T1562.001: Impair Defenses: Disable or Modify Tools
Operational Executive Summary
T1562.001 (Impair Defenses: Disable or Modify Tools) is classified under the Defense Evasion tactic within the MITRE ATT&CK framework. Tradecraft designed to avoid detection, analysis, and eradication throughout their operational lifecycle, including process injection, file obfuscation, and disabling defensive telemetry. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 449 distinct malware families, totaling over 124,420 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Impair Defenses: Disable or Modify Tools to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Impair Defenses: Disable or Modify Tools, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1562.001 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Impair Defenses: Disable or Modify Tools to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1562/001/.
Detection Engineering & Threat Hunting
Detecting Impair Defenses: Disable or Modify Tools requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1562.001 (Impair Defenses: Disable or Modify Tools) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Impair Defenses: Disable or Modify Tools across adjacent network segments.
Cataloged Malware Families Utilizing T1562.001 (449 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1562.001 (Impair Defenses: Disable or Modify Tools):
449 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| ramnit | Worm Banker | 20,595 | Ramnit (also known as Nimnul or Cosmu) is a devastating, multi-faceted banking trojan and worm that first emerged in 2010. Originally conceived as a Windows fil... |
| sality | File Infector | 18,572 | Sality is one of the most durable, resilient, and historically significant polymorphic file infectors and botnets in cybersecurity history. First identified aro... |
| installmonster | Pua | 16,691 | InstallMonster (documented across enterprise threat intelligence as Adware.InstallMonster, PUA:Win32/InstallMonster, and Trojan.InstallMonster) is an aggressive... |
| vtflooder | Pua Tool | 12,150 | VtFlooder (tracked across enterprise threat intelligence as Trojan:Win32/VtFlooder, Tool:Win32/VtFlooder, and Spammer:Win32/VtFlooder) is an automated cloud sub... |
| startsurf | Browser Hijacker | 6,358 | StartSurf (classified by cybersecurity vendors as BrowserModifier:Win32/StartSurf, Adware:Win32/StartSurf, and PUP.Optional.StartSurf) is a pervasive browser hi... |
| dlguide | Pua | 4,733 | DownloadGuide (detected across commercial threat intelligence as PUA:Win32/DownloadGuide, Adware:Win32/DownloadGuide, and Win32/DownloadGuide.Bundler) is a dece... |
| flystudio | Packer | 4,527 | FlyStudio (identified across enterprise antivirus detection signatures as Packer:Win32/FlyStudio, Trojan:Win32/FlyStudio, and Trojan.MalPack.FlyStudio) is a wid... |
| razy | Infostealer | 3,391 | Razy (cataloged across cybersecurity research as Trojan:Win32/Razy, Trojan.Win32.Razy, and Trojan.Razy.gen) is a sophisticated Windows trojan and information st... |
| filetour | Pua | 3,238 | FileTour (cataloged across threat telemetry as Trojan:Win32/Filetour, Adware.FileTour, and PUA:Win32/Filetour) is a dual-function software bundler and stealth c... |
| autoit | Packer | 1,895 | AutoIt (classified across commercial antivirus vendors as Trojan:Win32/AutoIt, Packer:Win32/AutoIt, and Backdoor.AutoIt) is a widely abused legitimate freeware ... |
| tiggre | Cryptominer | 1,728 | Trojan:Win32/Tiggre!rfn (widely recognized across Microsoft Defender and endpoint telemetry as CoinMiner.Tiggre, Trojan.Tiggre, or Win32/Tiggre) is a prolific, ... |
| qhost | Trojan | 1,722 | Trojan:Win32/Qhost (cataloged widely across security telemetry as TROJ_QHOST, DNSChanger.Qhost, or Win32/Qhost) is a classic and persistent DNS-tampering trojan... |
| dotdo | Adware | 1,678 | Dotdo (tracked across enterprise antivirus vendors as Adware:Win32/Dotdo, Trojan:Win32/Dotdo, and Adware.DotDo) is a persistent adware engine and local network ... |
| gamehack | Pua Tool | 1,656 | GameHack (identified by enterprise antivirus detection engines as Tool:Win32/GameHack, Riskware:Win32/GameHack, and PUA.Win32.GameHack) is a broad classificatio... |
| flux | Backdoor | 1,500 | Flux (cataloged across antivirus solutions as Backdoor:Win32/Flux and Trojan.Win32.Flux) is a classic Delphi-authored remote access backdoor trojan first surfac... |
| hue | Trojan | 1,500 | Hue (cataloged across security engines as Trojan:Win32/Hue, Backdoor:Win32/Hue, and Trojan.Win32.Hue) is a legacy Delphi-authored remote access backdoor trojan ... |
| unruy | Click Fraud | 1,267 | Unruy (identified across threat telemetry as Trojan:Win32/Unruy, Trojan-Clicker.Win32.Unruy, and Adware:Win32/Unruy) is an evasive background click-fraud trojan... |
| istartsurf | Browser Hijacker | 1,214 | iStartSurf (cataloged across enterprise telemetry as BrowserModifier:Win32/IStartSurf, Adware:Win32/IStartSurf, and PUP.Optional.iStartSurf) is an aggressive br... |
| icloader | Pua | 1,145 | ICLoader (identified across vendor detection engines as PUA:Win32/ICLoader, Trojan:Win32/ICLoader, and PUP.Optional.InstallCore) is an aggressive software bundl... |
| spigot | Adware | 1,008 | Spigot (documented by Microsoft Defender, Malwarebytes, and Sophos as BrowserModifier:Win32/Spigot, Adware:Win32/Spigot, and PUP.Optional.Spigot) is a widely di... |
| dinwod | File Infector | 973 | Dinwod (classified by Microsoft Defender and Trend Micro as Trojan:Win32/Dinwod, TrojanDropper:Win32/Dinwod, and Trojan.Win32.DINWOD.B) is an evasive trojan dro... |
| noon | Adware | 926 | Noon (documented across security intelligence solutions as Adware:Win32/Noon and BrowserModifier:Win32/Noon) is an aggressive adware and browser modifier platfo... |
| shipup | Adware | 896 | ShipUp (tracked across threat intelligence feeds as Adware:Win32/ShipUp, Trojan.Win32.ShipUp, and Win32/Shipup) is a deceptive adware engine and background payl... |
| speedingupmypc | Pup | 740 | SpeedingUpMyPC (cataloged by Microsoft Defender as PUA:Win32/SpeedingUpMyPC and tracked by Malwarebytes as PUP.Optional.SpeedingUpMyPC) is a deceptive system op... |
| soft32dl | Pua | 715 | Soft32 Downloader (classified across threat intelligence feeds as PUA:Win32/Soft32Downloader, Adware:Win32/Soft32, and PUP.Optional.Soft32) is a deceptive softw... |
| nitol | Ddos Bot | 694 | Nitol (cataloged across global cybersecurity threat intelligence as DDoS:Win32/Nitol, Trojan:Win32/Nitol, and Backdoor.Win32.Nitol) is a notorious Distributed D... |
| appster | Adware | 637 | Appster (recognized across cybersecurity solutions as Adware:Win32/Appster, PUA:Win32/Appster, and Adware.Appster) is an aggressive software bundler, monetizati... |
| vbclone | Trojan | 601 | VBClone (identified across security telemetry as Trojan:Win32/VBClone!rfn, Trojan.VBClone, and Win32/VBClone) represents a widely distributed family of Visual B... |
| byfh | Trojan | 593 | Byfh (tracked as Trojan:Win32/Byfh!rfn, Trojan.Byfh, and Adware:Win32/Byfh) is a persistent Windows trojan downloader and monetization platform analyzed by Micr... |
| slimware | Rogueware | 566 | Slimware (documented by Microsoft Defender as PUA:Win32/Slimware and tracked by Malwarebytes as PUP.Optional.SlimwareUtilities) is a deceptive system maintenanc... |
| winactivator | Pua Tool | 409 | WinActivator (classified across cybersecurity solutions as HackTool:Win32/AutoKMS, HackTool:Win32/WinActivator, and PUA:Win32/KMSpico) is a widespread family of... |
| midie | Trojan | 341 | Midie (cataloged across security software as Trojan:Win32/Midie, Trojan.Win32.Midie, and Backdoor:Win32/Midie) is a modular Windows trojan and backdoor loader t... |
| zdengo | Adware | 333 | Zdengo (frequently classified by security solutions as Adware.Zdengo, Trojan:Win32/Zdengo, Zdengo.A, and PUA:Win32/Zdengo) is a persistent adware installer, cli... |
| black | Ransomware | 329 | Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive double-extortion enterpr... |
| shiz | Banking Trojan | 302 | Trojan-Banker:Win32/Shiz is a notorious, historically significant Russian banking trojan that served as a critical evolutionary link connecting early Zeus and G... |
| winwrapper | Pua Tool | 296 | WinWrapper (cataloged by major antimalware vendors as PUA:Win32/WinWrapper, Adware.Win32.WinWrapper, and Trojan.Win32.WinWrapper) is a commercial pay-per-instal... |
| banload | Downloader | 288 | Banload (cataloged across security software as TrojanDownloader:Win32/Banload, Trojan-Downloader.Win32.Banload, and Win32/Banload) is a notorious family of troj... |
| ludbaruma | Worm | 283 | Ludbaruma (identified across antivirus products as Worm:Win32/Ludbaruma.A, Worm:Win32/Ludbaruma!pz, and TrojanDropper:Win32/Ludbaruma) is an aggressive Windows ... |
| hosts | Trojan Generic | 267 | BrowserModifier:Win32/Hosts (or simply 'Hosts file hijacker') is a generic heuristic detection for malware or adware that maliciously modifies the Windows HOSTS... |
| tofsee | Spam Bot | 264 | Tofsee (also widely cataloged as Gheg, Backdoor.Win32.Tofsee, and Spambot.Tofsee) is an extraordinarily resilient and sophisticated multi-purpose modular trojan... |
| gamemodding | Pua | 244 | GameModding (cataloged in threat telemetry under signatures such as HackTool:Win32/GameModding!pz, PUA:Win32/GameModding, and Riskware.GameModding) designates a... |
| playtech | Pua | 216 | Playtech (tracked by antivirus vendors under classifications such as PUA:Win32/Playtech, Adware:Win32/Playtech, and PUA.Playtech) identifies a family of potenti... |
| jeefo | File Infector | 213 | Jeefo (also known as Hidrag, and cataloged in security vendor encyclopedias as Virus:Win32/Jeefo.A, PE_JEEFO.A, and Virus.Win32.Hidrag.a) is a classic parasitic... |
| extenbro | Trojan | 204 | Extenbro (cataloged across security solutions as Trojan:Win32/Extenbro, Trojan:JS/ExtenBro!MTB, TrojanDownloader:Win32/ExtenBro.A, and BrowserModifier:Win32/Ext... |
| cheatengine | Pua Tool | 175 | CheatEngine (cataloged across enterprise endpoint security solutions as HackTool:Win32/CheatEngine, PUA:Win32/CheatEngine, and Riskware.CheatEngine) is a widely... |
| viking | File Infector | 175 | Viking (cataloged across security vendors as Virus:Win32/Viking, Worm.Win32.Viking, and PE_VIKING) is an infamous and highly destructive hybrid file-infecting v... |
| safebytes | Rogueware | 169 | SafeBytes (cataloged across security vendors as Rogue:Win32/SafeBytes, PUP.Optional.SafeBytes, and Program:Win32/SafeBytes) is a deceptive rogue PC optimizer an... |
| beebone | Worm | 151 | Beebone (widely cataloged across security vendors as the W32.Worm.Beebone or AAEH family) is a highly aggressive, polymorphic downloader worm first identified i... |
| dlsponsor | Adware | 151 | DownloadSponsor (cataloged across security vendors under designations including PUADlManager:Win32/DownloadSponsor, Adware:Win32/DownloadSponsor, and Program:Wi... |
| indiloadz | Adware | 146 | Indiloadz (cataloged across security vendor detections as Adware:Win32/Indiloadz, PUA:Win32/Indiloadz, and Trojan:Win32/Indiloadz) is an invasive software downl... |
| bypassuac | Hacktool | 145 | BypassUAC (cataloged across security telemetry under detections including HackTool:Win32/BypassUAC, Behavior:Win32/BypassUAC, and Trojan:Win32/BypassUAC) repres... |
| game | Trojan | 144 | Trojan:Win32/GameThief (frequently cataloged in security telemetry as Trojan.Game, Win32/Game, or Trojan-PSW.Win32.Game) is a specialized class of password-stea... |
| killproc | Trojan | 141 | Trojan:Win32/Killproc (commonly documented across security vendor telemetry as Trojan.Win32.KillProc, Win32/Killproc, or Trojan.BAT.KILLPROC) is an aggressive d... |
| wajam | Adware | 131 | Wajam (cataloged across security vendor feeds as Adware:Win32/Wajam, Adware.Wajam, SearchProtect, and Wajam Internet Enhancer) is a notorious adware and browser... |
| archsms | Ransomware | 127 | ArchSMS (cataloged across security vendors under designations including Hoax.Win32.ArchSMS, Trojan-Ransom.Win32.ArchSMS, and Trojan:Win32/Archsms) is an infamou... |
| bitmin | Coinminer | 112 | Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of... |
| unwaders | Adware | 111 | Unwaders (identified by Microsoft Defender as Adware:Win32/Unwaders, PUA:Win32/Unwaders, and Misleading:Win32/Unwaders) is a deceptive adware monetization frame... |
| fuerboos | Trojan | 110 | Fuerboos (cataloged by Microsoft Defender as Trojan:Win32/Fuerboos, Trojan:Win32/Fuerboos!cl, Trojan:Win32/Fuerboos!MTB, and TrojanDownloader:Win32/Fuerboos, wi... |
| ngrbot | Worm | 110 | NGRBot (extensively documented as Dorkbot, Worm:Win32/Dorkbot, Worm.Win32.Ngrbot, and W32.IRCBot.NG) is an infamous, multi-functional Windows botnet and self-pr... |
| hpdefender | Rogue Antivirus | 109 | Hpdefender (cataloged across antivirus telemetry as Rogue:Win32/HpDefender, Trojan:Win32/HpDefender, and Rogue.HpDefender) is an aggressive rogue security progr... |
| explorerhijack | Trojan | 106 | ExplorerHijack (monitored under behavioral detection signatures including Behavior:Win32/ExplorerHijack, Trojan:Win32/ExplorerHijack, and HackTool:Win32/Explore... |
| fusioncore | Adware | 104 | Fusioncore (cataloged by Microsoft Defender as Adware:Win32/FusionCore, PUA:Win32/FusionCore, and SoftwareBundler:Win32/FusionCore) is a pervasive commercial so... |
| addrop | Adware | 103 | Addrop (cataloged across security vendors as Adware:Win32/Addrop, Adware.Addrop, and PUA:Win32/Addrop) is a persistent adware dropper and Potentially Unwanted A... |
| powp | Adware | 99 | Powp (identified across antimalware engines as Adware:Win32/Powp, Trojan:Win32/Powp, and PUA:Win32/Powp) is an aggressive adware monetization framework and soft... |
| sysn | Trojan | 99 | Sysn (cataloged across security intelligence as Trojan:Win32/Sysn, Trojan.Win32.Sysna, and Swisyn) is a resilient family of Delphi-based Windows trojans and pay... |
| wronginf | Rogue Antivirus | 99 | Wronginf (cataloged under Microsoft Defender and vendor signatures as Rogue:Win32/Wronginf, Trojan:Win32/Wronginf, and Win32:WrongInf) is an aggressive scarewar... |
| adaebook | Adware | 98 | AdaEbook (detected across security vendors as Adware:Win32/AdaEbook, PUA:Win32/AdaEbook, and Trojan:Win32/AdaEbook) is a deceptive software bundling framework a... |
| convertad | Adware | 96 | ConvertAd (classified by security vendors as Adware:Win32/ConvertAd, PUA:Win32/ConvertAd, and Win32/ConvertAd) is an aggressive adware program and browser monet... |
| hijacker | Adware | 92 | Hijacker (cataloged across security vendors as BrowserModifier:Win32/Hijacker, Adware:Win32/Hijacker, and Trojan:Win32/Hijacker) is a widespread family of persi... |
| yobrowser | Adware | 90 | YoBrowser (identified in security telemetry under detections including PUA:Win32/YoBrowser, Trojan:Win32/YoBrowser, and Adware:Win32/YoBrowser) is a deceptive w... |
| dorkbot | Botnet | 86 | Dorkbot (also tracked across intelligence communities as NgrBot and Worm:Win32/Dorkbot) is a notorious multi-vector worm and modular botnet family that infected... |
| chindo | Worm | 85 | Chindo (cataloged in security vendor threat telemetry under signatures including Worm:Win32/Chindo, Trojan:Win32/Chindo, and Worm:Win32/Chindo.SQ!MTB) is a hybr... |
| youxun | Adware | 84 | Youxun (cataloged by security vendors as Adware:Win32/Youxun, PUA:Win32/Youxun, and Win32/Youxun) is an aggressive software monetization platform and smart down... |
| taranis | Trojan | 83 | Taranis (cataloged by security software vendors under signatures including Trojan:Win32/Taranis, TR/Taranis, and Win32/Taranis) is a multi-stage Windows trojan ... |
| picsys | Trojan | 82 | PicSys (cataloged by security vendors under detections including Trojan:Win32/PicSys, Trojan.Win32.Picsys, and Worm.Win32.PICSYS) is a covert surveillance troja... |
| shodi | Backdoor | 76 | Shodi (cataloged across security vendors under detections including Backdoor:Win32/Shodi, Trojan:Win32/Shodi, and BackDoor.Shohdi) is a classic Windows remote a... |
| dovs | Trojan | 75 | Dovs (cataloged in antivirus vendor databases under detections including Trojan:Win32/Dovs, TrojanDownloader:Win32/Dovs, and Win32/Dovs) is a stealthy Windows t... |
| bloored | Trojan | 74 | Bloored (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bloored, Trojan.Bloored, and Trojan.Win32.Bloored) is a generic Windows... |
| vilsel | Trojan | 74 | Vilsel (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Vilsel, Trojan.Win32.Vilsel, and Trojan.Vilsel) is a... |
| browsefox | Adware | 73 | BrowseFox (cataloged across security vendors under detections including Adware:Win32/BrowseFox, PUA:Win32/Browsefox, and PUP.Optional.BrowseFox) is an aggressiv... |
| vundo | Trojan | 70 | Vundo (also universally known across the cybersecurity industry as Virtumonde, Trojan:Win32/Vundo, and Trojan.Vundo) is a historic, landmark Windows trojan and ... |
| appset | Pua | 69 | Appset (cataloged across security vendors under detections including PUA:Win32/Appset, Trojan:Win32/Appset, and Program:Win32/Appset) is a persistent adware ins... |
| jacard | Trojan | 69 | Jacard (cataloged in threat research and antivirus vendor databases under detections including Trojan:Win32/Jacard, Trojan.Jacard, and W32/Jacard) is a sophisti... |
| neurevt | Trojan | 68 | Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Troja... |
| cloudscout | Advanced Threat | 67 | CloudScout (cataloged by cybersecurity research labs under designations including Trojan:Win32/CloudScout and Backdoor.CloudScout) is a sophisticated, modular p... |
| mogoogwi | Worm | 66 | Mogoogwi (cataloged across antivirus vendors under signatures including Worm:Win32/Mogoogwi, Worm:Win32/Mogoogwi.A, and Trojan:MSIL/Mogoogwi.A) is an aggressive... |
| cuegoe | Advanced Threat | 64 | Cuegoe (cataloged in cybersecurity threat intelligence databases and Malpedia under designations including Trojan:Win32/Cuegoe and Backdoor.Win32.Cuegoe) is a t... |
| domaiq | Pua | 63 | Domaiq (cataloged across security vendors and threat intelligence databases under detections including PUA:Win32/Domaiq, Adware:Win32/Domaiq, and Program:Win32/... |
| stormattack | Trojan | 62 | StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttac... |
| carberp | Banking Trojan | 61 | Carberp is an elite, highly sophisticated banking trojan and modular cyber espionage framework first identified in 2010. Developed by a well-organized Russian-U... |
| downloadadmin | Pua | 61 | DownloadAdmin (cataloged across antivirus vendors under detections including PUA:Win32/DownloadAdmin and Program:Win32/DownloadAdmin) is a deceptive software do... |
| brontok | Worm | 57 | Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing com... |
| kuaiba | Adware | 53 | Kuaiba (cataloged across antivirus vendors under signatures including Adware:Win32/Kuaiba, PUA:Win32/Kuaiba, and Program:Win32/Kuaiba) is a deceptive game distr... |
| multiplug | Adware | 53 | MultiPlug (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/MultiPlug, PUA:Win32/MultiPlug, and Progr... |
| vawtrak | Banking Trojan | 50 | Vawtrak (widely cataloged across international law enforcement and intelligence communities as Neverquest or Snifula) is one of the most damaging banking trojan... |
| bunitu | Trojan | 49 | Bunitu (cataloged across security intelligence feeds under signatures including Trojan:Win32/Bunitu, Trojan.Win32.Bunitu, and Trojan.Bunitu) is a persistent pro... |
| hoax | Ransomware | 48 | Hoax (cataloged across security vendors and threat intelligence databases under detections including Trojan-Ransom.Win32.Hoax, Ransom:Win32/Hoax, and Scareware.... |
| zepfod | Trojan | 46 | Zepfod is a stealthy Windows trojan downloader and reconnaissance agent active since 2015. Distributed via malicious email attachments, cracked gaming packages,... |
| genericrxdw | Ransomware | 26 | Trojan:Win32/Genericrxdw is a broad heuristic classification applied to generic, malicious executables that exhibit recognizable Trojan-like behaviors, such as ... |
| crysis | Ransomware | 24 | Ransomware:Win32/Crysis (widely tracked in subsequent major evolutionary variants as Dharma) is a prolific, destructive Ransomware-as-a-Service (RaaS) that emer... |
| backboot | Trojan | 22 | Backboot (classified across antivirus vendors under signatures including Trojan:Win32/Backboot, Trojan:Win32/Backboot.A, and VirTool:Win32/Backboot) is a persis... |
| matrix | Ransomware | 22 | Matrix (cataloged under signatures Ransom:Win32/Matrix, Trojan-Ransom.Win32.Matrix, and Win32/Matrix) is a sophisticated targeted ransomware family active since... |
| krbanker | Trojan | 21 | KRBanker (cataloged across global antimalware intelligence under signatures including Trojan:Win32/KRBanker, Trojan:Win32/KRBanker.A, and TrojanSpy:Win32/KRBank... |
| smokeloader | Loader | 21 | SmokeLoader (also cataloged in threat telemetry as Dofoil or Sharapov) is a veteran modular malware loader and botnet first commercialized in 2011 by an undergr... |
| faketool | Trojan | 20 | FakeTool (cataloged under antimalware detections including Trojan:Win32/FakeTool, Rogue:Win32/FakeTool, and PUA:Win32/FakeTool) represents a pervasive family of... |
| gt32supportgeeks | Pua | 20 | GT32SupportGeeks (tracked in telemetry under signatures PUA:Win32/GT32SupportGeeks, Rogue:Win32/GT32SupportGeeks, and Program:Win32/GT32SupportGeeks) is a decep... |
| winlock | Ransomware | 20 | Winlock (historically documented across threat intelligence platforms under designations including Ransom:Win32/Winlock, Trojan-Ransom.Win32.Winlock, and Win32/... |
| ntrootkit | Rootkit | 17 | NTRootkit (classified across cybersecurity vendors as Rootkit:Win32/NTRootkit, Trojan:Win32/NTRootkit, and Rootkit.Win32.NTRoot) is an evasive stealth rootkit e... |
| perion | Adware | 17 | Perion (classified across cybersecurity vendors as BrowserModifier:Win32/Perion, Adware:Win32/Perion, and PUA:Win32/Perion) represents a widespread adware, tool... |
| searchpage | Browser Modifier | 17 | SearchPage (classified across endpoint security engines as BrowserModifier:Win32/SearchPage, Adware:Win32/SearchPage, and Trojan.BrowserModifier.SearchPage) is ... |
| winwebsec | Rogueware | 17 | Winwebsec (classified across cybersecurity vendors as Rogue:Win32/Winwebsec, Trojan.Winwebsec, and Scareware:Win32/Winwebsec) is one of the most infamous and lu... |
| bundlore | Adware | 16 | Bundlore (tracked across security vendors under designations including Adware:OSX/Bundlore, Adware:Win32/Bundlore, OSX.Bundlore, and Shlayer/Bundlore variant) i... |
| freekeylogger | Spyware | 16 | FreeKeylogger (classified across endpoint security platforms as Spyware:Win32/FreeKeylogger, MonitoringTool:Win32/FreeKeylogger, and PUA:Win32/FreeKeylogger) re... |
| webwatcher | Spyware | 16 | WebWatcher (classified across antimalware engines as Spyware:Win32/WebWatcher, MonitoringTool:Win32/WebWatcher, and PUA:Win32/WebWatcher) is a stealth surveilla... |
| gotango | Browser Modifier | 15 | GoTango (classified as BrowserModifier:Win32/GoTango and Adware:Win32/GoTango across Microsoft Defender, Malwarebytes, and Trend Micro) is an aggressive browser... |
| nssm | Hacktool | 15 | NSSM (Non-Sucking Service Manager, classified across antimalware engines as HackTool:Win32/NSSM, Tool:Win32/NSSM, and PUA:Win32/NSSM) is a legitimate service wr... |
| wsgame | Infostealer | 15 | WSGame (classified as Trojan:Win32/WSGame and Trojan-GameThief.Win32.WSGame across Microsoft Defender, Kaspersky, and Trend Micro) is a dedicated gaming credent... |
| zlob | Trojan | 15 | Zlob (historically one of the most prolific malware families in cybersecurity history, classified across antivirus engines as Trojan:Win32/Zlob, Trojan.Zlob, an... |
| dnscleaner | Pua | 14 | DNSCleaner (classified across security vendors as PUA:Win32/DNSCleaner and Rogue:Win32/DNSCleaner) is a scareware system optimizer and Potentially Unwanted Appl... |
| microfake | Scareware | 14 | MicroFake (classified across antimalware engines under designations including Rogue:Win32/MicroFake and Trojan:Win32/MicroFake) is a rogue antivirus and scarewa... |
| winloadsda | Trojan Downloader | 14 | WinloadSDA (classified across security vendors as TrojanDownloader:Win32/WinloadSDA and Trojan:Win32/WinloadSDA) is an evasive trojan downloader and stager that... |
| woozlist | Browser Modifier | 14 | WoozList (classified as BrowserModifier:Win32/WoozList and Adware:Win32/WoozList across Microsoft Defender, Malwarebytes, and Trend Micro) is a persistent adwar... |
| aauto | Trojan | 13 | AAuto (classified across antimalware research as Trojan:Win32/AAuto and TrojanDownloader:Win32/AAuto) is an automation-scripting loader trojan compiled using th... |
| appscience | Adware | 13 | AppScience (classified across security vendors as Adware:Win32/AppScience and PUA:Win32/AppScience) is an intrusive adware and telemetry collection software fra... |
| pirminay | Infostealer | 13 | Pirminay (classified across security vendors as Trojan:Win32/Pirminay and PWS:Win32/Pirminay) is an information-stealing trojan designed to covertly harvest sys... |
| reptile | Rootkit | 13 | Reptile (widely tracked across threat intelligence feeds as Rootkit.Reptile and Backdoor.Reptile) is a powerful, open-source stealth kernel-mode rootkit and bac... |
| retefe | Trojan | 13 | Retefe (historically documented as Trojan:Win32/Retefe and Trojan-Banker.Win32.Retefe) is a sophisticated banking trojan that actively targeted banking institut... |
| widgi | Advanced Threat | 13 | Adware:Win32/Widgi (often associated with the Widgi Toolbar) is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates en... |
| addlyrics | Trojan | 12 | Addlyrics (classified in antivirus detection telemetry under designations including Trojan:Win32/Addlyrics, Trojan.Win32.Addlyrics, and Win32/Addlyrics) is a mu... |
| cia | File Infector | 12 | The CIA virus is a classic DOS-based file infector that primarily targets .COM and .EXE executables. Emerging in the early era of PC viruses, it employs memory-... |
| eyooun | Advanced Threat | 12 | Adware:Win32/Eyooun is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware,... |
| mapsgory | Advanced Threat | 12 | Adware:Win32/Mapsgory is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freewar... |
| ubar | Advanced Threat | 12 | Adware:Win32/Ubar is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware (e... |
| vimditator | Advanced Threat | 12 | Adware:Win32/Vimditator is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freew... |
| bandoo | Trojan | 11 | Bandoo (classified in antivirus detection telemetry under designations including Trojan:Win32/Bandoo, Trojan.Win32.Bandoo, and Win32/Bandoo) is a multi-stage tr... |
| conficker | Worm | 11 | Conficker (also known as Downadup or Kido) is one of the most prolific, destructive, and technologically advanced computer worms in internet history, first disc... |
| dnschanger | Trojan | 11 | DNSChanger is one of the largest and most commercially damaging malware operations in internet history, first detected in 2007. Operated by Estonian cybercrimin... |
| gamevance | Trojan | 11 | Adware:Win32/Gamevance is a historic, highly aggressive adware framework and Potentially Unwanted Program (PUA) that peaked in the late 2000s and early 2010s. I... |
| menti | Advanced Threat | 11 | Adware:Win32/Menti is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freeware, ... |
| pornoblocker | Ransomware | 11 | Ransomware:Win32/Pornoblocker (often categorized generically as a **Winlocker** or Screenlocker) represents a classic, historical evolutionary step in ransomwar... |
| sogou | Advanced Threat | 11 | Adware:Win32/Sogou is a Potentially Unwanted Program (PUA) and adware family frequently associated with aggressive Chinese software bundlers, specifically targe... |
| sohanad | Trojan | 11 | Worm:Win32/Sohanad is a widespread, classic computer worm that gained notoriety for spreading aggressively via removable drives (USB flash drives) and popular I... |
| vrbrothers | Advanced Threat | 11 | Adware:Win32/Vrbrothers is a deceptive adware framework and Potentially Unwanted Program (PUA) that silently infiltrates endpoints, typically bundled with freew... |
| adgazelle | Trojan | 10 | Adgazelle (classified in antivirus detection telemetry under designations including Trojan:Win32/Adgazelle, Trojan.Win32.Adgazelle, and Win32/Adgazelle) is a mu... |
| dial | Ransomware | 10 | Dialer:Win32/Dial (or generic **Dialer** heuristics) represents a historical, highly prevalent class of malware from the dial-up internet era (late 90s to early... |
| disabler | Ransomware | 10 | Trojan:Win32/Disabler (or generic **Disabler** heuristics) represents a critical class of malware specifically engineered to actively hunt, cripple, and termina... |
| drmsoft | Advanced Threat | 10 | PUA:Win32/Drmsoft is a Potentially Unwanted Program (PUA) and adware family often bundled with video converters, media players, or software that promises to str... |
| idlekms | Ransomware | 10 | HackTool:Win32/Idlekms (and similar tools like KMSPico or AutoKMS) is a software utility designed explicitly for software piracy. It is used to illegally activa... |
| trick | Ransomware | 10 | Trojan:Win32/Trick (universally known as **Trickbot**) is one of the most successful, devastating, and modular malware families in history. Originally emerging ... |
| antavmu | Ransomware | 9 | Antavmu (classified in antivirus detection telemetry under designations including Ransom:Win32/Antavmu, Ransom.Win32.Antavmu, and Win32/Antavmu) is a crypto-ran... |
| imestartup | Advanced Threat | 9 | BrowserModifier:Win32/Imestartup is a persistent Potentially Unwanted Program (PUA) and browser hijacker specifically designed to forcefully alter a user's web ... |
| mybeesearch | Advanced Threat | 9 | BrowserModifier:Win32/Mybeesearch is an aggressive Potentially Unwanted Program (PUA) and browser hijacker. Its primary objective is to silently take control of... |
| collector | Trojan | 8 | Spyware:Win32/Collector is a specialized Information Stealer (Infostealer) trojan designed to silently harvest and exfiltrate highly specific sets of data from ... |
| klez | Advanced Threat | 8 | Worm:Win32/Klez is a historic, highly destructive mass-mailing worm that first appeared in late 2001 and raged across the internet for years. Klez fundamentally... |
| mokssteal | Trojan | 8 | PWS:Win32/Mokssteal is a highly specialized Password Stealer (PWS) and Information Stealer (Infostealer) trojan designed to silently harvest and exfiltrate cred... |
| pandex | Ransomware | 8 | Trojan:Win32/Pandex (often an alias or component of the massive **Cutwail** botnet) is a highly prevalent, persistent trojan whose primary objective is to infec... |
| pcacceleratepro | Advanced Threat | 8 | Rogue:Win32/Pcacceleratepro is a deceptive Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to del... |
| pcmedic | Advanced Threat | 8 | Rogue:Win32/Pcmedic is a deceptive Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deliberatel... |
| prochack | Advanced Threat | 8 | HackTool:Win32/Prochack (or generic **Process Hacker** heuristics) refers to detections associated with powerful system administration and memory manipulation t... |
| restoro | Advanced Threat | 8 | Rogue:Win32/Restoro is a highly prevalent Potentially Unwanted Program (PUA) classified as **Scareware** or a **Rogue System Optimizer**. It is designed to deli... |
| winreg | Trojan | 8 | Trojan:Win32/Winreg (often categorized generically as a **Registry Modifier**) is a classification for malware whose primary defining characteristic is the aggr... |
| egroupdial | Advanced Threat | 7 | Dialer:Win32/Egroupdial represents a legacy classification of malware that was highly prevalent during the era of dial-up internet modems. It is designed to com... |
| satwancrypt | Ransomware | 7 | Ransom:Win32/Satwancrypt is a destructive ransomware strain designed to infiltrate corporate networks, encrypt critical business data, and extort organizations ... |
| smshoax | Trojan | 7 | Trojan:AndroidOS/Smshoax is a prevalent classification of mobile malware specifically designed to commit financial fraud by silently subscribing the victim to p... |
| yahlover | Advanced Threat | 7 | Worm:Win32/Yahlover (also known as the **Yahoo Messenger Worm**) is a prolific mass-mailing and instant messaging worm that aggressively spread by hijacking Yah... |
| doyo | Advanced Threat | 6 | Adware:Win32/Doyo is a pervasive Potentially Unwanted Application (PUA) and Adware variant whose primary objective is aggressive monetization through unauthoriz... |
| hostspatcher | Trojan | 6 | Riskware:Win32/Hostspatcher (or Trojan:Win32/Hostspatcher) is a specific classification for malware or Potentially Unwanted Applications (PUAs) whose primary fu... |
| installmetrix | Advanced Threat | 6 | Adware:Win32/Installmetrix (often detected as PUA:Win32/Installmetrix) is a pervasive commercial **Pay-Per-Install (PPI) bundling framework**. It is designed to... |
| smartinstaller | Advanced Threat | 6 | Adware:Win32/Smartinstaller (often detected as PUA:Win32/Smartinstaller) is a generic classification for a commercial **Pay-Per-Install (PPI) bundling framework... |
| bunndle | Trojan | 5 | Bunndle (classified in antivirus detection telemetry under designations including Trojan:Win32/Bunndle, Trojan.Win32.Bunndle, and Win32/Bunndle) is a multi-stag... |
| candyopen | Trojan | 5 | Candyopen (classified in antivirus detection telemetry under designations including Trojan:Win32/Candyopen, Trojan.Win32.Candyopen, and Win32/Candyopen) is a mu... |
| coupons | Advanced Threat | 5 | Adware:Win32/Coupons (often part of a family of 'deal-finding' browser extensions) is an intrusive adware component designed to forcibly alter a user's web brow... |
| directdownloader | Advanced Threat | 5 | Adware:Win32/Directdownloader (often detected as PUA:Win32/Directdownloader) is a prevalent commercial **software bundling framework and adware injection platfo... |
| dnschange | Trojan | 5 | Trojan:Win32/Dnschange (referencing the infamous **DNSChanger** malware class) is a severe threat designed to silently hijack a victim's web traffic by altering... |
| downloadsoft | Advanced Threat | 5 | Adware:Win32/Downloadsoft (often detected as PUA:Win32/Downloadsoft) is a pervasive commercial **software bundling framework and adware injection platform**. It... |
| forcestartpage | Advanced Threat | 5 | BrowserModifier:Win32/Forcestartpage is a generic classification for aggressive Potentially Unwanted Programs (PUAs) functioning as **Browser Hijackers**. Its p... |
| gamebox | Advanced Threat | 5 | Adware:Win32/Gamebox is an adware application typically disguised as a legitimate gaming portal, cheat utility, or free game downloading software. While it may ... |
| hideproc | Trojan | 5 | Rootkit:Win32/Hideproc (or generic process hiding tool) is a highly sophisticated, kernel-level rootkit component designed to completely conceal the presence of... |
| inno | Advanced Threat | 5 | Adware:Win32/Inno (often detected due to the malicious abuse of the legitimate **Inno Setup** compiler) is a pervasive commercial software bundling framework an... |
| kaymundler | Advanced Threat | 5 | Adware:Win32/Kaymundler (often detected as PUA:Win32/Kaymundler) is a pervasive commercial **software bundling framework and adware injection platform**. It is ... |
| kido | Advanced Threat | 5 | Worm:Win32/Kido (universally known in the cybersecurity community as **Conficker**) is one of the most infamous, widespread, and devastating computer worms in h... |
| megasearch | Advanced Threat | 5 | BrowserModifier:Win32/Megasearch is a highly intrusive browser hijacker and adware component designed to forcibly alter a user's web browsing experience. It man... |
| mods | Advanced Threat | 5 | Adware:Win32/Mods (often detected as PUA:Win32/Mods) is a pervasive commercial **software bundling framework and adware injection platform**. It is designed to ... |
| multibar | Advanced Threat | 5 | Adware:Win32/Multibar (often detected as PUA:Win32/Multibar) is a deceptive application that functions primarily as an aggressive browser hijacker and adware in... |
| offerinstall | Advanced Threat | 5 | Adware:Win32/Offerinstall (often detected as PUA:Win32/Offerinstall) is a pervasive commercial **software bundling framework and adware injection platform**. It... |
| passcrypt | Ransomware | 5 | Ransom:Win32/Passcrypt (or Trojan:Win32/Passcrypt) is a severe threat generally classified as Ransomware or a destructive Password Stealer. It is designed to ex... |
| purga | Ransomware | 5 | Ransom:Win32/Purga (or Trojan:Win32/Purga) is a severe threat generally classified as Ransomware. It is designed to extort victims by strongly encrypting critic... |
| rontokbr | Advanced Threat | 5 | Worm:Win32/Rontokbr (also widely known as **Rontokbro** or Brontok) is a classic, highly pervasive computer worm that first surged in the mid-2000s. It was famo... |
| schwarzesonne | Ransomware | 5 | Ransom:Win32/Schwarzesonne (or Trojan:Win32/Schwarzesonne) is a severe threat generally classified as Ransomware or a highly destructive Trojan. It is designed ... |
| softomate | Advanced Threat | 5 | Adware:Win32/Softomate (often part of a family of aggressive browser toolbars) is an intrusive adware component and browser hijacker designed to forcibly alter ... |
| winevar | Trojan | 5 | Virus:Win32/Winevar is a classic, destructive file infector and mass-mailing worm. Unlike modern stealthy trojans, Winevar is 'noisy' and aggressive, designed t... |
| zafi | Advanced Threat | 5 | Worm:Win32/Zafi is a classic, historically significant mass-mailing computer worm that caused widespread disruption in the mid-2000s. Zafi (particularly variant... |
| clickmein | Advanced Threat | 4 | Adware:Win32/Clickmein is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect... |
| cnbtech | Advanced Threat | 4 | Adware:Win32/Cnbtech is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect s... |
| cryfile | Ransomware | 4 | Ransom:Win32/Cryfile is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, a... |
| cryptconsole | Ransomware | 4 | Ransom:Win32/Cryptconsole is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate da... |
| fakeoff | Advanced Threat | 4 | Rogue:Win32/Fakeoff is a deceptive class of malware known as Rogue Security Software, or 'Fake AV'. It is explicitly designed to scam victims out of money by ag... |
| gocloudnet | Advanced Threat | 4 | Adware:Win32/Gocloudnet is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirec... |
| itorrent | Advanced Threat | 4 | Adware:Win32/Itorrent (often classified as PUA or Riskware) is an adware application typically bundled with, or disguised as, a free BitTorrent client. While it... |
| kuping | Advanced Threat | 4 | Adware:Win32/Kuping is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect se... |
| nieguide | Advanced Threat | 4 | Adware:Win32/Nieguide is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect ... |
| oneclick | Advanced Threat | 4 | Adware:Win32/Oneclick (often part of software bundling networks) is an intrusive adware component designed to forcibly alter a user's web browsing experience. I... |
| pcfixer | Trojan | 4 | Rogue:Win32/Pcfixer (and similar variants) represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades... |
| pcreviver | Trojan | 4 | Rogue:Win32/Pcreviver represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Wind... |
| perfectoptimizer | Trojan | 4 | Rogue:Win32/Perfectoptimizer represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitima... |
| polycrypt | Ransomware | 4 | Ransom:Win32/Polycrypt is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data,... |
| regger | Trojan | 4 | Trojan:Win32/Regger is a persistent trojan characterized by its aggressive and illicit modifications to the Windows Registry. Its primary function is not necess... |
| reveton | Ransomware | 4 | Ransom:Win32/Reveton represents a historically significant evolutionary step in cyber extortion, commonly known as **'Police Ransomware' or a 'Screen Locker'**.... |
| rkit | Trojan | 4 | Rootkit:Win32/Rkit is a generic detection name used by Microsoft Defender to identify advanced, highly privileged malware known as **Rootkits**. Unlike a standa... |
| sigma | Ransomware | 4 | Ransom:Win32/Sigma is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| slowpcfighter | Trojan | 4 | Rogue:Win32/Slowpcfighter represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate ... |
| tsingsoft | Advanced Threat | 4 | Adware:Win32/Tsingsoft (often bundled with free software downloads) is an intrusive adware component designed to forcibly alter a user's web browsing experience... |
| widdit | Advanced Threat | 4 | Adware:Win32/Widdit is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect se... |
| xdata | Ransomware | 4 | Ransom:Win32/Xdata is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app... |
| accelerator | Backdoor | 3 | Accelerator (classified in antivirus detection telemetry under designations including Backdoor:Win32/Accelerator, Backdoor.Win32.Accelerator, and Win32/Accelera... |
| adwapper | Trojan | 3 | Adwapper (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwapper, Trojan.Win32.Adwapper, and Win32/Adwapper) is a multi-... |
| autofixerpro | Adware | 3 | Autofixerpro (classified in antivirus detection telemetry under designations including Adware:Win32/Autofixerpro, Adware.Win32.Autofixerpro, and Win32/Autofixer... |
| betabot | Trojan | 3 | Betabot (classified in antivirus detection telemetry under designations including Trojan:Win32/Betabot, Trojan.Win32.Betabot, and Win32/Betabot) is a multi-stag... |
| browseban | Trojan | 3 | Browseban (classified in antivirus detection telemetry under designations including Trojan:Win32/Browseban, Trojan.Win32.Browseban, and Win32/Browseban) is a mu... |
| catalina | Trojan | 3 | Catalina (classified in antivirus detection telemetry under designations including Trojan:Win32/Catalina, Trojan.Win32.Catalina, and Win32/Catalina) is a multi-... |
| conduit | Adware | 3 | Adware:Win32/Conduit is the detection name for one of the most infamous and widespread **Browser Hijackers** in the history of the internet. Distributed by the ... |
| fakerean | Advanced Threat | 3 | Rogue:Win32/Fakerean is a highly deceptive piece of malware classified as **Fake Antivirus (FakeAV) or Scareware**. Its entire operational model relies on socia... |
| fakesmoke | Trojan | 3 | Trojan:Win32/Fakesmoke is a form of **Rogue Security Software** (often called Fake AV or Scareware). It masquerades as a legitimate, high-end antivirus program,... |
| hostschanger | Advanced Threat | 3 | HackTool:Win32/Hostschanger is a critical **Heuristic Detection** that flags any unauthorized software attempting to maliciously modify the `C:\Windows\System32... |
| hotkeyshook | Trojan | 3 | Behavior:Win32/Hotkeyshook is a critical **Heuristic and Behavioral Detection** flagged by modern EDR and antivirus solutions. It is not a specific malware fami... |
| keywordfind | Advanced Threat | 3 | Adware:Win32/Keywordfind is an intrusive adware component and **Browser Hijacker** designed to forcibly alter a user's web browsing experience. It manipulates b... |
| linkular | Advanced Threat | 3 | Adware:Win32/Linkular is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser set... |
| mobogenie | Advanced Threat | 3 | Adware:Win32/Mobogenie is a highly intrusive Potentially Unwanted Program (PUP) that masquerades as a legitimate desktop management application for Android smar... |
| monder | Advanced Threat | 3 | Adware:Win32/Monder is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser setti... |
| multiminer | Ransomware | 3 | CoinMiner:Win32/Multiminer represents a prevalent class of malware known as **Cryptojackers or Cryptocurrency Miners**. Unlike ransomware that destroys data, Mu... |
| navipromo | Advanced Threat | 3 | Adware:Win32/Navipromo is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser se... |
| offergenerator | Advanced Threat | 3 | Adware:Win32/Offergenerator is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates brows... |
| onescan | Advanced Threat | 3 | Rogue:Win32/Onescan is a family of Rogue Antivirus (Scareware) programs designed to extort money from users through fear and deception. It mimics the appearance... |
| onesyscare | Trojan | 3 | Rogue:Win32/Onesyscare represents a classic example of **'Scareware' or Fake System Optimizers**. It is a deceptive program that masquerades as a legitimate Win... |
| pcmega | Trojan | 3 | Adware:Win32/Pcmega (often branded as PCMega Optimizer) is a form of **Rogue Security Software** (Fake AV or Scareware). It masquerades as a legitimate, high-en... |
| pennybee | Advanced Threat | 3 | Adware:Win32/Pennybee is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect ... |
| premium | Trojan | 3 | Adware:Win32/Premium (often associated with Premium SMS Fraud or aggressive Potentially Unwanted Programs) is a detection for software that deceptively enrolls ... |
| procpatcher | Trojan | 3 | HackTool:Win32/Procpatcher (or generic Patcher detections) typically refers to software designed to bypass digital rights management (DRM), licensing checks, or... |
| proinstall | Advanced Threat | 3 | Adware:Win32/Proinstall is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser s... |
| qaccel | Advanced Threat | 3 | Adware:Win32/Qaccel is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser setti... |
| rootkitdrv | Advanced Threat | 3 | Behavior:Win32/Rootkitdrv is a critical **Heuristic and Generic Detection** triggered when an endpoint defense platform (like Windows Defender or an EDR agent) ... |
| searchgo | Advanced Threat | 3 | Adware:Win32/Searchgo is an intrusive adware component and **Browser Hijacker** designed to forcibly alter a user's web browsing experience. It manipulates brow... |
| shenzhen | Advanced Threat | 3 | Adware:Win32/Shenzhen is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser set... |
| smartassembly | Ransomware | 3 | HackTool:Win32/Smartassembly is a highly nuanced detection. SmartAssembly itself is a **legitimate commercial software obfuscator and protector** created by Red... |
| somoto | Advanced Threat | 3 | Adware:Win32/Somoto (also known as BetterInstaller) represents a massive, highly organized **Software Bundling and Adware Network**. Rather than functioning as ... |
| speesipro | Advanced Threat | 3 | Adware:Win32/Speesipro is an intrusive adware component designed to forcibly alter a user's web browsing experience. It manipulates browser settings to redirect... |
| spynomore | Ransomware | 3 | Rogue:Win32/Spynomore is a classic example of **Scareware or Fake Antivirus (FakeAV)**. It is a deceptive program that masquerades as a legitimate security tool... |
| taterf | Advanced Threat | 3 | Worm:Win32/Taterf is a highly prevalent, self-replicating worm primarily designed to steal login credentials for popular Massively Multiplayer Online Role-Playi... |
| tencent | Advanced Threat | 3 | PUA:Win32/Tencent (often flagged generically) typically refers to aggressive **Potentially Unwanted Applications (PUAs), Adware, or unwanted software bundles** ... |
| timesink | Advanced Threat | 3 | Adware:Win32/Timesink is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser set... |
| uptodown | Advanced Threat | 3 | Adware:Win32/Uptodown is an intrusive adware component and software bundler designed to forcibly alter a user's web browsing experience. It manipulates browser ... |
| vonteera | Advanced Threat | 3 | Adware:Win32/Vonteera is a highly aggressive and technically advanced adware family. While its ultimate goal is to hijack browsers and display unwanted advertis... |
| webdiscover | Advanced Threat | 3 | Adware:Win32/Webdiscover is a highly persistent, intrusive Potentially Unwanted Program (PUP) and **Browser Hijacker** that specifically manifests as an unremov... |
| webprefix | Advanced Threat | 3 | Adware:Win32/Webprefix is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser se... |
| wpepro | Advanced Threat | 3 | HackTool:Win32/Wpepro (Winsock Packet Editor Pro) is a powerful, legacy network utility designed to intercept, analyze, and modify network packets at the Winsoc... |
| advancedpccare | Adware | 2 | Advancedpccare (classified in antivirus detection telemetry under designations including Adware:Win32/Advancedpccare, Adware.Win32.Advancedpccare, and Win32/Adv... |
| autocleanpro | Trojan | 2 | Autocleanpro (classified in antivirus detection telemetry under designations including Trojan:Win32/Autocleanpro, Trojan.Win32.Autocleanpro, and Win32/Autoclean... |
| baidu | Ransomware | 2 | Baidu (classified in antivirus detection telemetry under designations including Ransom:Win32/Baidu, Ransom.Win32.Baidu, and Win32/Baidu) is a crypto-ransomware ... |
| baidusearch | Trojan | 2 | Baidusearch (classified in antivirus detection telemetry under designations including Trojan:Win32/Baidusearch, Trojan.Win32.Baidusearch, and Win32/Baidusearch)... |
| chextad | Ransomware | 2 | Adware:Win32/Chextad is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ... |
| daum | Advanced Threat | 2 | Adware:Win32/Daum is a classification for Potentially Unwanted Programs (PUPs) and adware heavily associated with South Korean distribution networks (often leve... |
| defaulttab | Trojan | 2 | Adware:Win32/Defaulttab is a particularly aggressive and persistent Potentially Unwanted Program (PUP) categorized as a Browser Hijacker. It is notorious for no... |
| dotbundle | Advanced Threat | 2 | Adware:Win32/Dotbundle is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser se... |
| extcrome | Advanced Threat | 2 | Adware:Win32/Extcrome is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Extension, specifically targeting Google Chrome. It ... |
| extinstaller | Advanced Threat | 2 | Adware:Win32/Extinstaller is a classification for deceptive software components specifically designed to forcibly install unwanted, malicious, or ad-supported b... |
| fakesupport | Ransomware | 2 | Adware/Trojan:Win32/Fakesupport is a classification encompassing malware and aggressive adware specifically designed to facilitate Technical Support Scams. Unli... |
| fakesysdef | Advanced Threat | 2 | Rogue:Win32/Fakesysdef is a classic and aggressive example of Rogue Software, specifically categorized as 'Scareware' or a Fake HDD Defragmenter/Repair tool. It... |
| filepatch | Ransomware | 2 | Riskware:Win32/Filepatch is a highly generic heuristic detection used by antivirus engines to flag software 'cracks', 'patchers', or 'keygens'. These tools are ... |
| fotopapps | Ransomware | 2 | Adware:Win32/Fotopapps is a persistent adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad i... |
| hackav | Ransomware | 2 | Trojan:Win32/Hackav is a specific classification for utility malware designed with a singular, critical purpose: to impair, terminate, or completely uninstall l... |
| hotdownloads | Advanced Threat | 2 | Adware:Win32/Hotdownloads is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an insta... |
| installm | Advanced Threat | 2 | Adware:Win32/Installm is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installat... |
| instally | Advanced Threat | 2 | Adware:Win32/Instally is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an installat... |
| instmonster | Advanced Threat | 2 | Adware:Win32/Instmonster is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an instal... |
| itranslator | Advanced Threat | 2 | Adware/PUP:Win32/Itranslator is a Potentially Unwanted Program (PUP) categorized as an Adware or Browser Modifier. It is ostensibly marketed as a helpful browse... |
| jetmedia | Advanced Threat | 2 | Adware:Win32/Jetmedia is a highly persistent adware framework designed to monetize user web traffic by injecting intrusive advertisements, altering browser sear... |
| joosoft | Advanced Threat | 2 | Adware:Win32/Joosoft is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser sett... |
| lockcrypt | Ransomware | 2 | Ransomware:Win32/Lockcrypt is a destructive ransomware family that encrypts user data and demands payment for the decryption key. Unlike 'spray-and-pray' ransom... |
| medfos | Ransomware | 2 | Adware:Win32/Medfos is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced a... |
| mediafinder | Advanced Threat | 2 | Adware:Win32/Mediafinder is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser ... |
| mousedisable | Ransomware | 2 | Trojan:Win32/Mousedisable is a heuristic detection for a specific, highly disruptive behavioral trait found in various 'Joke' programs, Lockers, and poorly writ... |
| necurs | Spam Bot | 2 | Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ... |
| ntkrnl | Trojan | 2 | Rootkit:Win32/Ntkrnl is a highly sophisticated classification for malware designed to operate at the deepest layer of the Windows operating system (Ring 0 / Ker... |
| ohmytabs | Advanced Threat | 2 | Adware:Win32/Ohmytabs is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser set... |
| oneclickdownloader | Advanced Threat | 2 | Adware:Win32/Oneclickdownloader is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler' or 'Wrapper'. Its primary function is to act as an... |
| oneinstaller | Advanced Threat | 2 | Adware:Win32/Oneinstaller is a widespread Potentially Unwanted Program (PUP) categorized as a 'Bundler'. Its primary function is to act as an installation wrapp... |
| openshopper | Advanced Threat | 2 | Adware:Win32/Openshopper is a highly persistent adware framework and browser hijacker designed to inject unsolicited advertisements, fake coupons, and sponsored... |
| patch | Ransomware | 2 | Riskware:Win32/Patch is a highly generic heuristic detection used by antivirus engines to flag software 'cracks', 'patchers', or 'keygens'. These tools are desi... |
| pccleanup | Advanced Threat | 2 | Adware:Win32/Pccleanup is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masquerading as ... |
| pcopticlean | Ransomware | 2 | Rogue:Win32/Pcopticlean is a deceptive application categorized as a 'Fake System Optimizer' or 'Scareware'. It aggressively masquerades as a legitimate PC perfo... |
| revizer | Advanced Threat | 2 | Adware:Win32/Revizer is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser sett... |
| russoturisto | Advanced Threat | 2 | Adware:Win32/Russoturisto is a classification for a family of highly intrusive adware and browser modifiers. As the name suggests, its primary behavior is to in... |
| shopro | Advanced Threat | 2 | Adware:Win32/Shopro is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser setti... |
| simpleregistrycleaner | Advanced Threat | 2 | Adware:Win32/Simpleregistrycleaner is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masq... |
| spammy | Advanced Threat | 2 | Adware:Win32/Spammy is a classification for a family of highly intrusive adware and browser modifiers. As the name suggests, its primary behavior is to inundate... |
| startpa | Ransomware | 2 | Adware:Win32/Startpa is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ... |
| sunnydigits | Advanced Threat | 2 | Adware:Win32/Sunnydigits is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser ... |
| superthreat | Advanced Threat | 2 | Rogue:Win32/Superthreat is a classic example of Rogue Software, specifically a 'Fake Antivirus' (FakeAV) or 'Scareware'. It masquerades as a legitimate security... |
| swpatch | Ransomware | 2 | Riskware:Win32/Swpatch is a generic heuristic detection used by antivirus engines to identify 'software patchers', 'keygens', or 'cracks'. These are utilities e... |
| toptoo | Ransomware | 2 | Adware:Win32/Toptoo is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced a... |
| torrenteasy | Advanced Threat | 2 | Adware:Win32/Torrenteasy is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser ... |
| u8taskservice | Advanced Threat | 2 | Adware:Win32/U8taskservice is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Modifier or Adware. It is designed to forcibly ... |
| updatestar | Advanced Threat | 2 | Adware:Win32/Updatestar is a classification for Potentially Unwanted Programs (PUPs) that masquerade as legitimate software updaters or driver management utilit... |
| verti | Advanced Threat | 2 | Adware:Win32/Verti is an intrusive Potentially Unwanted Program (PUP) designed to forcibly alter a user's web browsing experience. It manipulates browser settin... |
| vigram | Advanced Threat | 2 | Adware/PUP:Win32/Vigram is a prevalent Potentially Unwanted Program (PUP) categorized as Adware. It is designed to monetize the user's web browsing activity wit... |
| virtumonde | Trojan | 2 | Adware/Trojan:Win32/Virtumonde (also widely known as Vundo) is a historically significant, highly aggressive adware and trojan family that peaked in the mid-to-... |
| viruscure | Ransomware | 2 | Rogue:Win32/Viruscure is a classic example of 'Rogueware' or Fake Antivirus. Its primary objective is financial extortion through deception and intimidation. It... |
| vprotect | Advanced Threat | 2 | Rogue:Win32/Vprotect is a prominent example of 'Rogue Security Software', 'Fake AV', or 'Scareware'. It is designed to look and act like a legitimate antivirus ... |
| webdevaz | Trojan | 2 | Adware/Trojan:Win32/Webdevaz is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Modifier or Adware. It is designed to forcibl... |
| webdialer | Advanced Threat | 2 | Dialer:Win32/Webdialer is a historical classification for a type of malware prevalent during the era of dial-up internet access. Its primary objective was finan... |
| xiaoxiong | Advanced Threat | 2 | Adware:Win32/Xiaoxiong is a regional Potentially Unwanted Program (PUP) categorized as a Browser Hijacker, specifically targeting users in Asian markets. It agg... |
| xmrigminer | Advanced Threat | 2 | RiskTool:Win32/Xmrigminer (or simply XMRig) is a highly efficient, open-source CPU mining application designed to mine Monero (XMR) and other RandomX-based cryp... |
| xunleihd | Advanced Threat | 2 | Adware:Win32/Xunleihd is an intrusive Potentially Unwanted Program (PUP) categorized as a malicious Browser Extension or Hijacker, primarily targeting users see... |
| zugo | Advanced Threat | 2 | Adware/PUP:Win32/Zugo is a highly aggressive Potentially Unwanted Program (PUP) categorized as Adware or a Browser Hijacker. It is designed to forcibly alter we... |
| activator | Ransomware | 1 | Activator (classified in antivirus detection telemetry under designations including Ransom:Win32/Activator, Ransom.Win32.Activator, and Win32/Activator) is a cr... |
| adbreak | Ransomware | 1 | Adbreak (classified in antivirus detection telemetry under designations including Ransom:Win32/Adbreak, Ransom.Win32.Adbreak, and Win32/Adbreak) is a crypto-ran... |
| adkubru | Ransomware | 1 | Adkubru (classified in antivirus detection telemetry under designations including Ransom:Win32/Adkubru, Ransom.Win32.Adkubru, and Win32/Adkubru) is a crypto-ran... |
| adpernok | Ransomware | 1 | Adpernok (classified in antivirus detection telemetry under designations including Ransom:Win32/Adpernok, Ransom.Win32.Adpernok, and Win32/Adpernok) is a crypto... |
| adwaresig | Adware | 1 | Adwaresig (classified in antivirus detection telemetry under designations including Adware:Win32/Adwaresig, Adware.Win32.Adwaresig, and Win32/Adwaresig) is a co... |
| allstars | Trojan | 1 | Allstars (classified in antivirus detection telemetry under designations including Trojan:Win32/Allstars, Trojan.Win32.Allstars, and Win32/Allstars) is a multi-... |
| alnaddy | Trojan | 1 | Alnaddy (classified in antivirus detection telemetry under designations including Trojan:Win32/Alnaddy, Trojan.Win32.Alnaddy, and Win32/Alnaddy) is a multi-stag... |
| antivirus | Ransomware | 1 | Antivirus (classified in antivirus detection telemetry under designations including Ransom:Win32/Antivirus, Ransom.Win32.Antivirus, and Win32/Antivirus) is a cr... |
| avkiller | Ransomware | 1 | Avkiller (classified in antivirus detection telemetry under designations including Ransom:Win32/Avkiller, Ransom.Win32.Avkiller, and Win32/Avkiller) is a crypto... |
| awangba | Ransomware | 1 | Awangba (classified in antivirus detection telemetry under designations including Ransom:Win32/Awangba, Ransom.Win32.Awangba, and Win32/Awangba) is a crypto-ran... |
| bancobras | Trojan | 1 | Bancobras (classified in antivirus detection telemetry under designations including Trojan:Win32/Bancobras, Trojan.Win32.Bancobras, and Win32/Bancobras) is a mu... |
| blackenergy | Advanced Threat | 1 | BlackEnergy is an advanced, modular persistent threat (APT) framework originally authored in 2007 by Ukrainian hacker Dmytro Oleksiuk (alias 'Cr4sh') as an unde... |
| bonkyhp | Ransomware | 1 | Bonkyhp (classified in antivirus detection telemetry under designations including Ransom:Win32/Bonkyhp, Ransom.Win32.Bonkyhp, and Win32/Bonkyhp) is a crypto-ran... |
| boychi | Ransomware | 1 | Boychi (classified in antivirus detection telemetry under designations including Ransom:Win32/Boychi, Ransom.Win32.Boychi, and Win32/Boychi) is a crypto-ransomw... |
| btcon | Trojan | 1 | Btcon (classified in antivirus detection telemetry under designations including Trojan:Win32/Btcon, Trojan.Win32.Btcon, and Win32/Btcon) is a multi-stage trojan... |
| bypass | Infostealer | 1 | Bypass (classified in antivirus detection telemetry under designations including PWS:Win32/Bypass, PWS.Win32.Bypass, and Win32/Bypass) is a dedicated informatio... |
| candybox | Ransomware | 1 | Candybox (classified in antivirus detection telemetry under designations including Ransom:Win32/Candybox, Ransom.Win32.Candybox, and Win32/Candybox) is a crypto... |
| cleanlog | Trojan | 1 | Trojan:Win32/Cleanlog is a specialized defense evasion tool utilized by advanced attackers (often post-exploitation) to deliberately cover their tracks. Its exp... |
| cleanpcpro | Ransomware | 1 | <h3>Executive Summary</h3> CleanPCPro is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system optimizer. I... |
| clearsearch | Ransomware | 1 | <h3>Executive Summary</h3> ClearSearch is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achie... |
| cnsmin | Advanced Threat | 1 | Adware:Win32/Cnsmin is a classic, highly persistent Browser Hijacker and adware family, originating in the early 2000s and strongly associated with the Chinese ... |
| cognosads | Ransomware | 1 | Adware:Win32/Cognosads is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through force... |
| coinloader | Ransomware | 1 | <h3>Executive Summary</h3> Coinloader is a specialized Trojan Downloader engineered with a singular, primary objective: to silently infect a system and subseque... |
| comine | Trojan | 1 | Coinminer:Win32/Comine (or Trojan:Win32/Comine) is a malicious cryptomining application designed to silently hijack the CPU and GPU resources of infected system... |
| comproc | Trojan | 1 | <h3>Executive Summary</h3> Comproc is a highly sophisticated Trojan that frequently exhibits Rootkit-like capabilities. It is designed to covertly infiltrate Wi... |
| cryptominer | Trojan | 1 | <h3>Executive Summary</h3> "Cryptominer" (often flagged as Riskware.CoinMiner, Trojan.Miner, or PUA.Miner) is a generic detection classification for software th... |
| deceptor | Ransomware | 1 | <h3>Executive Summary</h3> Deceptor (often detected as Rogue.Deceptor or Riskware.FakeAV) is a highly deceptive Potentially Unwanted Program (PUP) operating as ... |
| diskscanfa | Advanced Threat | 1 | <h3>Executive Summary</h3> DiskScanFA is a classification for a specific family of Rogue Security Software, commonly referred to as "FakeAV" or "Scareware." It ... |
| dlsecure | Ransomware | 1 | <h3>Executive Summary</h3> Dlsecure is a prominent example of "Rogue AV" or "Scareware." It is a deceptive, malicious application designed to aggressively mimic... |
| donut | Ransomware | 1 | <h3>Executive Summary</h3> Donut is a highly sophisticated, open-source offensive security framework designed to generate position-independent shellcode from .N... |
| doubleagent | Advanced Threat | 1 | <h3>Executive Summary</h3> DoubleAgent is not a traditional malware family, but rather a highly sophisticated, open-source code injection and persistence techni... |
| driverbooster | Advanced Threat | 1 | <h3>Executive Summary</h3> DriverBooster (developed by IObit) is widely classified by enterprise security vendors as a Potentially Unwanted Program (PUP) or "Ro... |
| driverdevelop | Trojan | 1 | <h3>Executive Summary</h3> "DriverDevelop" is a detection classification typically assigned to heavily obfuscated or unauthorized kernel-mode drivers (`.sys` fi... |
| driverturbo | Ransomware | 1 | <h3>Executive Summary</h3> DriverTurbo is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system optimizer. ... |
| eitu | Ransomware | 1 | Adware:Win32/Eitu is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad ... |
| ezsearch | Advanced Threat | 1 | <h3>Executive Summary</h3> EZSearch is a prevalent browser hijacker and adware program designed to forcibly redirect user search queries to a custom search port... |
| fakeal | Ransomware | 1 | <h3>Executive Summary</h3> FakeAl (short for "Fake Alert") is a classification for a highly disruptive form of Potentially Unwanted Program (PUP) operating as "... |
| fakeransom | Ransomware | 1 | Ransomware:Win32/Fakeransom (or 'Scareware') refers to malicious programs that mimic the behavior and appearance of actual ransomware to extort money, but lack ... |
| familykeylogger | Advanced Threat | 1 | <h3>Executive Summary</h3> FamilyKeylogger is a commercial surveillance application, often marketed to parents for monitoring children, but widely classified by... |
| feebs | Trojan | 1 | <h3>Executive Summary</h3> Feebs is a highly destructive and self-replicating polymorphic Worm and Trojan that gained significant notoriety in the mid-2000s. De... |
| flowspirit | Ransomware | 1 | <h3>Executive Summary</h3> FlowSpirit is an aggressive Adware and Potentially Unwanted Program (PUP) designed to heavily monetize infected systems. It achieves ... |
| fraud | Trojan | 1 | <h3>Executive Summary</h3> Fraud (often categorized as Trojan.Fraud, Rogue.Fraud, or FakeAV) is a generic classification for a highly aggressive form of Scarewa... |
| genkmsp | Ransomware | 1 | <h3>Executive Summary</h3> GenKMSP (often associated with KMSPico or AutoKMS) is classified as a "HackTool" or "Riskware." It is a software cracking utility spe... |
| gibe | Advanced Threat | 1 | <h3>Executive Summary</h3> Gibe (also known as Swen or Gibe.F) is a highly deceptive mass-mailing computer worm that gained notoriety in the early 2000s. It dif... |
| gruel | Advanced Threat | 1 | <h3>Executive Summary</h3> Gruel is a classic, highly destructive Worm and Virus dating back to the early 2000s. Often categorized as "joke" or "nuisance" malwa... |
| helper | Advanced Threat | 1 | Adware/PUP:Win32/Helper is a generic classification for potentially unwanted programs that disguise themselves as legitimate 'assistant' or 'helper' application... |
| hezhi | Ransomware | 1 | Adware:Win32/Hezhi is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad... |
| hostseditor | Trojan | 1 | <h3>Executive Summary</h3> HostsEditor (often categorized as Riskware, HackTool, or Trojan.Hosts) refers to malicious software or scripts designed specifically ... |
| iezones | Trojan | 1 | <h3>Executive Summary</h3> IEZones (Internet Explorer Zones) represents a class of Adware and Spyware that specifically targets the security zone configurations... |
| kelvir | Trojan | 1 | <h3>Executive Summary</h3> Kelvir is a widespread and aggressive family of Worms that primarily propagate by exploiting instant messaging networks, most notably... |
| kgen | Ransomware | 1 | HackTool:Win32/Kgen (Keygen) designates software crack utilities, key generators, and software patchers. While originally designed solely to bypass software lic... |
| killall | Ransomware | 1 | <h3>Executive Summary</h3> KillAll is a classification for malicious scripts, utilities, or "HackTools" specifically designed to aggressively terminate running ... |
| killapp | Ransomware | 1 | <h3>Executive Summary</h3> KillApp (often detected as Riskware.KillApp, Tool.KillApp, or Trojan.KillApp) identifies a specific class of malicious utilities or s... |
| kmsactivator | Ransomware | 1 | <h3>Executive Summary</h3> KMS Activator (often seen as AutoKMS or KMSpico) is a widely distributed "HackTool" designed to illegally bypass Microsoft's Key Mana... |
| kraken | Ransomware | 1 | <h3>Executive Summary</h3> Kraken is a notorious, highly sophisticated Botnet and Trojan malware family. At its peak in 2008, it was considered one of the large... |
| libie | Ransomware | 1 | Adware:Win32/Libie is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through forced ad... |
| look2me | Trojan | 1 | <h3>Executive Summary</h3> Look2Me (also known as L2M) is a notoriously aggressive and persistent form of Adware and Spyware that plagued Windows systems heavil... |
| lyrics | Ransomware | 1 | Adware:Win32/Lyrics (often seen as 'LyricsSay' or similar variants) is a highly intrusive adware family designed to hijack the user's web browsing experience. I... |
| magic | Ransomware | 1 | HackTool:Win32/Magic is a broad categorization for utilities designed to modify, patch, or crack legitimate software, often to bypass DRM or licensing checks. W... |
| maxsecure | Ransomware | 1 | <h3>Executive Summary</h3> MaxSecure (often Max Secure Anti Virus or Max Secure Spyware Detector) is a notorious family of "Rogue Security Software" or "Scarewa... |
| mediamine | Ransomware | 1 | Adware:Win32/Mediamine is a highly intrusive adware family designed to hijack the user's web browsing experience. Its primary goal is monetization through force... |
| mirai | Botnet | 1 | Mirai (Japanese for 'the future') is a revolutionary Linux-based malware family and botnet that transformed internet of things (IoT) security upon its emergence... |
| molebox | Advanced Threat | 1 | <h3>Executive Summary</h3> Molebox is a dual-use technology. Originally developed as a legitimate commercial software virtualization and packing utility (design... |
| mycleanpc | Advanced Threat | 1 | Rogueware:Win32/Mycleanpc is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and exto... |
| mytob | Backdoor | 1 | <h3>Executive Summary</h3> Mytob is a highly prolific and historically significant mass-mailing worm and botnet agent that first emerged in the mid-2000s. Based... |
| netdevil | Trojan | 1 | <h3>Executive Summary</h3> NetDevil is a legacy, yet highly capable, Remote Access Trojan (RAT) that gained prominence in the early to mid-2000s. Engineered to ... |
| nircmd | Ransomware | 1 | HackTool:Win32/Nircmd refers to the detection of a perfectly legitimate, highly powerful system administration utility created by NirSoft. Because NirCmd allows... |
| nyxem | Advanced Threat | 1 | <h3>Executive Summary</h3> Nyxem (widely known as Kama Sutra, Blackmal, or MyWife) is a highly destructive mass-mailing computer worm that gained global infamy ... |
| optispeed | Ransomware | 1 | <h3>Executive Summary</h3> Optispeed is an aggressive Potentially Unwanted Program (PUP) and Adware application that masquerades as a legitimate system optimiza... |
| optix | Trojan | 1 | <h3>Executive Summary</h3> Optix (most commonly referring to Optix Pro) is a notorious and highly capable Remote Access Trojan (RAT) that gained prominence in t... |
| orangedefender | Ransomware | 1 | <h3>Executive Summary</h3> OrangeDefender is a prominent example of Rogue Security Software (also known as FakeAV or Scareware). It is a highly deceptive progra... |
| pcbooster | Ransomware | 1 | <h3>Executive Summary</h3> PCBooster is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system optimizer. It... |
| pccleaners | Ransomware | 1 | <h3>Executive Summary</h3> PCCleaners (often detected as Rogue.PCCleaners or PUP.FakeOptimizer) is a deceptive Potentially Unwanted Program (PUP) operating as "... |
| pccleaningutility | Ransomware | 1 | <h3>Executive Summary</h3> "PC Cleaning Utility" is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system o... |
| pccleanplus | Ransomware | 1 | <h3>Executive Summary</h3> PCCleanPlus (often detected as Rogue.PCCleanPlus or PUP.FakeOptimizer) is a deceptive Potentially Unwanted Program (PUP) operating as... |
| pchealthboost | Ransomware | 1 | <h3>Executive Summary</h3> PC HealthBoost is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system optimize... |
| pcrepair | Ransomware | 1 | <h3>Executive Summary</h3> PCRepair (often encountered under various generic names like "PC Repair Pro" or "Advanced PC Repair") is a classification for Rogue S... |
| pcvark | Ransomware | 1 | <h3>Executive Summary</h3> PCVARK (often associated with applications like "Advanced Mac Cleaner" or various Windows "System Optimizers") is a deceptive softwar... |
| pornblackmailer | Ransomware | 1 | Ransomware/Scareware:Win32/Pornblackmailer represents a highly manipulative form of extortion software. Unlike traditional ransomware that encrypts files, this ... |
| powerspritz | Ransomware | 1 | <h3>Executive Summary</h3> PowerSpritz is a sophisticated, fileless malware framework that heavily leverages Microsoft PowerShell to compromise Windows environm... |
| powerun | Ransomware | 1 | <h3>Executive Summary</h3> Powerun (often detected as HackTool.Powerun, Riskware.PowerShell, or Trojan.Powerun) is not a standalone malware family, but rather a... |
| powstage | Ransomware | 1 | <h3>Executive Summary</h3> PowStage (or PowerShell Stager) refers to a class of fileless malware components used extensively in modern, "Living off the Land" (L... |
| protector | Ransomware | 1 | <h3>Executive Summary</h3> Protector (often seen as "Windows Protector," "System Protector," or "Antivirus Protector") is a classification for Rogue Security So... |
| proxygate | Advanced Threat | 1 | <h3>Executive Summary</h3> ProxyGate is an application typically classified as Riskware or a Potentially Unwanted Program (PUP) by enterprise security environme... |
| psshell | Ransomware | 1 | <h3>Executive Summary</h3> PSShell refers to a category of offensive PowerShell scripts and frameworks (such as Nishang or Empire modules) designed to establish... |
| pyme | Ransomware | 1 | <h3>Executive Summary</h3> Pyme is a malicious program that exhibits characteristics of both a Trojan and a Worm. It is designed to covertly infiltrate Windows ... |
| realspy | Advanced Threat | 1 | <h3>Executive Summary</h3> RealSpy is a commercially available software application marketed for employee monitoring and parental control. However, due to its d... |
| regcurepro | Advanced Threat | 1 | Rogueware:Win32/Regcurepro is a highly visible, classic example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and ext... |
| removewga | Backdoor | 1 | <h3>Executive Summary</h3> RemoveWGA is classified as a "HackTool" or "Riskware." It is a legacy software cracking utility specifically designed to illegally by... |
| riodrv | Trojan | 1 | <h3>Executive Summary</h3> RioDrv (often associated with older, invasive Digital Rights Management (DRM) software like the infamous Sony BMG copy protection sca... |
| scramupx | Advanced Threat | 1 | <h3>Executive Summary</h3> ScramUPX is a highly specialized malware packing and obfuscation utility. It is designed to take an executable file that has already ... |
| searchprovide | Ransomware | 1 | <h3>Executive Summary</h3> SearchProvide is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It ach... |
| security | Advanced Threat | 1 | Rogue:Win32/Security (often seen as SecurityShield, SecurityTool, etc.) is a broad categorization for 'Rogueware' or Fake Antivirus software. These applications... |
| securityshield | Trojan | 1 | Rogueware:Win32/Securityshield is a highly visible, classic example of a 'Fake Antivirus' program. It operates entirely on a model of deception and extortion. M... |
| seeav | Ransomware | 1 | Trojan:Win32/Seeav is a generic detection indicating that a malicious binary is actively attempting to Impair Defenses by seeking out and neutralizing the host'... |
| seznam | Trojan | 1 | <h3>Executive Summary</h3> In a cybersecurity context, "Seznam" detections typically refer to aggressive browser hijackers and Potentially Unwanted Programs (PU... |
| shezkrypt | Ransomware | 1 | <h3>Executive Summary</h3> Shezkrypt is a destructive ransomware and cryptor family designed to extort financial payment from victims by irreparably encrypting ... |
| shinolock | Ransomware | 1 | <h3>Executive Summary</h3> Shinolock is a variant of ransomware designed to extort financial payment from victims by encrypting their critical data and demandin... |
| silentinstall | Advanced Threat | 1 | <h3>Executive Summary</h3> "SilentInstall" (often flagged generically as Adware.SilentInstall or PUP.Installer) refers to a class of Potentially Unwanted Progra... |
| singleclickreg | Advanced Threat | 1 | Adware:Win32/Singleclickreg is a classic example of 'Rogueware' or a Fake System Optimizer. It operates on a model of deception and extortion. While masqueradin... |
| smartapplicationcontroller | Ransomware | 1 | <h3>Executive Summary</h3> SmartApplicationController (often detected as Rogue.SmartAppControl or PUP.SmartController) is a deceptive Potentially Unwanted Progr... |
| smartfortress | Trojan | 1 | Rogue:Win32/Smartfortress is a classic and highly visible example of 'Rogueware' or a Fake Antivirus. It operates purely on deception, masquerading as a legitim... |
| smartpctweaker | Advanced Threat | 1 | Rogueware:Win32/Smartpctweaker is a classic example of a 'Fake Optimizer'. It operates entirely on a model of deception and extortion. Masquerading as a legitim... |
| snocry | Ransomware | 1 | <h3>Executive Summary</h3> Snocry is a destructive ransomware family designed to extort financial payment from victims by encrypting their critical files and de... |
| softcdn | Ransomware | 1 | <h3>Executive Summary</h3> SoftCDN (often detected as PUP.SoftCDN or Adware.SoftCDN) represents a class of deceptive software bundlers and "download managers." ... |
| sokuxuan | Ransomware | 1 | <h3>Executive Summary</h3> Sokuxuan is an aggressive Adware and Potentially Unwanted Program (PUP) designed to monetize infected systems. It achieves this by hi... |
| specialsearchoffer | Ransomware | 1 | <h3>Executive Summary</h3> SpecialSearchOffer is a highly intrusive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It... |
| spypro | Trojan | 1 | <h3>Executive Summary</h3> SpyPro (often associated with the SpySheriff or SpywareProtect2009 families) is a highly aggressive form of Rogue Antivirus (Scarewar... |
| spyrix | Advanced Threat | 1 | <h3>Executive Summary</h3> Spyrix is a commercially available software application marketed for employee monitoring and parental control. However, due to its de... |
| ssprotect | Advanced Threat | 1 | Rogueware:Win32/Ssprotect is a classic example of a 'Fake Antivirus' or 'Rogueware'. It operates entirely on a model of deception and extortion. Masquerading as... |
| streamer | Ransomware | 1 | <h3>Executive Summary</h3> Streamer (often detected as Adware.Streamer or PUP.Streamer) is a Potentially Unwanted Program that typically masquerades as a legiti... |
| systemhijack | Ransomware | 1 | <h3>Executive Summary</h3> SystemHijack is a generic classification for a severe category of Trojans designed to completely subvert the core functions of the Wi... |
| systimizer | Advanced Threat | 1 | Rogueware:Win32/Systimizer is a deceptive application masquerading as a high-end PC optimization and registry cleaning tool. It operates on a model of psycholog... |
| systweaker | Ransomware | 1 | <h3>Executive Summary</h3> SysTweaker is a deceptive Potentially Unwanted Program (PUP) that operates as "Rogue Security Software" or a fake system optimizer. I... |
| taskkill | Ransomware | 1 | <h3>Executive Summary</h3> The detection of "Taskkill" in a security context refers to the malicious abuse of the legitimate, built-in Windows utility `taskkill... |
| teamviewer | Backdoor | 1 | <h3>Executive Summary</h3> TeamViewer is a fully legitimate, commercially available remote access and support application. However, in the context of cybersecur... |
| urausy | Ransomware | 1 | Ransom:Win32/Urausy (also known as a 'Police Trojan') represents a massive, historical wave of screen-locking ransomware. Unlike modern crypto-ransomware that e... |
| w10tweak | Ransomware | 1 | <h3>Executive Summary</h3> W10Tweak (often flagged as HackTool.Win32.W10Tweak or Riskware.Win10Tweaker) is a classification for various third-party utilities de... |
| wadhrama | Ransomware | 1 | <h3>Executive Summary</h3> Wadhrama is a sophisticated, highly disruptive variant of ransomware characterized by its use of robust encryption algorithms and its... |
| wfpdisabler | Trojan | 1 | HackTool:Win32/Wfpdisabler (Windows File Protection Disabler) is a highly specialized, malicious utility used during the post-exploitation phase of an attack. I... |
| wgapatch | Ransomware | 1 | HackTool:Win32/Wgapatch refers to software designed to bypass Microsoft's Windows Genuine Advantage (WGA) validation. While technically a 'hack tool' rather tha... |
| winshow | Ransomware | 1 | <h3>Executive Summary</h3> WinShow is a highly disruptive Adware and Browser Hijacker variant designed to aggressively monetize infected endpoints. It achieves ... |
| winspeedup | Ransomware | 1 | <h3>Executive Summary</h3> WinSpeedup (often detected as Rogue.WinSpeedup or PUP.FakeOptimizer) is a highly deceptive Potentially Unwanted Program (PUP) operati... |
| wisesystemmechanic | Advanced Threat | 1 | Rogueware:Win32/Wisesystemmechanic is a highly visible example of a 'Fake Optimizer' and registry cleaner. It operates entirely on a model of deception and exto... |
| xiaobaminer | Trojan | 1 | <h3>Executive Summary</h3> XiaobaMiner is a malicious cryptocurrency mining Trojan (Cryptojacker) designed to hijack the computational resources (CPU and GPU) o... |
| xmrminer | Trojan | 1 | <h3>Executive Summary</h3> XMRig (often detected generally as XMRMiner or CoinMiner.XMR) is a legitimate, open-source Monero (XMR) CPU/GPU miner that has been o... |
| zacinlo | Advanced Threat | 1 | <h3>Executive Summary</h3> Zacinlo is a highly sophisticated Adware and Rootkit framework. Unlike standard adware that relies on simple browser extensions, Zaci... |
| zero | Ransomware | 1 | <h3>Executive Summary</h3> While "Zero" can occasionally refer to minor ransomware variants, in enterprise security contexts, it most commonly refers to the Zer... |
| zwangi | Ransomware | 1 | <h3>Executive Summary</h3> Zwangi is a highly persistent Adware and Potentially Unwanted Program (PUP) designed to aggressively monetize infected systems. It ac... |
| aero | Adware | Sampled | Aero (frequently cataloged in security telemetry as AERO Sample or BrowserModifier:Win32/Aero) represents a persistent category of Potentially Unwanted Applicat... |
| jps | Trojan | Sampled | JPS (cataloged across security software as Trojan:Win32/JPS, Virus:Win32/JPS, and Trojan.Win32.JPS) is the compiled runtime client component generated by the JP... |
| jps_virus_maker | Tool | Sampled | JPS Virus Maker (cataloged across security software as HackTool:Win32/JPSVirusMaker, Tool:Win32/JPS, and Constructor.Win32.JPS) is a classical GUI-based virus c... |
| messiah | Trojan | Sampled | Messiah (cataloged across security software as Trojan:Win32/Messiah, Backdoor.Win32.Messiah, and Trojan.Messiah) is a classic Delphi-authored remote access troj... |
| netsphere | Trojan | Sampled | NetSphere (cataloged across security software as Backdoor:Win32/NetSphere, Trojan.Win32.NetSphere, and Backdoor.NetSphere) is a classic early 2000s remote admin... |
| terabit_virus_maker | Trojan | Sampled | Terabit Virus Maker (abbreviated as TVM and identified in security definitions as HackTool.Win32.Terabit) is an automated malware generation kit and script viru... |