T1071.001: Application Layer Protocol: Web Protocols (C2 Communication)
Operational Executive Summary
T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication)) is classified under the Command and Control tactic within the MITRE ATT&CK framework. Communication channels and covert protocols utilized to maintain interactive control of compromised implants through legitimate web protocols, encrypted proxies, and DNS tunneling. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 272 distinct malware families, totaling over 209,429 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Application Layer Protocol: Web Protocols (C2 Communication) to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Application Layer Protocol: Web Protocols (C2 Communication), malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1071.001 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Application Layer Protocol: Web Protocols (C2 Communication) to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1071/001/.
Detection Engineering & Threat Hunting
Detecting Application Layer Protocol: Web Protocols (C2 Communication) requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication)) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Application Layer Protocol: Web Protocols (C2 Communication) across adjacent network segments.
Cataloged Malware Families Utilizing T1071.001 (272 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1071.001 (Application Layer Protocol: Web Protocols (C2 Communication)):
272 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| xtrat | Rat | 35,969 | Xtreme RAT (widely tracked as xtrat or xrat) is a feature-complete, commercial-grade remote access trojan that first surfaced in late 2010. Engineered originall... |
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| zusy | Banking Trojan | 14,120 | Tinba (formally designated in AV classification as Zusy or IlliBanker, and colloquially celebrated as the 'Tiny Banker') is a notoriously compact banking trojan... |
| emotet | Loader | 12,943 | Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observe... |
| vtflooder | Pua Tool | 12,150 | VtFlooder (tracked across enterprise threat intelligence as Trojan:Win32/VtFlooder, Tool:Win32/VtFlooder, and Spammer:Win32/VtFlooder) is an automated cloud sub... |
| adposhel | Adware | 8,951 | Adposhel (tracked across the cybersecurity industry as Adware:Win32/Adposhel, PUA:Win32/Adposhel, and Adware.BrowseFox) is an intrusive ad-injection and browser... |
| ursnif | Banking Trojan | 8,188 | Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ... |
| startsurf | Browser Hijacker | 6,358 | StartSurf (classified by cybersecurity vendors as BrowserModifier:Win32/StartSurf, Adware:Win32/StartSurf, and PUP.Optional.StartSurf) is a pervasive browser hi... |
| lethic | Spam Bot | 4,879 | Lethic is a notorious, long-running spam-distribution botnet that first emerged in 2008. Designed specifically as an automated email transmission engine for Eas... |
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| dealply | Adware | 3,976 | DealPly (classified across security products as Adware:Win32/DealPly, Adware.DealPly, and Win32:DealPly) is a sophisticated modular adware and browser modificat... |
| razy | Infostealer | 3,391 | Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information st... |
| vittalia | Pua | 2,965 | Vittalia (documented across endpoint telemetry as Adware.Vittalia, PUP.Optional.Vittalia, and PUA:Win32/Vittalia) is a persistent adware bundler, browser hijack... |
| gamarue | Loader | 2,789 | Gamarue (widely tracked by security vendors as Andromeda or Wauchos) is one of the most prolific and technically sophisticated modular botnet loaders in the his... |
| nanocore | Rat | 2,400 | NanoCore is an extensively proliferated, modular .NET-based Remote Access Trojan (RAT) originally created in 2013 by software developer Zachary Shames of Great ... |
| chapak | Downloader | 2,254 | TrojanDownloader:Win32/Chapak (widely cataloged across threat telemetry as Trojan.Chapak, Win32/Chapak, or Downloader.Chapak) is a high-volume, multi-stage troj... |
| sdbot | Rat | 1,931 | SDBot is one of the most foundational, architecturally influential, and widely cloned IRC-controlled backdoor trojans in computer security history, first releas... |
| cerber | Ransomware | 1,792 | Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Deve... |
| tiggre | Cryptominer | 1,728 | Trojan:Win32/Tiggre!rfn (widely recognized across Microsoft Defender and endpoint telemetry as CoinMiner.Tiggre, Trojan.Tiggre, or Win32/Tiggre) is a prolific, ... |
| delf | Trojan | 1,727 | Trojan:Win32/Delf (historically cataloged across antivirus telemetry as TrojanSpy:Win32/Delf, Trojan.Win32.Delf, or Win32/Delf) is one of the most prolific and ... |
| qhost | Trojan | 1,722 | Trojan:Win32/Qhost (cataloged widely across security telemetry as TROJ_QHOST, DNSChanger.Qhost, or Win32/Qhost) is a classic and persistent DNS-tampering trojan... |
| dotdo | Adware | 1,678 | Dotdo (tracked across enterprise antivirus vendors as Adware:Win32/Dotdo, Trojan:Win32/Dotdo, and Adware.DotDo) is a persistent adware engine and local network ... |
| gepys | Downloader | 1,587 | Trojan:Win32/Gepys (cataloged across security vendor telemetry as Trojan.Gepys, Downloader.Gepys, or Win32/Gepys) is an aggressive Windows trojan downloader and... |
| tinba | Banking Trojan | 1,531 | Trojan:Win32/Tinba (short for 'Tiny Banker', also cataloged by vendors as Zusy) is a landmark banking trojan famous for its remarkably micro-sized footprint—com... |
| azorult | Infostealer | 1,513 | AZORult is an infamous, highly efficient commodity information stealer and malware downloader first commercialized in 2016 by Russian underground developer 'Pav... |
| fearless_lite | Spyware | 1,500 | Fearless Lite (tracked across antivirus engines as Trojan-Spy.Win32.FearlessLite and Spyware.FearlessLite) is a streamlined, low-footprint variant of the Fearle... |
| flux | Backdoor | 1,500 | Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfac... |
| hav_rat | Rat | 1,500 | Hav-RAT (cataloged across antivirus software as Backdoor:Win32/HavRAT, Trojan.Win32.HavRAT, and Backdoor.HavRat) is a classic Delphi-authored Remote Access Troj... |
| hue | Trojan | 1,500 | Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan ... |
| icecold_reloaded | Rat | 1,500 | IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based... |
| triusor | Trojan | 1,429 | Trojan:Win32/Triusor (cataloged across security telemetry as Trojan.Triusor, Downloader.Triusor, or Win32/Triusor) is a modular Windows trojan downloader and dr... |
| zpevdo | Trojan | 1,303 | Trojan:Win32/Zpevdo (cataloged across security telemetry as Trojan.Win32.ZPEVDO, Win32/Zpevdo, or Downloader.Zpevdo) is an evasive multi-stage trojan loader and... |
| unruy | Click Fraud | 1,267 | Unruy (identified across threat telemetry as Trojan:Win32/Unruy, Trojan-Clicker.Win32.Unruy, and Adware:Win32/Unruy) is an evasive background click-fraud trojan... |
| istartsurf | Browser Hijacker | 1,214 | iStartSurf (cataloged across enterprise telemetry as BrowserModifier:Win32/IStartSurf, Adware:Win32/IStartSurf, and PUP.Optional.iStartSurf) is an aggressive br... |
| darkgate | Loader | 1,205 | DarkGate is an evasive, commercial Malware-as-a-Service (MaaS) loader and remote access platform developed by a cybercriminal known as 'RastaFarEye'. Active pri... |
| linkury | Adware | 1,194 | Linkury (cataloged by enterprise security teams as Adware:Win32/Linkury, BrowserModifier:Win32/Linkury, and PUP.Optional.Linkury) is a notorious browser hijacke... |
| swisyn | Trojan | 1,036 | Trojan:Win32/Swisyn (cataloged across industry vendor telemetry as TrojanDropper:Win32/Swisyn, Trojan.Win32.Swisyn, or Win32/Swisyn) is an evasive multi-stage t... |
| spigot | Adware | 1,008 | Spigot (documented by Microsoft Defender, Malwarebytes, and Sophos as BrowserModifier:Win32/Spigot, Adware:Win32/Spigot, and PUP.Optional.Spigot) is a widely di... |
| dinwod | File Infector | 973 | Dinwod (classified by Microsoft Defender and Trend Micro as Trojan:Win32/Dinwod, TrojanDropper:Win32/Dinwod, and Trojan.Win32.DINWOD.B) is an evasive trojan dro... |
| noon | Adware | 926 | Noon (documented across security intelligence solutions as Adware:Win32/Noon and BrowserModifier:Win32/Noon) is an aggressive adware and browser modifier platfo... |
| shipup | Adware | 896 | ShipUp (tracked across threat intelligence feeds as Adware:Win32/ShipUp, Trojan.Win32.ShipUp, and Win32/Shipup) is a deceptive adware engine and background payl... |
| lamer | Worm | 894 | Worm:Win32/Lamer is a dual-threat propagation worm and trojan downloader that emerged in the mid-2000s, designed to infiltrate Windows networks and establish a ... |
| pikabot | Loader | 850 | Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to ... |
| darkkomet | Rat | 801 | DarkComet (frequently cataloged in security telemetry as DarkKomet or Backdoor.Win32.DarkKomet) is an iconic, feature-packed Remote Access Trojan (RAT) original... |
| nymaim | Downloader | 756 | Nymaim is a sophisticated dual-stage malware downloader and loader first observed in 2013. Designed with extreme resilience, Nymaim specialized in evading secur... |
| yakes | Trojan | 751 | Trojan:Win32/Yakes (widely cataloged across antivirus telemetry as Trojan.Yakes or Win32/Yakes) is a prolific family of obfuscated trojan downloaders and multi-... |
| nitol | Ddos Bot | 694 | Nitol (cataloged across global cybersecurity threat intelligence as DDoS:Win32/Nitol, Trojan:Win32/Nitol, and Backdoor.Win32.Nitol) is a notorious Distributed D... |
| urelas | Infostealer | 666 | Trojan:Win32/Urelas is a specialized information stealer and credential extraction trojan engineered to harvest authentication credentials, session cookies, and... |
| ainslot | Trojan | 635 | Trojan:Win32/Ainslot (also cataloged in threat telemetry as Worm:Win32/Ainslot.A, TROJ_GEN.UAE171Y, or Win32/Ainslot) is a persistent Windows trojan dropper and... |
| simbot | Backdoor | 634 | Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or B... |
| qqpass | Infostealer | 612 | Trojan-PSW.Win32.QQPass (broadly cataloged in antivirus telemetry as PWS:Win32/QQPass) is an aggressive, specialized password stealer engineered explicitly to t... |
| khalesi | Infostealer | 555 | Backdoor:Win32/Khalesi is an evasive, modular information stealer and Remote Access Trojan (RAT) engineered to harvest corporate banking credentials, system con... |
| detnat | Trojan | 523 | Trojan:Win32/Detnat (frequently cataloged in security telemetry as Trojan:Win32/Detnat!MTB, Trojan.Detnat, or Win32/Detnat) is an evasive multi-component backdo... |
| trickbot | Trojan | 466 | TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor... |
| agentb | Trojan | 449 | Agent.B (classified across commercial antivirus vendors as Trojan:Win32/Agent.B, Trojan-Downloader.Win32.Agent.b, and Backdoor.Agent.B) is a long-standing, prol... |
| memery | Trojan | 445 | Memery (cataloged across security software as Trojan:Win32/Memery, Backdoor:Win32/Memery, and Trojan-Spy.Win32.Memery) is an evasive memory-resident trojan and ... |
| zegost | Rat | 441 | Trojan:Win32/Zegost (widely documented by threat researchers as Backdoor.Zegost or Zegost RAT) is a sophisticated cyber espionage Remote Access Trojan and rootk... |
| ausiv | Trojan | 422 | Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that eme... |
| ekstak | Trojan | 421 | Ekstak (cataloged across security software as Trojan.Win32.Ekstak, Trojan:Win32/Ekstak, and Worm:Win32/Ekstak) is a covert Windows backdoor trojan and spyware f... |
| cosmicduke | Infostealer | 408 | Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / R... |
| berbew | Infostealer | 407 | Trojan:Win32/Berbew (widely known in antivirus telemetry as Padodor) is a historic banking trojan and multi-purpose infostealer discovered in 2004 that pioneere... |
| maener | Cryptominer | 387 | Maener (cataloged by security vendors as Trojan:Win32/Maener, Trojan.Win32.Maener, Worm:Win32/Maener, and Bindmaener) is a persistent cryptocurrency mining troj... |
| lolbot | Worm | 374 | Worm:Win32/Lolbot is a notorious worm and remote access trojan that achieved massive global distribution by hijacking instant messaging platforms—including Skyp... |
| ponystealer | Infostealer | 374 | Trojan:Win32/PonyStealer (universally recognized in cyber threat intelligence as Pony or Fareit) is a foundational credential theft trojan and stage-one botnet ... |
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| koobface | Worm | 350 | Koobface (an anagram of 'Facebook') was the definitive pioneer of social-network worm and botnet operations, reigning as one of the most prolific and profitable... |
| ganelp | Trojan | 348 | Ganelp (cataloged across security solutions as Trojan:Win32/Ganelp, Trojan-Spy.Win32.Ganelp, and PWS:Win32/Ganelp) is a specialized password-stealing trojan and... |
| midie | Trojan | 341 | Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader t... |
| zdengo | Adware | 333 | Zdengo (frequently classified by security solutions as Adware.Zdengo, Trojan:Win32/Zdengo, Zdengo.A, and PUA:Win32/Zdengo) is a persistent adware installer, cli... |
| mintluks | Infostealer | 330 | Mintluks (tracked across security telemetry as PWS:MSIL/Mintluks, TrojanDownloader:Win32/Mintluks, and MSIL/Mintluks) is a specialized .NET-based information st... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| snojan | Trojan | 324 | Snojan (cataloged across security research authorities as Trojan.Win32.SNOJAN.A, Trojan:Win32/Snojan, and Backdoor:Win32/Snojan) is a persistent backdoor trojan... |
| mikey | Adware | 314 | Mikey (cataloged across security software as PUA.Win32.Mikey.AA, Trojan:Win32/Mikey, and PUA:Win32/Mikey!MTB) is a pervasive Potentially Unwanted Application (P... |
| nanobot | Rat | 306 | Backdoor:Win32/Nanobot is a modular, lightweight Remote Access Trojan (RAT) and stage-two loader engineered with an extremely compact on-disk footprint (typical... |
| expiro | File Infector | 305 | Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-... |
| shiz | Banking Trojan | 302 | Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and G... |
| dfay | Trojan | 300 | TrojanDropper:Win32/Dfay (widely cataloged across vendor telemetry as Trojan.Dfay or Win32/Dfay) is an evasive trojan dropper and memory injection loader engine... |
| regsup | Trojan | 296 | Regsup (cataloged across security vendors as Trojan:Win32/Regsup, PUA:Win32/Regsup, and Trojan.Win32.Regsup) is a Windows trojan downloader and potentially unwa... |
| winwrapper | Pua Tool | 296 | WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-instal... |
| kasidet | Pos Malware | 294 | Kasidet (cataloged across threat research as Neutrino Bot, Win32/Kasidet, Trojan.Kasidet, and Backdoor:Win32/Kasidet) is a sophisticated modular Windows botnet ... |
| dlhelper | Downloader | 290 | Dlhelper (classified in antimalware telemetry as SoftwareBundler:Win32/Dlhelper and PUA:Win32/DLHelper) is a deceptive software bundler and secondary downloader... |
| banload | Downloader | 288 | Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of troj... |
| yunsip | Infostealer | 280 | Yunsip (tracked across security vendor definitions as PWS:Win32/Yunsip, Trojan:Win32/Yunsip, and PWS:Win32/Yunsip.A) is an aggressive credential-stealing trojan... |
| eorezo | Adware | 271 | EoRezo (cataloged across antimalware products as Adware:Win32/EoRezo, PUA:Win32/EORezo, and Adware.EoRezo) is a pervasive French adware platform and software bu... |
| tofsee | Spam Bot | 264 | Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan... |
| xmrig | Cryptominer | 248 | XMRig (cataloged across antivirus vendors as Coinminer:Win32/XMRig, Trojan.XMRig, and Riskware.XMRig) is a high-performance open-source Monero (XMR) cryptocurre... |
| daws | Ransomware | 246 | TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader and stage-one ransomware... |
| browserio | Adware | 243 | Browserio (identified across antimalware engines as PUA:Win32/Browserio and Adware.Browserio) is an aggressive browser hijacker and adware program operating on ... |
| olgames | Infostealer | 243 | PWS:Win32/Onlinegames (extensively tracked across security vendor databases as Trojan-PSW.Win32.OnLineGames or PSW.OnLineGames) is a massive, long-running famil... |
| amonetize | Downloader | 242 | Amonetize (cataloged in antimalware telemetry as PUA:Win32/Amonetize, SoftwareBundler:Win32/Amonetize, and Adware.Amonetize) is a commercial pay-per-install (PP... |
| disfa | Trojan | 238 | Disfa (cataloged in antivirus telemetry as Trojan:Win32/Disfa, Trojan.MSIL.Disfa, and recognized as a variant of the Bladabindi / njRAT malware family) is a .NE... |
| blackmoon | Banking Trojan | 228 | Trojan:Win32/Blackmoon (widely designated in cybersecurity research as KRBanker) is a destructive, regionally focused banking trojan that emerged in 2014, speci... |
| mywebsearch | Adware | 223 | MyWebSearch (cataloged across security software as Adware:Win32/MyWebSearch, Adware.MyWebSearch, and MyWebSearch Toolbar) is one of the most widely distributed ... |
| reconyc | Downloader | 222 | Reconyc (cataloged across security software as Trojan:Win32/Reconyc, Trojan.Win32.Reconyc, and Trojan.Reconyc) is a heavily obfuscated Windows trojan dropper an... |
| kolab | Worm | 219 | Kolab (cataloged across security vendors as Worm:Win32/Kolab, Net-Worm.Win32.Kolab, WORM_KOLABC, and W32/Kolab) is a prolific Windows network worm and backdoor ... |
| cosmu | Rat | 218 | Cosmu (sometimes referred to as Win32/Cosmu) is a long-standing family of malware that primarily functions as an information stealer and, in some variants, a wo... |
| drolnux | Worm | 205 | Drolnux (tracked in antivirus telemetry as Worm:Win32/Drolnux, Worm:Win32/Drolnux.A, and W32/Drolnux) is a network-aware computer worm and backdoor trojan that ... |
| barys | Infostealer | 200 | Barys (cataloged in threat telemetry under signatures including Trojan:Win32/Barys, Trojan:PowerShell/Barys, and HEUR:Trojan-Spy.MSIL.Stealer) is a modular Wind... |
| remcos | Rat | 198 | Remcos (an acronym for 'Remote Control & Surveillance') is a feature-rich, commercial Remote Access Trojan first released in 2016 by Italian software developer ... |
| phpw | Trojan | 195 | PHPW (cataloged in antivirus telemetry as Trojan:Win32/PHPW, Trojan.PHPW, and Backdoor:Win32/PHPW) is a Windows backdoor trojan and surveillance agent tracked s... |
| spyeye | Banking Trojan | 192 | SpyEye (cataloged across security vendors as Trojan:Win32/SpyEye, Win32/SpyEye, and TSPY_SPYEYE) is one of the most notorious and commercially successful bankin... |
| processhijack | Trojan | 187 | ProcessHijack (cataloged in threat telemetry as Trojan:Win32/ProcessHijack and Trojan:Win32/ProcessHijack.GTM!MTB) represents a family of sophisticated stealth ... |
| hydracrypt | Ransomware | 180 | HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware fam... |
| mailru | Adware | 174 | MailRu (cataloged across security software as PUA:Win32/MailRu, PUA:Win32/MailRuBar, and Adware.MailRu) identifies an aggressive adware and Potentially Unwanted... |
| pykspa | Worm | 169 | Pykspa (cataloged across threat intelligence as W32/Pykspa, Worm:Win32/Pykspa, and the Skype Worm Pykspa) is an information-stealing worm that first emerged in ... |
| swrort | Backdoor | 161 | Swrort (cataloged across security industry feeds as Backdoor:Win32/Swrort.A, BKDR_SWRORT.A, Trojan:Win32/Swrort, and Trojan.Swrort) is a stealthy Remote Access ... |
| socelars | Infostealer | 159 | Trojan:Win32/Socelars is a targeted browser session hijacking and credential theft trojan that surfaced in 2019, specifically engineered to compromise corporate... |
| ipamor | Backdoor | 147 | Ipamor (cataloged across security industry feeds as Backdoor:Win32/Ipamor, Trojan:Win32/Ipamor!rfn, Trojan.Win32.IPAMOR, and PE_IPAMOR) is a stealthy remote acc... |
| hupigon | Rat | 146 | Backdoor:Win32/Hupigon (universally known in China as Huigezi, translated as 'Grey Pigeon') is a classic, historically legendary Chinese Remote Access Trojan (R... |
| bsymem | Ransomware | 144 | Trojan:Win32/Bsymem (cataloged across vendor telemetry as Trojan.Bsymem or Ransom.Bsymem) is a stealthy dual-stage remote access backdoor and enterprise ransomw... |
| cassiopeia | Backdoor | 137 | Cassiopeia (cataloged across security vendor detection systems as Backdoor:Win32/Cassiopeia, BKDR_CASSIOPEIA.A, and Trojan:Win32/Cassiopeia) is a stealthy Remot... |
| salgorea | Backdoor | 135 | Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cybe... |
| scarsi | Backdoor | 133 | Scarsi (cataloged across security vendors under signatures including Backdoor:Win32/Scarsi, Trojan:Win32/Scarsi, and Win32/Scarsi) is a stealthy Remote Access T... |
| spygate | Rat | 127 | Backdoor:Win32/Spygate (widely known as SpyGate-RAT) is a prominent, commercial Remote Access Trojan builder developed in .NET and Visual Basic that emerged in ... |
| autohk | Trojan | 120 | The "AutoHK" malware family refers to a broad category of malicious programs that utilize AutoHotkey (AHK), a legitimate and open-source scripting language desi... |
| goznym | Banking Trojan | 120 | Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s... |
| hafen | Backdoor | 120 | Hafen (cataloged across security vendors under detections including Backdoor:Win32/Hafen, BKDR_HAFEN.A, and Trojan:Win32/Hafen) is a stealthy Remote Access Troj... |
| predator | Spyware | 120 | Predator is a premier commercial zero-day mercenary spyware platform engineered by Cytrox (part of the European surveillance consortium known as the Intellexa A... |
| rebhip | Rat | 120 | Worm:Win32/Rebhip is a stealthy dual-threat worm and keylogging trojan discovered in 2011 that proliferates via removable USB drives and unsecured local network... |
| icedid | Banking Trojan | 118 | IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept... |
| gozi | Banking Trojan | 113 | Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput... |
| palevo | Botnet | 106 | Worm:Win32/Palevo (universally known in cybersecurity research as the Butterfly Bot and the Mariposa botnet) was a monumental, highly modular crimeware botnet t... |
| remoteadmin | Hacktool | 95 | RemoteAdmin (cataloged across security vendors under detections including RiskWare:Win32/RemoteAdmin, HackTool:Win32/RemoteAdmin, and Win32/RemoteAdmin) is a ge... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| meterpreter | Hacktool | 78 | Meterpreter (cataloged across security vendors and threat intelligence databases under detections including HackTool:Win32/Meterpreter, Trojan:Win32/Meterpreter... |
| netwiredrc | Rat | 72 | Trojan:Win32/Netwire (cataloged as NetWiredRC, or simply NetWire) is an infamous cross-platform Remote Access Trojan (RAT) and infostealer that was commercially... |
| orcus | Backdoor | 66 | Orcus RAT (cataloged across security vendors and threat intelligence databases as Backdoor:Win32/Orcus, MSIL/Orcus, and Orcus RAT) is a notorious, modular .NET ... |
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
| lokibot | Infostealer | 55 | LokiBot (also designated as Loki PWS) is a widely proliferated commodity information stealer and keylogger first observed in 2015. Authored by an underground de... |
| kelihos | Spam Bot | 47 | Worm:Win32/Kelihos (also known as Hlux) was a massive, highly resilient peer-to-peer (P2P) botnet that operated from 2010 until its final federal dismantling in... |
| shiotob | Banking Trojan | 47 | Shiotob (extensively documented in threat intelligence literature under the names URLZone and Bebloh, with AV detections including Trojan:Win32/Shiotob and Troj... |
| candiru | Spyware | 45 | Candiru (operating under corporate entities Saito Tech Ltd, Taveta Ltd, and Grindavik Solutions) is an Israeli commercial cyber-surveillance contractor speciali... |
| pliskal | Trojan | 23 | Pliskal (tracked across enterprise antivirus research telemetry under designations including Trojan:Win32/Pliskal, Trojan:Win32/Pliskal.A, and TrojanDownloader:... |
| ytddownloader | Pua | 23 | YTD Downloader (commonly cataloged across endpoint security vendors under signatures including PUA:Win32/YTDDownloader, SoftwareBundler:Win32/YTDVideoDownloader... |
| aenjaris | Trojan | 22 | Aenjaris (classified in antimalware research telemetry under designations including Trojan:Win32/Aenjaris, Trojan:Win32/Aenjaris.A, and Win32/Aenjaris) is a ste... |
| backboot | Trojan | 22 | Backboot (classified across antivirus vendors under signatures including Trojan:Win32/Backboot, Trojan:Win32/Backboot.A, and VirTool:Win32/Backboot) is a persis... |
| downloadshield | Pua | 22 | DownloadShield (cataloged under antimalware detections including PUA:Win32/DownloadShield, SoftwareBundler:Win32/DownloadShield, and Adware.DownloadShield) is a... |
| guagua | Trojan | 22 | Guagua (classified in antimalware telemetry under signatures including Trojan:Win32/Guagua, Trojan:Win32/Guagua.A, and Backdoor:Win32/Guagua) is a modular Windo... |
| inbox | Adware | 22 | Inbox (widely cataloged across security solutions under designations including BrowserModifier:Win32/Inbox, Adware:Win32/Inbox, and PUA:Win32/InboxAce) is a per... |
| kuluoz | Trojan | 22 | Kuluoz (identified across antimalware research as Trojan:Win32/Kuluoz, TrojanDownloader:Win32/Kuluoz, and closely associated with the historic Asprox botnet inf... |
| miniduke | Trojan | 22 | MiniDuke (classified across threat intelligence repositories under designations including Backdoor:Win32/MiniDuke, Trojan:Win32/MiniDuke, and Win32/MiniDuke) is... |
| pbot | Trojan | 22 | Pbot (tracked under signatures Backdoor:Win32/Pbot, Trojan:Win32/Pbot, and Win32/Pbot) is a modular Windows remote access backdoor and network proxy agent. Infi... |
| tspy | Trojan | 22 | TSpy (classified in antimalware research telemetry under designations including Spyware:Win32/TSpy, TrojanSpy:Win32/TSpy, and Trojan-Spy.Win32.TSpy) is a stealt... |
| asktoolbar | Adware | 21 | Ask Toolbar (historically tracked under detections including BrowserModifier:Win32/AskToolbar, Adware:Win32/AskToolbar, and PUA:Win32/AskPartnerNetwork) is a no... |
| garrun | Trojan | 21 | Garrun (identified in security research telemetry as Trojan:Win32/Garrun, Trojan:Win32/Garrun.A, and Backdoor:Win32/Garrun) is an evasive Windows trojan backdoo... |
| neobar | Adware | 21 | Neobar (identified across endpoint security vendors as BrowserModifier:Win32/Neobar, Adware:Win32/Neobar, and PUA:Win32/Neobar) is an aggressive browser modifie... |
| sixxpack | Trojan | 21 | Sixxpack (classified across endpoint detection telemetry under designations including Trojan:Win32/Sixxpack, Trojan:Win32/Sixxpack.A, and VirTool:Win32/Sixxpack... |
| smokeloader | Loader | 21 | SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an undergr... |
| dexel | Trojan | 20 | Dexel (identified across antivirus research telemetry as Trojan:Win32/Dexel, TrojanDownloader:Win32/Dexel, and Backdoor:Win32/Dexel) is an evasive Windows troja... |
| toggle | Adware | 20 | Toggle (identified across endpoint security vendors as BrowserModifier:Win32/Toggle, Adware:Win32/Toggle, and PUA:Win32/Toggle) is a deceptive adware toolbar an... |
| dorifel | Trojan | 19 | Dorifel (also known as Quervar and classified across antivirus vendors under signatures including Trojan:Win32/Dorifel, Virus:Win32/Dorifel.A, and Worm:Win32/Do... |
| cryptinject | Ransomware | 15 | Cryptinject (classified in antimalware definitions under designations including Ransom:Win32/Cryptinject, Trojan:Win32/Cryptinject, and VirTool:Win32/Cryptinjec... |
| babar | Advanced Threat | 14 | Trojan:Win32/Babar is a highly sophisticated, nation-state cyber-espionage implant attributed by international intelligence agencies and cybersecurity researche... |
| chopper | Backdoor | 14 | Chopper (widely tracked across cybersecurity research, CISA advisories, and EDR platforms as China Chopper, Backdoor:Win32/Chopper, and Trojan:ASP/Chopper) is a... |
| chthonic | Banking Trojan | 14 | Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res... |
| sinowal | Banking Trojan | 13 | Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware ... |
| turkojan | Rat | 13 | Backdoor:Win32/Turkojan is a landmark Turkish-origin commercial Remote Access Trojan (RAT) created in the mid-2000s that gained international notoriety for its ... |
| cybernetic | Botnet | 11 | CyberNetic is a botnet agent and Remote Access Trojan (RAT) that communicates primarily via Internet Relay Chat (IRC) networks to receive instructions from its ... |
| koutodoor | Backdoor | 11 | Backdoor:Win32/Koutodoor is a persistent, stealthy backdoor designed to breach endpoint defenses, establish a long-term foothold, and allow remote threat actors... |
| locky | Ransomware | 11 | Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ... |
| vitro | Trojan | 11 | Virus:Win32/Vitro (frequently associated with the **Virut** malware family) is a highly aggressive, classic polymorphic file infector. Unlike modern trojans tha... |
| cryptolocker | Ransomware | 10 | CryptoLocker is the historic archetype of modern asymmetric ransomware, first discovered in September 2013. Engineered and operated under the criminal syndicate... |
| korplug | Trojan | 10 | Backdoor:Win32/Korplug (widely known in the cybersecurity community as **PlugX**) is a highly customized, persistent Remote Access Trojan (RAT) used extensively... |
| mirc | Trojan | 10 | HackTool:Win32/mIRC (or **mIRC Abuse**) refers to the malicious exploitation of the legitimate, highly popular Internet Relay Chat (IRC) client, mIRC. While the... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| spybot | Advanced Threat | 10 | Worm:Win32/Spybot (not to be confused with the legitimate 'Spybot Search & Destroy' utility) is an extremely famous, historic IRC-based worm and botnet agent th... |
| aspxor | Trojan | 9 | Aspxor (classified in antivirus detection telemetry under designations including Trojan:Win32/Aspxor, Trojan.Win32.Aspxor, and Win32/Aspxor) is a multi-stage tr... |
| enfal | Trojan | 9 | Backdoor:Win32/Enfal (also tracked as **Linfo**) is a highly targeted, persistent Remote Access Trojan (RAT) that has been used extensively by sophisticated Chi... |
| remotemanipulator | Ransomware | 9 | HackTool:Win32/Remotemanipulator (commonly known as **RMS** or **Remote Manipulator System**) is a legitimate, commercial Remote Administration Tool (RAT) simil... |
| yoddos | Trojan | 9 | Trojan:Win32/Yoddos (also known as the **Yoddos Botnet**) is a significant malware family specifically engineered to compromise endpoints and recruit them into ... |
| pandex | Ransomware | 8 | Trojan:Win32/Pandex (often an alias or component of the massive **Cutwail** botnet) is a highly prevalent, persistent trojan whose primary objective is to infec... |
| plugx | Rat | 8 | PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in ... |
| virtu | Trojan | 8 | Virus:Win32/Virtu (often associated with the **Virut** family) is a highly destructive, polymorphic file infector and botnet agent. Unlike modern trojans that s... |
| winvnc | Backdoor | 8 | HackTool:Win32/Winvnc (or generic **VNC Abuse** heuristics) represents the unauthorized deployment and abuse of legitimate Virtual Network Computing (VNC) softw... |
| agobot | Backdoor | 7 | Agobot (classified in antivirus detection telemetry under designations including Backdoor:Win32/Agobot, Backdoor.Win32.Agobot, and Win32/Agobot) is a interactiv... |
| cybergate | Rat | 7 | Trojan:Win32/CyberGate is a classic, widely abused Delphi-based commercial Remote Access Trojan (RAT) that circulated extensively in the underground cybercrime ... |
| magala | Trojan | 7 | Trojan:Win32/Magala (also known as a **Clicker Trojan**) is a form of malware specifically designed to generate illicit revenue for its operators through automa... |
| miuref | Click Fraud | 7 | Trojan:Win32/Miuref (also known in the cybersecurity community as **Boaxxe**) is a massive, highly resilient botnet primarily focused on generating illicit reve... |
| adwind | Trojan | 6 | Adwind (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwind, Trojan.Win32.Adwind, and Win32/Adwind) is a multi-stage tr... |
| imminent | Trojan | 6 | Backdoor:Win32/Imminent (specifically, the **Imminent Monitor RAT**) was a highly sophisticated, commercially available Remote Access Trojan. Before its infrast... |
| netcat | Advanced Threat | 6 | HackTool:Win32/Netcat (often abbreviated as `nc` or `ncat`) is a classic example of a **'Dual-Use' or 'Living off the Land' (LotL)** utility. Netcat is a comman... |
| cardinal | Ransomware | 5 | Cardinal (classified in antivirus detection telemetry under designations including Ransom:Win32/Cardinal, Ransom.Win32.Cardinal, and Win32/Cardinal) is a crypto... |
| mosucker | Trojan | 5 | Backdoor:Win32/Mosucker is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive acce... |
| qadars | Trojan | 5 | Trojan:Win32/Qadars is a highly sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fr... |
| sasfis | Trojan | 5 | TrojanDownloader:Win32/Sasfis is a prevalent, highly active botnet component and downloader trojan. It is primarily utilized by cybercriminal syndicates as a 'f... |
| snare | Trojan | 5 | Backdoor:Win32/Snare is a stealthy remote access trojan (RAT) or backdoor designed to provide threat actors with persistent, undetected, and interactive access ... |
| tinukebot | Trojan | 5 | Trojan:Win32/Tinukebot (widely known as **TinyNuke** or Nuclear Bot) is a sophisticated, commercially sold banking trojan and botnet framework. Its primary obje... |
| arcdoor | Backdoor | 4 | Arcdoor (classified in antivirus detection telemetry under designations including Backdoor:Win32/Arcdoor, Backdoor.Win32.Arcdoor, and Win32/Arcdoor) is a intera... |
| cpuminer | Ransomware | 4 | Trojan:Win32/Cpuminer (often a generalized classification for multiple variants) represents a massive shift in cybercrime monetization: **Cryptojacking**. Inste... |
| gh0st | Rat | 4 | Gh0st RAT (also tracked as Ghost RAT, Backdoor.Gh0st, and Win32/Gh0st) is one of the most historically significant, modular, and widely weaponized Remote Access... |
| hvnc | Trojan | 4 | Backdoor:Win32/hVNC (Hidden Virtual Network Computing) represents a devastatingly stealthy class of Remote Access Trojans (RATs). While standard VNC is a legiti... |
| nukesped | Trojan | 4 | Backdoor:Win32/Nukesped is a highly sophisticated, persistent backdoor remote access trojan (RAT) heavily attributed to the **Lazarus Group (HIDDEN COBRA)**, a ... |
| proxyweb | Trojan | 4 | Trojan:Win32/Proxyweb is a type of malware that silently converts an infected endpoint into a proxy server or relay node for a larger botnet. Instead of stealin... |
| autohit | Trojan | 3 | Autohit (classified in antivirus detection telemetry under designations including Trojan:Win32/Autohit, Trojan.Win32.Autohit, and Win32/Autohit) is a multi-stag... |
| clickshell | Advanced Threat | 3 | Adware:Win32/Clickshell is a type of malware designed specifically for **Click Fraud**. Unlike standard adware that simply displays annoying pop-ups to the user... |
| gate | Ransomware | 3 | Trojan:Win32/Gate is a persistent, stealthy backdoor trojan designed to silently breach endpoint defenses, establish long-term persistence, and open a covert co... |
| kwampirs | Trojan | 3 | Backdoor:Win32/Kwampirs is a sophisticated, highly targeted remote access trojan (RAT) primarily associated with the Advanced Persistent Threat (APT) group know... |
| multiminer | Ransomware | 3 | CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Mu... |
| havex | Trojan | 2 | Trojan:Win32/Havex is a highly specialized, sophisticated Remote Access Trojan (RAT) famously utilized by the 'Dragonfly' (or Energetic Bear) Advanced Persisten... |
| ircbrute | Trojan | 2 | Trojan:Win32/Ircbrute is a classification for a botnet agent or worm that combines the command-and-control (C2) infrastructure of an Internet Relay Chat (IRC) b... |
| ircfast | Trojan | 2 | Worm/Trojan:Win32/Ircfast is a network worm and botnet agent that leverages the Internet Relay Chat (IRC) protocol for command and control. Prevalent during the... |
| manuscrypt | Trojan | 2 | Trojan:Win32/Manuscrypt (also known as Volgmer or FALLCHILL) is an extremely sophisticated malware family strongly associated with the North Korean state-sponso... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| rustock | Advanced Threat | 2 | Rootkit:Win32/Rustock (internally designated as Costrat) was an extraordinarily sophisticated, stealthy kernel-mode rootkit and spam botnet active between 2006 ... |
| winnti | Backdoor | 2 | Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracke... |
| wootbot | Advanced Threat | 2 | Worm:Win32/Wootbot (also known as W32.Wootbot) is a classic, historically significant network worm and IRC botnet agent that was highly prevalent in the mid-200... |
| alyak | Trojan | 1 | Alyak (classified in antivirus detection telemetry under designations including Trojan:Win32/Alyak, Trojan.Win32.Alyak, and Win32/Alyak) is a multi-stage trojan... |
| blackenergy | Advanced Threat | 1 | BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an unde... |
| cardtool | Trojan | 1 | Cardtool (classified in antivirus detection telemetry under designations including Trojan:Win32/Cardtool, Trojan.Win32.Cardtool, and Win32/Cardtool) is a multi-... |
| ciadoor | Trojan | 1 | <h3>Executive Summary</h3> CiaDoor is a stealthy Remote Access Trojan (RAT) and backdoor designed to provide threat actors with persistent, unauthorized adminis... |
| client | Trojan | 1 | <h3>Executive Summary</h3> In the context of malware taxonomy, "Client" is a generic classification denoting the client-side executable of a Remote Access Troja... |
| clipspy | Advanced Threat | 1 | <h3>Executive Summary</h3> ClipSpy is a utility designed to monitor, inspect, and log the contents of the Windows system clipboard. While it can be utilized leg... |
| darkhotel | Backdoor | 1 | Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly reveale... |
| doublefantasy | Backdoor | 1 | <h3>Executive Summary</h3> DoubleFantasy is a highly sophisticated, stealthy Backdoor and loader component widely attributed to the <strong>Equation Group</stro... |
| eicardemo | Advanced Threat | 1 | <h3>Executive Summary</h3> EICAR Demo (or the EICAR Standard Anti-Virus Test File) is **NOT MALWARE**. It is a safe, standardized, and internationally recognize... |
| eskimo | Ransomware | 1 | Backdoor:Win32/Eskimo is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True ... |
| exchanger | Ransomware | 1 | <h3>Executive Summary</h3> Exchanger is a broad classification often applied to malware, typically trojans or potentially unwanted applications (PUAs), that fac... |
| familykeylogger | Advanced Threat | 1 | <h3>Executive Summary</h3> FamilyKeylogger is a commercial surveillance application, often marketed to parents for monitoring children, but widely classified by... |
| gemius | Advanced Threat | 1 | <h3>Executive Summary</h3> Gemius is a prominent web analytics and audience measurement technology. While technically a legitimate commercial service used by we... |
| ghost | Rat | 1 | Gh0st RAT (also tracked in security taxonomies as GhostRAT or Backdoor.Gh0st) is a seminal open-source Remote Access Trojan originally authored in 2008 by the C... |
| httpbot | Ransomware | 1 | Backdoor:Win32/Httpbot (or HTTP Bot) is a broad classification for botnet agents and Remote Access Trojans (RATs) that specifically utilize standard web protoco... |
| hyperbro | Trojan | 1 | <h3>Executive Summary</h3> HyperBro is a custom, in-memory Remote Access Trojan (RAT) and backdoor exclusively utilized by the Chinese state-sponsored threat gr... |
| infinitetear | Trojan | 1 | <h3>Executive Summary</h3> InfiniteTear is a highly sophisticated, stealthy Backdoor and Remote Access Trojan (RAT) historically associated with Advanced Persis... |
| karagany | Trojan | 1 | <h3>Executive Summary</h3> Karagany is a sophisticated Backdoor Trojan historically associated with the state-sponsored Advanced Persistent Threat (APT) group k... |
| konni | Trojan | 1 | <h3>Executive Summary</h3> Konni is a sophisticated Remote Access Trojan (RAT) and the namesake of the Advanced Persistent Threat (APT) group that wields it. Th... |
| miragefox | Trojan | 1 | <h3>Executive Summary</h3> MirageFox is a highly specialized, sophisticated Remote Access Trojan (RAT) and backdoor utilized exclusively by the Chinese state-sp... |
| mirai | Botnet | 1 | Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence... |
| molebox | Advanced Threat | 1 | <h3>Executive Summary</h3> Molebox is a dual-use technology. Originally developed as a legitimate commercial software virtualization and packing utility (design... |
| moonpie | Trojan | 1 | <h3>Executive Summary</h3> Moonpie (sometimes associated with advanced persistent threat toolsets) is a sophisticated Backdoor and remote access trojan (RAT) de... |
| msilbot | Ransomware | 1 | <h3>Executive Summary</h3> MSILBot (often detected as MSIL.Trojan or MSIL.Bot) refers to a broad category of botnet malware and remote access trojans (RATs) tha... |
| orcusrat | Ransomware | 1 | <h3>Executive Summary</h3> Orcus RAT is a highly sophisticated, commercially available Remote Access Trojan (RAT). It is controversially marketed and sold on su... |
| proxygate | Advanced Threat | 1 | <h3>Executive Summary</h3> ProxyGate is an application typically classified as Riskware or a Potentially Unwanted Program (PUP) by enterprise security environme... |
| psshell | Ransomware | 1 | <h3>Executive Summary</h3> PSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish... |
| pswdump | Advanced Threat | 1 | <h3>Executive Summary</h3> PSWDump is a malicious HackTool and credential dumper specifically designed to extract Windows NT LAN Manager (NTLM) password hashes ... |
| qqfarmassist | Advanced Threat | 1 | <h3>Executive Summary</h3> QQFarmAssist is classified as a Potentially Unwanted Program (PUP) and a riskware tool. Originally designed as an automated assistant... |
| remexi | Trojan | 1 | <h3>Executive Summary</h3> Remexi is a sophisticated Backdoor Trojan historically attributed to the Iranian-linked Advanced Persistent Threat (APT) group known ... |
| remotehack | Trojan | 1 | <h3>Executive Summary</h3> RemoteHack is a broad classification for a suite of Remote Access Trojans (RATs) and remote administration HackTools. These tools are... |
| roboinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> RoboInstall is an aggressive software bundler and Potentially Unwanted Program (PUP) installer. It is designed to maximize affiliate ... |
| sathurbot | Trojan | 1 | Trojan:Win32/Sathurbot is a sophisticated botnet agent known for its unique propagation and Command and Control (C2) methods. Unlike bots that rely solely on em... |
| scramupx | Advanced Threat | 1 | <h3>Executive Summary</h3> ScramUPX is a highly specialized malware packing and obfuscation utility. It is designed to take an executable file that has already ... |
| shark | Ransomware | 1 | <h3>Executive Summary</h3> Shark is a versatile and widely distributed Remote Access Trojan (RAT) family. Originating from underground hacker forums, it is desi... |
| shutdowner | Backdoor | 1 | <h3>Executive Summary</h3> Shutdowner refers to a class of malicious scripts, utilities, or "HackTools" explicitly designed to force a computer to shut down, re... |
| silentinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> "SilentInstall" (often flagged generically as Adware.SilentInstall or PUP.Installer) refers to a class of Potentially Unwanted Progra... |
| smallhttp | Advanced Threat | 1 | HackTool:Win32/Smallhttp refers to highly compact, portable web server executables that are frequently dropped onto compromised machines by attackers during pos... |
| spook | Ransomware | 1 | Backdoor:Win32/Spook is a persistent Remote Access Trojan (RAT) designed to provide attackers with covert, interactive control over a compromised system. True t... |
| storm | Botnet | 1 | Worm:Win32/Storm (universally documented in cybersecurity literature as the Storm Worm, Peed, and Nuwar) was a revolutionary peer-to-peer (P2P) botnet that infe... |
| teamviewer | Backdoor | 1 | <h3>Executive Summary</h3> TeamViewer is a fully legitimate, commercially available remote access and support application. However, in the context of cybersecur... |
| vidar | Infostealer | 1 | Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russ... |
| webdial | Advanced Threat | 1 | <h3>Executive Summary</h3> Webdial is a classic example of legacy malware classified as a "Dialer." Highly prevalent during the era of dial-up internet access, ... |
| webisida | Advanced Threat | 1 | <h3>Executive Summary</h3> Webisida is an automated web surfing and traffic exchange application widely classified by enterprise security vendors as Riskware, a... |
| wellmess | Ransomware | 1 | <h3>Executive Summary</h3> WellMess is a highly sophisticated, cross-platform (Windows and Linux) malware family heavily utilized by the Russian state-sponsored... |
| winshell | Trojan | 1 | Backdoor:Win32/Winshell represents a category of Remote Access Trojans (RATs) and backdoors designed to provide an attacker with a persistent, interactive Windo... |
| zeusvm | Banking Trojan | 1 | Trojan-Banker:Win32/ZeusVM (also widely tracked in underground forums as KINS) is a highly sophisticated banking trojan variant derived from the leaked Zeus 2.0... |
| institution_2004 | Trojan | Sampled | Institution 2004 (cataloged across security software as Trojan:Win32/Institution2004, Backdoor.Win32.Institution, and Trojan.Institution) is an early 2000s Delp... |
| jbonblanc | Trojan | Sampled | JBonBlanc (cataloged across security software as Trojan:Win32/JBonBlanc, Backdoor.Win32.JBonBlanc, and Trojan.JBonBlanc) is a legacy French-authored Delphi remo... |
| lost_door | Rat | Sampled | Lost Door (cataloged across security software as Backdoor.LostDoor, Trojan.Win32.LostDoor, and Backdoor:Win32/LostDoor) is a classic Delphi-authored Remote Acce... |
| messiah | Trojan | Sampled | Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access troj... |
| netsphere | Trojan | Sampled | NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote admin... |
| nuclear_rat | Rat | Sampled | Nuclear RAT (cataloged across security software as NuclearRAT, Nuclear RAT 2.1, Backdoor.NuclearRat, and Trojan.NuclearRAT) is a classic open-source Remote Acce... |
| prjraptor | Trojan | Sampled | PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retr... |
| schoolbus | Trojan | Sampled | Schoolbus (cataloged across security software as Backdoor:Win32/Schoolbus, Trojan.Win32.Schoolbus, and Backdoor.Schoolbus) is a classic early 2000s Remote Acces... |
| serenity_rat | Rat | Sampled | Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in B... |
| sinique | Trojan | Sampled | Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access troja... |
| stream_rat | Trojan | Sampled | Stream-RAT (also styled across security documentation as StreamRAT, Backdoor.StreamRAT, and Trojan.StreamRAT) is an early-to-mid 2000s Remote Access Trojan engi... |
| subseven | Trojan | Sampled | SubSeven (also widely known as Sub7, Backdoor.SubSeven, and Sub7 Gold) is one of the most culturally iconic and technologically influential Remote Access Trojan... |
| synrat | Trojan | Sampled | SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Ac... |
| trojna | Trojan | Sampled | Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual... |
| ulysses | Trojan | Sampled | Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in ... |
| vampire | Trojan | Sampled | Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 20... |
| y3k_rat | Trojan | Sampled | Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visu... |
| z_dem0n | Trojan | Sampled | Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using t... |
| zombierat | Trojan | Sampled | ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access... |