid_drop | Trojan | Sampled | Acid Drop (also documented in historical archives as AcidDrop or Backdoor.AcidDrop) is a vintage remote access backdoor and Trojan horse originating in the late... |
| aero | Adware | Sampled | Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applicat... |
| amiboide | Backdoor | Sampled | Amiboide is a historical malware family that primarily operated as a trojan horse, targeting Windows operating systems. It was often distributed through malicio... |
| apocalypse_rat | Rat | Sampled | Apocalypse RAT (Remote Access Trojan) is a potent piece of malware designed to provide threat actors with comprehensive control over compromised Windows systems... |
| back_orifice | Backdoor | Sampled | Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cyb... |
| beast | Rat | Sampled | Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95... |
| bersek | Backdoor | Sampled | Bersek is an intricate malware strain primarily characterized by its capabilities as a backdoor and information stealer. It infiltrates systems typically via so... |
| bozok | Trojan | Sampled | Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealt... |
| bump_rat | Trojan | Sampled | Bump-Rat is a specialized malware family that has drawn attention for its targeted application in cyber espionage campaigns. Unlike broadly distributed commodit... |
| netbus | Rat | Sampled | NetBus is one of the earliest, most legendary, and influential Remote Access Trojans in personal computing history, originally created in March 1998 by Swedish ... |