T1566.001: Phishing: Spearphishing Attachment

Framework: MITRE ATT&CK · Tactic: Initial Access · Total Cataloged Families: 822 · Observed Samples: 58,189 · Primary Threat Categories: Ransomware · Trojan · Banking Trojan

Operational Executive Summary

T1566.001 (Phishing: Spearphishing Attachment) is classified under the Initial Access tactic within the MITRE ATT&CK framework. Techniques used by adversaries to gain their initial foothold within an enterprise network, spanning spearphishing, drive-by downloads, exploit kits, and compromised edge perimeter appliances. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 822 distinct malware families, totaling over 58,189 validated samples.

Technical Anatomy & Adversary Tradecraft

Adversaries leverage Phishing: Spearphishing Attachment to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Phishing: Spearphishing Attachment, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.

In modern multi-stage campaigns, T1566.001 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Phishing: Spearphishing Attachment to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.

Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at https://attack.mitre.org/techniques/T1566/001/.

Detection Engineering & Threat Hunting

Detecting Phishing: Spearphishing Attachment requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:

Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.

SOC Containment & Hardening Guidance

To mitigate risks associated with T1566.001 (Phishing: Spearphishing Attachment) across production infrastructure, security teams should implement the following defensive controls:

Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Phishing: Spearphishing Attachment across adjacent network segments.

→ Incident Response Guidance: Read our Active Incident Response Playbook

Cataloged Malware Families Utilizing T1566.001 (822 Families)

The following malware families in the SystemHelpDesk catalog have been verified utilizing T1566.001 (Phishing: Spearphishing Attachment):

822 families

Family	Category	Sample Count	Technical Summary
emotet	Loader	`12,943`	Emotet (initially identified in 2014 as Geodo or Heodo) is historically recognized as one of the most destructive and costly botnet malware loaders ever observe...
fareit	Infostealer	`10,955`	Fareit (widely recognized across the threat intelligence community as Pony or Pony Stealer) is one of the most influential and pervasive credential-harvesting i...
ursnif	Banking Trojan	`8,188`	Ursnif (also widely known by its underlying codebase names Gozi and ISFB) is one of the most enduring and technically sophisticated banking trojans and modular ...
upatre	Downloader	`4,200`	Upatre is a notoriously lightweight, high-volume downloader first identified in mid-2013 that served as the initial spearhead for some of the most catastrophic ...
gandcrab	Ransomware	`2,992`	GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ransomware-as-a-Service (Raa...
chapak	Downloader	`2,254`	TrojanDownloader:Win32/Chapak (widely cataloged across threat telemetry as Trojan.Chapak, Win32/Chapak, or Downloader.Chapak) is a high-volume, multi-stage troj...
cerber	Ransomware	`1,792`	Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2016 and late 2017. Deve...
qbot	Banking Trojan	`1,758`	QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2...
triusor	Trojan	`1,429`	Trojan:Win32/Triusor (cataloged across security telemetry as Trojan.Triusor, Downloader.Triusor, or Win32/Triusor) is a modular Windows trojan downloader and dr...
ulise	Trojan	`1,176`	Ulise (cataloged across global threat intelligence as Trojan-Downloader.Win32.Ulise, Trojan:Win32/Ulise, and Trojan.Ulise) is a sophisticated trojan downloader ...
ursu	Trojan	`1,168`	Trojan:Win32/Ursu (cataloged across security telemetry as Trojan.MSIL.URSU, Win32/Ursu, or Downloader.Ursu) is a persistent .NET-based trojan dropper and second...
pikabot	Loader	`850`	Pikabot is an evasive, modular malware loader that emerged in early 2023, widely recognized by threat intelligence analysts as one of the primary successors to ...
mira	Worm	`729`	Trojan:Win32/Mira (also tracked across vendor signatures as Worm:Win32/Mira, distinct from the Linux IoT botnet Mirai) is a prolific Windows mass-mailing worm a...
simbot	Backdoor	`634`	Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or B...
trickbot	Trojan	`466`	TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime histor...
cosmicduke	Infostealer	`408`	Backdoor:Win32/CosmicDuke (also tracked as Bot-Moog, TinyBaron, or Nemor) is an advanced cyber espionage platform developed and deployed by APT29 (Cozy Bear / R...
tinyloader	Downloader	`203`	TinyLoader (cataloged in antivirus telemetry as TrojanDownloader:Win32/TinyLoader, Trojan.TinyLoader, and Downloader.TinyLoader) is an ultra-compact first-stage...
nakoctb	Ransomware	`134`	Ransom:Win32/Nakoctb (frequently cataloged in security telemetry as naKocTb, Trojan:Win32/Nakoctb, or Trojan-Ransom.Win32.Nakoctb) is a notorious Windows screen...
goznym	Banking Trojan	`120`	Trojan:Win32/Goznym is a devastating hybrid banking trojan created in early 2016 through the engineering merger of two notorious malware codebases: the Nymaim s...
icedid	Banking Trojan	`118`	IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept...
phorpiex	Botnet	`115`	Phorpiex (also cataloged across the cybersecurity industry as Trik, Worm:Win32/Phorpiex, Trojan:Win32/Phorpiex, and Worm.Win32.Trik) is an infamous, multi-funct...
gozi	Banking Trojan	`113`	Trojan:Win32/Gozi (also universally tracked as ISFB and the Ursnif family tree) is one of the most historically significant, resilient banking trojans in comput...
guildma	Banking Trojan	`109`	Guildma (also tracked by cybersecurity researchers as Astaroth, Trojan:Win32/Guildma, and Trojan-Banker.Win32.Guildma) is a highly sophisticated, multi-stage mo...
tempedreve	Downloader	`104`	Tempedreve (cataloged across security research as TrojanDownloader:Win32/Tempedreve and Trojan:Win32/Tempedreve) is a dedicated multi-stage trojan downloader an...
nisloder	Loader	`103`	Nisloder (cataloged under Microsoft Defender signatures as TrojanDownloader:Win32/Nisloder and Trojan:Win32/Nisloder) is a lightweight modular trojan downloader...
nymeria	Downloader	`102`	Nymeria (cataloged across security vendors as TrojanDownloader:Win32/Nymeria, Trojan.Nymeria, and Backdoor:Win32/Nymeria) is a modular Windows trojan downloader...
chir	Worm	`99`	Chir (extensively documented as Virus:Win32/Chir.B@mm, W32.Chir, and Runouce) is a historic, highly aggressive mass-mailing worm and polymorphic file infector f...
cutwail	Botnet	`92`	Cutwail (frequently referenced in conjunction with its rootkit and downloader component Pushdo, or Pandex) is one of the longest-running and highest-volume spam...
bancteian	Downloader	`91`	Bancteian (cataloged across security vendors under signatures including Trojan:Win32/Bancteian, TrojanDownloader:Win32/Bancteian, and Trojan.Bancteian) is a spe...
mydoom	Worm	`88`	Mydoom (cataloged historically under designations including Worm:Win32/Mydoom, W32.Mydoom@mm, W32.Novarg.A@mm, and Shimgapi) is one of the most prolific and fas...
rubinurd	Downloader	`87`	Rubinurd (cataloged by threat intelligence researchers and security vendors under identifiers including Trojan:Win32/Rubinurd, TrojanDownloader.Rubinurd, and Wi...
bitrep	Trojan	`76`	Bitrep (cataloged in antivirus vendor databases under detections including Trojan:Win32/Bitrep, Trojan:Win32/Bitrep.A, and TrojanDownloader:Win32/Bitrep) is a W...
bayrob	Trojan	`74`	Bayrob (cataloged across cybersecurity research and international law enforcement filings as Trojan.Bayrob, Win32/Bayrob, and W32.Bayrob) was a notorious cyberc...
shade	Ransomware	`72`	Shade (also widely tracked in cyber threat intelligence feeds as Troldesh, Encoder.858, and Ransom:Win32/Shade) is a landmark ransomware family that terrorized ...
wecod	Trojan	`71`	Wecod (cataloged in antivirus vendor databases under detections including Trojan:Win32/Wecod, Trojan.Win32.Wecod, and Win32/Wecod) is a multi-functional Windows...
mepaow	Trojan	`68`	Mepaow (cataloged in antivirus vendor databases and threat intelligence feeds under detections including Trojan:Win32/Mepaow, Worm.Win32.MEPAOW, and Trojan.Mepa...
propagate	Ransomware	`67`	Worm:Win32/Propagate is a behavioral heuristic detection utilized by antivirus engines to flag malware that aggressively attempts to copy itself across a networ...
pynamer	Trojan	`67`	Pynamer (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Pynamer, Trojan.Pynamer, and Trojan:Win32/P...
stormattack	Trojan	`62`	StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttac...
asparnet	Trojan	`58`	Asparnet (cataloged across security vendors under detections including Trojan:Win32/Asparnet and Adware:Win32/Asparnet) is a persistent Windows adware and troja...
brontok	Worm	`57`	Brontok (widely recognized across cybersecurity history as Rontokbr, Worm:Win32/Brontok, and W32.Rontokbro@mm) is a landmark, highly disruptive mass-mailing com...
jimmy	Ransomware	`57`	Jimmy (tracked across incident response engagements and threat intelligence feeds under signatures including Ransom:Win32/Jimmy, Trojan-Ransom.Win32.Jimmy, and ...
scarab	Ransomware	`57`	Scarab (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Scarab, Trojan-Ransom.Win32.Scarab, and Rans...
bancos	Banking Trojan	`55`	Bancos (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Bancos, Trojan:Win32/Bancos, and Win3...
warezov	Worm	`55`	Warezov (also widely tracked in security industry literature as Stration, Email-Worm.Win32.Warezov, and Worm:Win32/Warezov) is a landmark mass-mailing email wor...
steam	Infostealer	`54`	Steam (cataloged across security intelligence feeds under signatures including Trojan:Win32/SteamStealer, PWS:Win32/Steam, and Trojan-PSW.Win32.Steam) is a targ...
banbra	Banking Trojan	`53`	Banbra (cataloged across security vendors and threat intelligence databases under signatures including Trojan-Banker.Win32.Banbra, Trojan:Win32/Banbra, and Win3...
crytex	Ransomware	`52`	Crytex (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Crytex, Trojan-Ransom.Win32.Crysis, and Rans...
shakblades	Ransomware	`48`	Shakblades is a destructive Windows ransomware strain active since 2017. Propagated primarily through trojanized software activators, cracked utilities, and exp...
ruskill	Ransomware	`46`	Ruskill (cataloged across security vendors and threat intelligence databases under signatures including Ransom:Win32/Ruskill, Trojan-Ransom.Win32.Ruskill, and T...
vigorf	Trojan	`45`	Vigorf is a pervasive Windows trojan downloader and ransomware stager cataloged under Microsoft Defender signatures including Trojan:Win32/Vigorf.A. Infiltratin...
jaiko	Ransomware	`44`	Jaiko is an extortion ransomware and screen locker strain active since 2016. Delivered via weaponized email attachments and fake software installers, Jaiko exec...
agenttesla	Infostealer	`43`	Agent Tesla is an accessible, highly ubiquitous commercial info-stealer and keylogger built on the Microsoft .NET framework. First surfacing in late 2014, the t...
formbook	Spyware	`35`	Formbook (rebranded in recent generations as XLoader) is a prolific, cross-platform information stealer and spyware implant offered on underground cybercrime fo...
turla	Advanced Threat	`35`	Turla (extensively documented in military and threat intelligence reporting under aliases such as Snake, Uroburos, Waterbug, and Venomous Bear) is an elite cybe...
blamon	Ransomware	`22`	Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive...
elzob	Ransomware	`22`	Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family a...
krucky	Ransomware	`22`	Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a dest...
kuluoz	Trojan	`22`	Kuluoz (identified across antimalware research as Trojan:Win32/Kuluoz, TrojanDownloader:Win32/Kuluoz, and closely associated with the historic Asprox botnet inf...
miniduke	Trojan	`22`	MiniDuke (classified across threat intelligence repositories under designations including Backdoor:Win32/MiniDuke, Trojan:Win32/MiniDuke, and Win32/MiniDuke) is...
golroted	Ransomware	`21`	Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destr...
pajetbin	Ransomware	`21`	Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware fami...
schoolboy	Ransomware	`21`	Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware famil...
tonmye	Ransomware	`21`	Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targ...
blihan	Ransomware	`20`	Blihan (classified in endpoint telemetry as Ransom:Win32/Blihan, Trojan-Ransom.Win32.Blihan, and Win32/Blihan) is an aggressive crypto-ransomware family designe...
pasta	Ransomware	`20`	Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware fa...
qzonit	Ransomware	`20`	Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a ta...
wdjiange	Ransomware	`20`	Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Win...
dorifel	Trojan	`19`	Dorifel (also known as Quervar and classified across antivirus vendors under signatures including Trojan:Win32/Dorifel, Virus:Win32/Dorifel.A, and Worm:Win32/Do...
jackservn	Trojan Downloader	`17`	Jackservn (classified in antimalware definitions under Trojan:Win32/Jackservn, TrojanDownloader:Win32/Jackservn, and Backdoor:Win32/Jackservn) is a stealthy mod...
birele	Ransomware	`16`	Birele (classified across commercial antivirus and EDR solutions under designations including Ransom:Win32/Birele, Trojan-Ransom.Win32.Birele, and Ransom.Birele...
cmy3u	Ransomware	`16`	Cmy3u (classified across security vendors as Ransom:Win32/Cmy3u, Trojan-Ransom.Win32.Cmy3u, and Win32/Cmy3u) is a targeted crypto-ransomware family engineered t...
cwqw	Ransomware	`16`	Cwqw (identified across antimalware research as Ransom:Win32/Cwqw, Trojan-Ransom.Win32.Cwqw, and Ransom.Cwqw) is an evasive corporate crypto-ransomware family d...
dico	Ransomware	`16`	Dico (classified across antimalware research as Ransom:Win32/Dico, Trojan-Ransom.Win32.Dico, and Ransom.Dico) is a high-impact corporate crypto-ransomware famil...
jottix	Ransomware	`16`	Jottix (classified across cybersecurity organizations as Ransom:Win32/Jottix, Trojan-Ransom.Win32.Jottix, and Win32/Jottix) is a targeted crypto-ransomware fami...
krserv	Ransomware	`16`	KRServ (classified across antimalware research as Ransom:Win32/KRServ, Trojan:Win32/KRServ, and Win32/KRServ) is a specialized ransomware and trojan service fam...
sixer	Ransomware	`16`	Sixer (classified in cybersecurity threat databases under designations including Ransom:Win32/Sixer, Trojan-Ransom.Win32.Sixer, and Win32/Sixer) is an evasive c...
vools	Ransomware	`16`	Vools (classified across antimalware research as Ransom:Win32/Vools, Trojan-Ransom.Win32.Vools, and Win32/Vools) is a high-speed corporate crypto-ransomware fam...
adject	Ransomware	`15`	Adject (classified across antivirus engines as Ransom:Win32/Adject, Trojan-Ransom.Win32.Adject, and Win32/Adject) is a targeted crypto-ransomware family designe...
betload	Ransomware	`15`	Betload (classified as Ransom:Win32/Betload, Trojan:Win32/Betload, and TrojanDownloader:Win32/Betload) is a hybrid trojan loader and ransomware payload observed...
blackv	Ransomware	`15`	BlackV (classified across threat intelligence feeds as Ransom:Win32/BlackV and Trojan-Ransom.Win32.BlackV) is an aggressive Windows crypto-ransomware family des...
cryptinject	Ransomware	`15`	Cryptinject (classified in antimalware definitions under designations including Ransom:Win32/Cryptinject, Trojan:Win32/Cryptinject, and VirTool:Win32/Cryptinjec...
generickdz	Ransomware	`15`	GenericKDZ (classified across endpoint antimalware engines under designations including Ransom:Win32/GenericKDZ, Trojan-Ransom.Win32.GenericKDZ, and Win32/Gener...
jaiks	Ransomware	`15`	Jaiks (classified in antimalware threat repositories as Ransom:Win32/Jaiks and Trojan-Ransom.Win32.Jaiks) is an evasive crypto-ransomware family designed to exe...
lovgate	Worm	`15`	Lovgate (historically documented across cybersecurity research as Worm:Win32/Lovgate, Email-Worm.Win32.Lovgate, and Backdoor:Win32/Lovgate) is a landmark mass-m...
powzip	Ransomware	`15`	Powzip (classified in threat intelligence feeds as Ransom:Win32/Powzip and Trojan-Ransom.Win32.Powzip) is an unusual crypto-ransomware family that leverages Pow...
scriptkd	Ransomware	`15`	Scriptkd (classified as Ransom:Win32/Scriptkd and Trojan-Ransom.Win32.Scriptkd) is a script-based and multi-stage crypto-ransomware family combining Windows Scr...
umbald	Ransomware	`15`	Umbald (classified across antimalware research as Ransom:Win32/Umbald, Trojan-Ransom.Win32.Umbald, and Win32/Umbald) is an aggressive enterprise crypto-ransomwa...
vehidis	Ransomware	`15`	Vehidis (classified as Ransom:Win32/Vehidis and Trojan-Ransom.Win32.Vehidis) is a destructive crypto-ransomware family designed for rapid and wide-scale data ex...
yantai	Trojan Downloader	`15`	Yantai (classified in threat databases as TrojanDownloader:Win32/Yantai and Backdoor:Win32/Yantai) is a stealthy trojan downloader engineered to establish persi...
zvuzona	Ransomware	`15`	Zvuzona (classified as Ransom:Win32/Zvuzona across Microsoft Defender, Kaspersky, and Trend Micro) is a destructive crypto-ransomware family designed for rapid ...
chthonic	Banking Trojan	`14`	Trojan:Win32/Chthonic is an advanced, highly modular banking trojan and direct evolutionary offshoot of the Zeus (Zbot) codebase discovered by Kaspersky Lab res...
genericrxdz	Ransomware	`14`	GenericRXDZ (classified across commercial antivirus engines under designations including Ransom:Win32/GenericRXDZ and Trojan-Ransom.Win32.GenericRXDZ) is an eva...
geral	Ransomware	`14`	Geral (classified across antimalware research as Ransom:Win32/Geral, Trojan-Ransom.Win32.Geral, and Win32/Geral) is an aggressive Windows crypto-ransomware fami...
troldesh	Ransomware	`14`	Troldesh (widely tracked across the intelligence community as Shade or Encrypter.JPHP) is a notorious Russian-speaking ransomware family first active in late 20...
dimnie	Infostealer	`13`	Dimnie (first discovered in 2014 and thoroughly analyzed by security firms including Palo Alto Networks Unit 42) is an evasive modular infostealer and intellige...
gorgon	Apt	`13`	Gorgon (tracked in threat intelligence as The Gorgon Group, Backdoor:Win32/Gorgon, and Trojan:Win32/Gorgon) is a cyber espionage and targeted crimeware toolset ...
kirts	Ransomware	`13`	Kirts (classified across antimalware research as Ransom:Win32/Kirts and Trojan-Ransom.Win32.Kirts) is a targeted crypto-ransomware family designed to execute de...
kraddare	Ransomware	`13`	Kraddare (classified as Ransom:Win32/Kraddare across Microsoft Defender, Kaspersky, and Trend Micro) is an enterprise crypto-ransomware family designed for rapi...
macri	Ransomware	`13`	Macri (classified in threat databases as Ransom:Win32/Macri and Trojan-Ransom.Win32.Macri) is a targeted corporate crypto-ransomware family that encrypts files ...
reset	Ransomware	`13`	Reset (classified across antivirus engines as Ransom:Win32/Reset and Trojan-Ransom.Win32.Reset) is an aggressive corporate crypto-ransomware family designed to ...
talent	Ransomware	`13`	Talent (classified in threat databases as Ransom:Win32/Talent and Trojan-Ransom.Win32.Talent) is an evasive crypto-ransomware family designed for rapid and wide...
zboter	Trojan	`13`	Trojan:Win32/Zboter is a generic heuristic detection typically associated with the downloader or initial staging components of the infamous ZeuS (Zbot) banking ...
zerber	Ransomware	`13`	Ransomware:Win32/Zerber (a common misspelling or heuristic variant of Cerber Ransomware) was one of the most prolific, sophisticated, and financially succes...
centrumloader	Trojan Downloader	`12`	Centrumloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Centrumloader, TrojanDownloader.Win32.Centrumload...
csrb	Ransomware	`12`	Trojan:Win32/Csrb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
fasong	Ransomware	`12`	Trojan:Win32/Fasong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
gendal	Ransomware	`12`	Trojan:Win32/Gendal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
quant	Ransomware	`12`	TrojanDownloader:Win32/Quant (commonly known as Quant Loader) is a highly successful, commercially available malware downloader. Heavily advertised and sold...
redosdru	Ransomware	`12`	Trojan:Win32/Redosdru is a persistent, stealthy trojan and backdoor designed to breach endpoint defenses, establish a long-term foothold, and securely deliver s...
systex	Ransomware	`12`	Trojan:Win32/Systex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
webdown	Ransomware	`12`	TrojanDownloader:Win32/Webdown is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole pur...
bluteal	Ransomware	`11`	Bluteal (classified in antivirus detection telemetry under designations including Ransom:Win32/Bluteal, Ransom.Win32.Bluteal, and Win32/Bluteal) is a crypto-ran...
cloxer	Ransomware	`11`	Trojan:Win32/Cloxer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
exploder	Ransomware	`11`	Trojan:Win32/Exploder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
gendwnurl	Ransomware	`11`	TrojanDownloader:Win32/Gendwnurl is a generic heuristic detection used by antivirus engines to identify malicious scripts or small executable stubs whose sole p...
jord	Ransomware	`11`	Trojan:Win32/Jord is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
locky	Ransomware	`11`	Locky is one of the most prolific, damaging, and aggressively distributed ransomware strains in cyber history, first emerging in February 2016. Associated with ...
midia	Ransomware	`11`	Virus:Win32/Midia is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
multidl	Trojan	`11`	TrojanDownloader:Win32/Multidl is a generic heuristic detection used by antivirus engines to identify malicious stagers whose primary function is to establish a...
paph	Ransomware	`11`	Trojan:Win32/Paph is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
ranos	Ransomware	`11`	Trojan:Win32/Ranos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
refroso	Ransomware	`11`	Trojan:Win32/Refroso is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
stimilik	Ransomware	`11`	Trojan:Win32/Stimilik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
ubibila	Ransomware	`11`	Trojan:Win32/Ubibila is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
zebrocy	Trojan	`11`	Trojan:Win32/Zebrocy (also known as Sednit or associated with Sofacy) is a highly customized, multi-language malware toolset used almost exclusively by **APT28 ...
zzinfor	Ransomware	`11`	Trojan:Win32/Zzinfor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
bandit	Ransomware	`10`	Bandit (classified in antivirus detection telemetry under designations including Ransom:Win32/Bandit, Ransom.Win32.Bandit, and Win32/Bandit) is a crypto-ransomw...
codiby	Ransomware	`10`	Trojan:Win32/Codiby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hilevel	Ransomware	`10`	Trojan:Win32/Hilevel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
jaike	Ransomware	`10`	Trojan:Win32/Jaike is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
jintor	Ransomware	`10`	Trojan:Win32/Jintor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
korplug	Trojan	`10`	Backdoor:Win32/Korplug (widely known in the cybersecurity community as PlugX) is a highly customized, persistent Remote Access Trojan (RAT) used extensively...
nagoot	Ransomware	`10`	Trojan:Win32/Nagoot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
sisbot	Ransomware	`10`	Trojan:Win32/Sisbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tovus	Ransomware	`10`	Trojan:Win32/Tovus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
vopak	Ransomware	`10`	Trojan:Win32/Vopak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
buzy	Ransomware	`9`	Buzy (classified in antivirus detection telemetry under designations including Ransom:Win32/Buzy, Ransom.Win32.Buzy, and Win32/Buzy) is a crypto-ransomware desi...
cossta	Ransomware	`9`	Trojan:Win32/Cossta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
delbar	Ransomware	`9`	Trojan:Win32/Delbar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
dervec	Ransomware	`9`	Trojan:Win32/Dervec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
enfal	Trojan	`9`	Backdoor:Win32/Enfal (also tracked as Linfo) is a highly targeted, persistent Remote Access Trojan (RAT) that has been used extensively by sophisticated Chi...
hiru	Ransomware	`9`	Trojan:Win32/Hiru is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
ksdler	Ransomware	`9`	TrojanDownloader:Win32/Ksdler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ...
lebag	Ransomware	`9`	Trojan:Win32/Lebag is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
loader	Ransomware	`9`	Trojan:Win32/Loader (or generic Loader / Downloader heuristics) represents the foundational building block of the modern cybercrime ecosystem. A Loader is a...
lunam	Ransomware	`9`	Trojan:Win32/Lunam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
miancha	Ransomware	`9`	Trojan:Win32/Miancha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
microjoin	Ransomware	`9`	HackTool:Win32/Microjoin (or generic File Joiner / Binder heuristics) refers to a class of utilities used to secretly combine two or more distinct files...
mwpm	Ransomware	`9`	Trojan:Win32/Mwpm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
opanki	Backdoor	`9`	Worm:Win32/Opanki is a legacy, self-propagating worm that gained extreme prevalence in the mid-to-late 2000s by aggressively exploiting Instant Messaging (IM) n...
ranapama	Ransomware	`9`	Trojan:Win32/Ranapama is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
snobar	Ransomware	`9`	Trojan:Win32/Snobar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
wirzemro	Ransomware	`9`	Trojan:Win32/Wirzemro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
blueh	Ransomware	`8`	Blueh (classified in antivirus detection telemetry under designations including Ransom:Win32/Blueh, Ransom.Win32.Blueh, and Win32/Blueh) is a crypto-ransomware ...
brresmon	Ransomware	`8`	Brresmon (classified in antivirus detection telemetry under designations including Ransom:Win32/Brresmon, Ransom.Win32.Brresmon, and Win32/Brresmon) is a crypto...
citeary	Ransomware	`8`	Trojan:Win32/Citeary is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
cnopa	Ransomware	`8`	Trojan:Win32/Cnopa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
dalexis	Ransomware	`8`	Trojan:Win32/Dalexis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
enistery	Ransomware	`8`	Trojan:Win32/Enistery is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
lydra	Ransomware	`8`	Trojan:Win32/Lydra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
montp	Ransomware	`8`	Trojan:Win32/Montp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
neos	Ransomware	`8`	Trojan:Win32/Neos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
orbus	Ransomware	`8`	Trojan:Win32/Orbus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
puwaders	Ransomware	`8`	Trojan:Win32/Puwaders is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
resur	Ransomware	`8`	Trojan:Win32/Resur is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
wenper	Ransomware	`8`	Trojan:Win32/Wenper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
wyhymyz	Ransomware	`8`	Trojan:Win32/Wyhymyz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
comrerop	Ransomware	`7`	Trojan:Win32/Comrerop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
corrempa	Ransomware	`7`	Trojan:Win32/Corrempa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
dishigy	Ransomware	`7`	Trojan:Win32/Dishigy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
dorv	Ransomware	`7`	Trojan:Win32/Dorv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
erbon	Ransomware	`7`	Trojan:Win32/Erbon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
gippers	Ransomware	`7`	Trojan:Win32/Gippers is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
hermes	Ransomware	`7`	Ransom:Win32/Hermes is a targeted, destructive ransomware strain first observed in early 2017 across Russian cybercrime underground forums. In October 2017, Her...
klone	Ransomware	`7`	Trojan:Win32/Klone is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
lolojan	Ransomware	`7`	Trojan:Win32/Lolojan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
loskad	Ransomware	`7`	Trojan:Win32/Loskad is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mago	Ransomware	`7`	Trojan:Win32/Mago is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
molock	Ransomware	`7`	Trojan:Win32/Molock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
moonlight	Ransomware	`7`	Trojan:Win32/Moonlight is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
noonlight	Ransomware	`7`	Trojan:Win32/Noonlight is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
nrww	Ransomware	`7`	Trojan:Win32/Nrww is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
nsanti	Ransomware	`7`	Trojan:Win32/Nsanti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
pepm	Ransomware	`7`	Trojan:Win32/Pepm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
resdro	Ransomware	`7`	Trojan:Win32/Resdro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
spnr	Ransomware	`7`	Trojan:Win32/Spnr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
taily	Ransomware	`7`	Trojan:Win32/Taily is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
tainp	Ransomware	`7`	Trojan:Win32/Tainp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
upkm	Ransomware	`7`	Trojan:Win32/Upkm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
vbcryptent	Trojan	`7`	Trojan:Win32/Vbcryptent is a generic heuristic detection utilized by security vendors to classify a wide variety of malicious payloads (trojans, stealers, worms...
vemptik	Ransomware	`7`	Trojan:Win32/Vemptik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
vibem	Ransomware	`7`	Trojan:Win32/Vibem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
zmem	Ransomware	`7`	Trojan:Win32/Zmem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
zumanek	Ransomware	`7`	Trojan:Win32/Zumanek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
adwind	Trojan	`6`	Adwind (classified in antivirus detection telemetry under designations including Trojan:Win32/Adwind, Trojan.Win32.Adwind, and Win32/Adwind) is a multi-stage tr...
bicololo	Ransomware	`6`	Bicololo (classified in antivirus detection telemetry under designations including Ransom:Win32/Bicololo, Ransom.Win32.Bicololo, and Win32/Bicololo) is a crypto...
bulta	Ransomware	`6`	Bulta (classified in antivirus detection telemetry under designations including Ransom:Win32/Bulta, Ransom.Win32.Bulta, and Win32/Bulta) is a crypto-ransomware ...
cekar	Ransomware	`6`	Cekar (classified in antivirus detection telemetry under designations including Ransom:Win32/Cekar, Ransom.Win32.Cekar, and Win32/Cekar) is a crypto-ransomware ...
chepro	Ransomware	`6`	Trojan:Win32/Chepro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
cjishu	Ransomware	`6`	Trojan:Win32/Cjishu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
creprote	Ransomware	`6`	Trojan:Win32/Creprote is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
delfidelfi	Trojan	`6`	Trojan:Win32/Delfidelfi is a generic heuristic detection used by antivirus engines to classify a wide variety of malware that has been written or heavily packed...
delikle	Ransomware	`6`	Trojan:Win32/Delikle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
detroie	Ransomware	`6`	Trojan:Win32/Detroie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
dotnet	Ransomware	`6`	Trojan:MSIL/Dotnet (or Generic.DotNet) is a broad, generic heuristic detection utilized by antivirus engines to flag highly suspicious or demonstrably malicious...
dotto	Ransomware	`6`	Trojan:Win32/Dotto is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
duphead	Ransomware	`6`	Trojan:Win32/Duphead is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
ekidoa	Ransomware	`6`	Trojan:Win32/Ekidoa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
epack	Ransomware	`6`	Trojan:Win32/Epack is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
fbtaken	Ransomware	`6`	Trojan:Win32/Fbtaken is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
firstinj	Ransomware	`6`	Trojan:Win32/Firstinj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
genericgb	Ransomware	`6`	Trojan:Win32/Genericgb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
hiloti	Ransomware	`6`	Trojan:Win32/Hiloti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
huhk	Ransomware	`6`	Trojan:Win32/Huhk is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
hype	Ransomware	`6`	Trojan:Win32/Hype is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
idsohtu	Ransomware	`6`	Trojan:Win32/Idsohtu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
jumpta	Ransomware	`6`	Trojan:Win32/Jumpta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
leivion	Ransomware	`6`	Trojan:Win32/Leivion is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
nilage	Ransomware	`6`	Trojan:Win32/Nilage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
orsam	Ransomware	`6`	Trojan:Win32/Orsam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
pavica	Ransomware	`6`	Trojan:Win32/Pavica is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
peals	Ransomware	`6`	Trojan:Win32/Peals is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
psloader	Ransomware	`6`	Trojan:Win32/Psloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
rastarby	Ransomware	`6`	Trojan:Win32/Rastarby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
recex	Ransomware	`6`	Trojan:Win32/Recex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sagecrypt	Ransomware	`6`	Ransom:Win32/Sagecrypt (widely known as Sage 2.0) is a highly sophisticated ransomware family that gained prominence in 2017. It is notable for being heavil...
samca	Ransomware	`6`	Trojan:Win32/Samca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sinresby	Ransomware	`6`	Trojan:Win32/Sinresby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
smee	Ransomware	`6`	Trojan:Win32/Smee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
swotter	Ransomware	`6`	Trojan:Win32/Swotter is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
tilken	Ransomware	`6`	Trojan:Win32/Tilken is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
toga	Ransomware	`6`	Trojan:Win32/Toga is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
vanilloader	Ransomware	`6`	TrojanDownloader:Win32/Vanilloader is a lightweight, highly obfuscated trojan designed exclusively to act as the first stage in a multi-stage infection chain. I...
venik	Ransomware	`6`	Trojan:Win32/Venik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
vidro	Ransomware	`6`	Trojan:Win32/Vidro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
xpyn	Ransomware	`6`	Trojan:Win32/Xpyn is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
zygug	Ransomware	`6`	Trojan:Win32/Zygug is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
agentwdcr	Ransomware	`5`	Agentwdcr (classified in antivirus detection telemetry under designations including Ransom:Win32/Agentwdcr, Ransom.Win32.Agentwdcr, and Win32/Agentwdcr) is a cr...
amavaldo	Trojan	`5`	Amavaldo (classified in antivirus detection telemetry under designations including Trojan:Win32/Amavaldo, Trojan.Win32.Amavaldo, and Win32/Amavaldo) is a multi-...
baserch	Ransomware	`5`	Baserch (classified in antivirus detection telemetry under designations including Ransom:Win32/Baserch, Ransom.Win32.Baserch, and Win32/Baserch) is a crypto-ran...
bero	Ransomware	`5`	Bero (classified in antivirus detection telemetry under designations including Ransom:Win32/Bero, Ransom.Win32.Bero, and Win32/Bero) is a crypto-ransomware desi...
chifrax	Ransomware	`5`	Trojan:Win32/Chifrax is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
conjar	Ransomware	`5`	Trojan:Win32/Conjar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
cryrar	Ransomware	`5`	Ransom:Win32/Cryrar is a severe threat classified as Ransomware. Uniquely, variants of this family (or families using similar techniques) often leverage legitim...
cslz	Ransomware	`5`	Trojan:Win32/Cslz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
cyfin	Ransomware	`5`	Trojan:Win32/Cyfin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
dadobra	Ransomware	`5`	Trojan:Win32/Dadobra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
delfiles	Ransomware	`5`	Trojan:Win32/Delfiles is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
dodiw	Ransomware	`5`	Trojan:Win32/Dodiw is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
dominator	Ransomware	`5`	Trojan:Win32/Dominator is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
downer	Ransomware	`5`	TrojanDownloader:Win32/Downer (or Generic Downloader) is a broad heuristic classification for malicious software whose primary purpose is to securely bypass loc...
enestedel	Ransomware	`5`	Trojan:Win32/Enestedel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
fakeie	Ransomware	`5`	Trojan:Win32/Fakeie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
fbsi	Ransomware	`5`	Trojan:Win32/Fbsi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
fraudster	Ransomware	`5`	Trojan:Win32/Fraudster is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
genericrxcl	Ransomware	`5`	Trojan:Win32/Genericrxcl is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
gojdue	Ransomware	`5`	Trojan:Win32/Gojdue is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
haperlock	Ransomware	`5`	Trojan:Win32/Haperlock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
inegery	Ransomware	`5`	Trojan:Win32/Inegery is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
jyuqet	Ransomware	`5`	Trojan:Win32/Jyuqet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
kasinst	Ransomware	`5`	Trojan:Win32/Kasinst is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
laban	Ransomware	`5`	Trojan:Win32/Laban is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
loki	Trojan	`5`	TrojanSpy:Win32/Loki (universally known as LokiBot) is one of the most prevalent, enduring, and dangerous information stealers on the cybercriminal market. ...
mdrop	Ransomware	`5`	TrojanDropper:Win32/Mdrop (or Generic Dropper) is a broad heuristic classification for malicious software whose sole purpose is to securely bypass local antivir...
mensa	Ransomware	`5`	Trojan:Win32/Mensa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
msildrop	Ransomware	`5`	TrojanDropper:Win32/Msildrop (or Generic MSIL Dropper) is a broad heuristic classification for malicious software written in C# or VB.NET and compiled into Micr...
mufanom	Ransomware	`5`	Trojan:Win32/Mufanom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
naprat	Ransomware	`5`	Trojan:Win32/Naprat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
necne	Ransomware	`5`	Trojan:Win32/Necne is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
perkiler	Ransomware	`5`	Trojan:Win32/Perkiler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
pintu	Ransomware	`5`	Trojan:Win32/Pintu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
pres	Ransomware	`5`	Trojan:Win32/Pres is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
remoh	Ransomware	`5`	Trojan:Win32/Remoh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rontokbr	Advanced Threat	`5`	Worm:Win32/Rontokbr (also widely known as Rontokbro or Brontok) is a classic, highly pervasive computer worm that first surged in the mid-2000s. It was famo...
ruco	Ransomware	`5`	Trojan:Win32/Ruco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
sahat	Ransomware	`5`	Trojan:Win32/Sahat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sasfis	Trojan	`5`	TrojanDownloader:Win32/Sasfis is a prevalent, highly active botnet component and downloader trojan. It is primarily utilized by cybercriminal syndicates as a 'f...
separ	Trojan	`5`	Trojan:Win32/Separ is an aggressive credential-stealing malware campaign renowned for its simplicity, effectiveness, and its heavy reliance on legitimate, 'dual...
skillis	Ransomware	`5`	Trojan:Win32/Skillis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
smearpasse	Ransomware	`5`	Trojan:Win32/Smearpasse is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
stocde	Ransomware	`5`	Trojan:Win32/Stocde is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tanske	Ransomware	`5`	Trojan:Win32/Tanske is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tar4rkdi	Ransomware	`5`	Trojan:Win32/Tar4rkdi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
ukpa	Ransomware	`5`	Trojan:Win32/Ukpa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
vapsup	Ransomware	`5`	Trojan:Win32/Vapsup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
vbinder	Trojan	`5`	Trojan:Win32/Vbinder (often classified generically as a 'Binder', 'Joiner', or 'Wrapper') is not a specific malware payload itself, but rather a malicious utili...
wigon	Ransomware	`5`	Trojan:Win32/Wigon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
winevar	Trojan	`5`	Virus:Win32/Winevar is a classic, destructive file infector and mass-mailing worm. Unlike modern stealthy trojans, Winevar is 'noisy' and aggressive, designed t...
zafi	Advanced Threat	`5`	Worm:Win32/Zafi is a classic, historically significant mass-mailing computer worm that caused widespread disruption in the mid-2000s. Zafi (particularly variant...
000c	Ransomware	`4`	000C (classified in antivirus detection telemetry under designations including Ransom:Win32/000C, Ransom.Win32.000C, and Win32/000C) is a crypto-ransomware desi...
blakamba	Ransomware	`4`	Blakamba (classified in antivirus detection telemetry under designations including Ransom:Win32/Blakamba, Ransom.Win32.Blakamba, and Win32/Blakamba) is a crypto...
boht	Ransomware	`4`	Boht (classified in antivirus detection telemetry under designations including Ransom:Win32/Boht, Ransom.Win32.Boht, and Win32/Boht) is a crypto-ransomware desi...
canbis	Ransomware	`4`	Canbis (classified in antivirus detection telemetry under designations including Ransom:Win32/Canbis, Ransom.Win32.Canbis, and Win32/Canbis) is a crypto-ransomw...
cryfile	Ransomware	`4`	Ransom:Win32/Cryfile is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, a...
cryptconsole	Ransomware	`4`	Ransom:Win32/Cryptconsole is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate da...
denes	Ransomware	`4`	Trojan:Win32/Denes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
dubfot	Ransomware	`4`	Trojan:Win32/Dubfot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
dycler	Ransomware	`4`	Trojan:Win32/Dycler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
eggnog	Ransomware	`4`	Trojan:Win32/Eggnog is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
emelent	Ransomware	`4`	Trojan:Win32/Emelent is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
emogen	Ransomware	`4`	Trojan:Win32/Emogen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
eqtonex	Ransomware	`4`	Trojan:Win32/Eqtonex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
fakeime	Ransomware	`4`	Trojan:Win32/Fakeime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
fesber	Ransomware	`4`	Trojan:Win32/Fesber is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
floder	Ransomware	`4`	Trojan:Win32/Floder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
fwwy	Ransomware	`4`	Trojan:Win32/Fwwy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
gamup	Ransomware	`4`	Trojan:Win32/Gamup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
genericrxdr	Ransomware	`4`	Trojan:Win32/Genericrxdr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
hvom	Ransomware	`4`	Trojan:Win32/Hvom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
inservice	Ransomware	`4`	Trojan:Win32/Inservice is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
irplan	Ransomware	`4`	Trojan:Win32/Irplan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
kapucen	Ransomware	`4`	Trojan:Win32/Kapucen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
kelios	Ransomware	`4`	Trojan:Win32/Kelios is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
kriskynote	Ransomware	`4`	Trojan:Win32/Kriskynote is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
listicka	Ransomware	`4`	Trojan:Win32/Listicka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
mahato	Ransomware	`4`	Trojan:Win32/Mahato is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
marocan	Ransomware	`4`	Trojan:Win32/Marocan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
mazben	Ransomware	`4`	Trojan:Win32/Mazben is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mkar	Ransomware	`4`	Trojan:Win32/Mkar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
morphex	Ransomware	`4`	Trojan:Win32/Morphex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
nukesped	Trojan	`4`	Backdoor:Win32/Nukesped is a highly sophisticated, persistent backdoor remote access trojan (RAT) heavily attributed to the Lazarus Group (HIDDEN COBRA), a ...
paradise	Ransomware	`4`	Ransom:Win32/Paradise is a prolific crypto-ransomware family operating under a Ransomware-as-a-Service (RaaS) model. It allows affiliates to distribute the malw...
patpoopy	Ransomware	`4`	Trojan:Win32/Patpoopy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
perseus	Ransomware	`4`	Trojan:Win32/Perseus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
polycrypt	Ransomware	`4`	Ransom:Win32/Polycrypt is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data,...
prosti	Ransomware	`4`	Trojan:Win32/Prosti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
pwsime	Ransomware	`4`	PWS:Win32/Pwsime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, b...
qqten	Ransomware	`4`	Trojan:Win32/Qqten is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rabased	Ransomware	`4`	Trojan:Win32/Rabased is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
shaosmine	Ransomware	`4`	Trojan:Win32/Shaosmine is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
sigma	Ransomware	`4`	Ransom:Win32/Sigma is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app...
spora	Ransomware	`4`	Ransom:Win32/Spora is widely regarded by threat analysts as one of the most sophisticated, 'professionally' developed crypto-ransomware families of its era. It ...
stagol	Ransomware	`4`	Trojan:Win32/Stagol is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
startserv	Ransomware	`4`	Trojan:Win32/Startserv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
tarayt	Ransomware	`4`	Trojan:Win32/Tarayt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tbma	Ransomware	`4`	Trojan:Win32/Tbma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
titirez	Ransomware	`4`	Trojan:Win32/Titirez is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
weiduan	Ransomware	`4`	Trojan:Win32/Weiduan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
werly	Ransomware	`4`	Trojan:Win32/Werly is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
xdata	Ransomware	`4`	Ransom:Win32/Xdata is a severe threat classified as Ransomware. It is designed to extort victims by strongly encrypting critical personal or corporate data, app...
xiazai	Ransomware	`4`	TrojanDownloader:Win32/Xiazai is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ...
xylauncher	Ransomware	`4`	TrojanDownloader:Win32/Xylauncher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads l...
yakbeex	Ransomware	`4`	Trojan:Win32/Yakbeex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
zard	Ransomware	`4`	Trojan:Win32/Zard is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
zesibund	Ransomware	`4`	Trojan:Win32/Zesibund is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
admoke	Ransomware	`3`	Admoke (classified in antivirus detection telemetry under designations including Ransom:Win32/Admoke, Ransom.Win32.Admoke, and Win32/Admoke) is a crypto-ransomw...
bandios	Ransomware	`3`	Bandios (classified in antivirus detection telemetry under designations including Ransom:Win32/Bandios, Ransom.Win32.Bandios, and Win32/Bandios) is a crypto-ran...
banz	Ransomware	`3`	Banz (classified in antivirus detection telemetry under designations including Ransom:Win32/Banz, Ransom.Win32.Banz, and Win32/Banz) is a crypto-ransomware desi...
basine	Ransomware	`3`	Basine (classified in antivirus detection telemetry under designations including Ransom:Win32/Basine, Ransom.Win32.Basine, and Win32/Basine) is a crypto-ransomw...
beaugrit	Ransomware	`3`	Beaugrit (classified in antivirus detection telemetry under designations including Ransom:Win32/Beaugrit, Ransom.Win32.Beaugrit, and Win32/Beaugrit) is a crypto...
bebloh	Trojan	`3`	Bebloh (classified in antivirus detection telemetry under designations including Trojan:Win32/Bebloh, Trojan.Win32.Bebloh, and Win32/Bebloh) is a multi-stage tr...
belonard	Ransomware	`3`	Belonard (classified in antivirus detection telemetry under designations including Ransom:Win32/Belonard, Ransom.Win32.Belonard, and Win32/Belonard) is a crypto...
blacked	Ransomware	`3`	Blacked (classified in antivirus detection telemetry under designations including Ransom:Win32/Blacked, Ransom.Win32.Blacked, and Win32/Blacked) is a crypto-ran...
blubot	Ransomware	`3`	Blubot (classified in antivirus detection telemetry under designations including Ransom:Win32/Blubot, Ransom.Win32.Blubot, and Win32/Blubot) is a crypto-ransomw...
boaxxe	Ransomware	`3`	Boaxxe (classified in antivirus detection telemetry under designations including Ransom:Win32/Boaxxe, Ransom.Win32.Boaxxe, and Win32/Boaxxe) is a crypto-ransomw...
cgmu	Ransomware	`3`	Trojan:Win32/Cgmu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
comei	Ransomware	`3`	Trojan:Win32/Comei is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
coolmirage	Ransomware	`3`	Trojan:Win32/Coolmirage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
crastic	Ransomware	`3`	Trojan:Win32/Crastic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
crcf	Ransomware	`3`	Trojan:Win32/Crcf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
ctqc	Ransomware	`3`	Trojan:Win32/Ctqc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
democry	Ransomware	`3`	Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variant...
deshacop	Ransomware	`3`	Trojan:Win32/Deshacop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
diss	Ransomware	`3`	Trojan:Win32/Diss is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
dunco	Ransomware	`3`	Trojan:Win32/Dunco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
dyamar	Ransomware	`3`	Trojan:Win32/Dyamar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
enosch	Ransomware	`3`	Trojan:Win32/Enosch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
eroyee	Ransomware	`3`	Trojan:Win32/Eroyee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
exdek	Ransomware	`3`	Trojan:Win32/Exdek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
exeaqtor	Ransomware	`3`	Trojan:Win32/Exeaqtor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
ezoons	Ransomware	`3`	Trojan:Win32/Ezoons is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
fadok	Ransomware	`3`	Trojan:Win32/Fadok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
fourthrem	Ransomware	`3`	Trojan:Win32/Fourthrem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
gasti	Ransomware	`3`	Trojan:Win32/Gasti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ghoul	Ransomware	`3`	Trojan:Win32/Ghoul is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
glox	Ransomware	`3`	Trojan:Win32/Glox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
goabeny	Ransomware	`3`	Trojan:Win32/Goabeny is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
gottle	Ransomware	`3`	Trojan:Win32/Gottle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hancitor	Ransomware	`3`	TrojanDownloader:Win32/Hancitor (also widely known as Chanitor) is a highly prolific and dangerous Initial Access Broker (IAB) and downloader trojan. It is ...
higuniel	Ransomware	`3`	Trojan:Win32/Higuniel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
hlubea	Ransomware	`3`	Trojan:Win32/Hlubea is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
horst	Ransomware	`3`	Trojan:Win32/Horst is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ilomo	Ransomware	`3`	Trojan:Win32/Ilomo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
jobaka	Ransomware	`3`	Trojan:Win32/Jobaka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
koal	Ransomware	`3`	Trojan:Win32/Koal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
konus	Ransomware	`3`	Trojan:Win32/Konus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
koobcafe	Ransomware	`3`	Trojan:Win32/Koobcafe is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
krunchy	Ransomware	`3`	Trojan:Win32/Krunchy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
lapka	Ransomware	`3`	Trojan:Win32/Lapka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
lenwadu	Ransomware	`3`	Trojan:Win32/Lenwadu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
liev	Ransomware	`3`	Trojan:Win32/Liev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
lipler	Ransomware	`3`	Trojan:Win32/Lipler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
lodbak	Ransomware	`3`	Trojan:Win32/Lodbak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
luder	Ransomware	`3`	Trojan:Win32/Luder is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
macoute	Ransomware	`3`	Trojan:Win32/Macoute is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
maesorn	Ransomware	`3`	Trojan:Win32/Maesorn is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
mdeclass	Ransomware	`3`	Trojan:Win32/Mdeclass is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
msidrop	Ransomware	`3`	Behavior:Win32/Msidrop is a critical Heuristic and Generic Detection applied to malicious Windows Installer (`.msi`) packages. Attackers heavily utilize mal...
mutant	Ransomware	`3`	Trojan:Win32/Mutant is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mycop	Ransomware	`3`	Trojan:Win32/Mycop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
myransom	Ransomware	`3`	Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varian...
myxah	Ransomware	`3`	Trojan:Win32/Myxah is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
nystprac	Ransomware	`3`	Trojan:Win32/Nystprac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
octopus	Ransomware	`3`	Trojan:Win32/Octopus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
opesup	Ransomware	`3`	Trojan:Win32/Opesup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
palibu	Ransomware	`3`	Trojan:Win32/Palibu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
passma	Ransomware	`3`	Trojan:Win32/Passma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
petun	Ransomware	`3`	Trojan:Win32/Petun is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
povertel	Ransomware	`3`	Trojan:Win32/Povertel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
powerless	Ransomware	`3`	Trojan:Win32/Powerless is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
pstinb	Ransomware	`3`	Trojan:Win32/Pstinb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
purgen	Ransomware	`3`	Trojan:Win32/Purgen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
qqfarmer	Ransomware	`3`	Trojan:Win32/Qqfarmer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
randrew	Ransomware	`3`	Trojan:Win32/Randrew is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
redlonam	Ransomware	`3`	Trojan:Win32/Redlonam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
rifdoor	Ransomware	`3`	Trojan:Win32/Rifdoor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
rising	Ransomware	`3`	Trojan:Win32/Rising is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
ruandmel	Ransomware	`3`	Trojan:Win32/Ruandmel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
rukometa	Ransomware	`3`	Trojan:Win32/Rukometa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
sage	Ransomware	`3`	Ransomware:Win32/Sage (specifically known as Sage 2.0) is a highly destructive crypto-ransomware family that gained significant notoriety in early 2017. A varia...
sasquor	Ransomware	`3`	Trojan:Win32/Sasquor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
scano	Ransomware	`3`	Trojan:Win32/Scano is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sdld	Ransomware	`3`	Trojan:Win32/Sdld is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
shepher	Ransomware	`3`	Trojan:Win32/Shepher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
smalo	Ransomware	`3`	Trojan:Win32/Smalo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sperolz	Ransomware	`3`	Trojan:Win32/Sperolz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
suloc	Ransomware	`3`	Trojan:Win32/Suloc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
takbum	Ransomware	`3`	Trojan:Win32/Takbum is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tarctox	Ransomware	`3`	Trojan:Win32/Tarctox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
temr	Ransomware	`3`	Trojan:Win32/Temr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
tenavt	Ransomware	`3`	Trojan:Win32/Tenavt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
therat	Ransomware	`3`	Trojan:Win32/Therat is a persistent, stealthy Remote Access Trojan (RAT) designed to breach endpoint defenses and securely deliver secondary, high-severity payl...
torjok	Ransomware	`3`	Trojan:Win32/Torjok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tovicrypt	Ransomware	`3`	Ransomware:Win32/Tovicrypt is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varia...
tyhos	Ransomware	`3`	Trojan:Win32/Tyhos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ursumdt	Ransomware	`3`	Trojan:Win32/Ursumdt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
uwamson	Ransomware	`3`	Trojan:Win32/Uwamson is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
uztub	Ransomware	`3`	Trojan:Win32/Uztub is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
uztuby	Ransomware	`3`	Trojan:Win32/Uztuby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
veilev	Ransomware	`3`	Trojan:Win32/Veilev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
vkont	Ransomware	`3`	Trojan:Win32/Vkont is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
vucha	Ransomware	`3`	Trojan:Win32/Vucha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
xorala	Ransomware	`3`	Trojan:Win32/Xorala is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
xyligan	Ransomware	`3`	Trojan:Win32/Xyligan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
5hex	Ransomware	`2`	5Hex (classified in antivirus detection telemetry under designations including Ransom:Win32/5Hex, Ransom.Win32.5Hex, and Win32/5Hex) is a crypto-ransomware desi...
agentus	Ransomware	`2`	Agentus (classified in antivirus detection telemetry under designations including Ransom:Win32/Agentus, Ransom.Win32.Agentus, and Win32/Agentus) is a crypto-ran...
alphaeon	Ransomware	`2`	Alphaeon (classified in antivirus detection telemetry under designations including Ransom:Win32/Alphaeon, Ransom.Win32.Alphaeon, and Win32/Alphaeon) is a crypto...
alreay	Ransomware	`2`	Alreay (classified in antivirus detection telemetry under designations including Ransom:Win32/Alreay, Ransom.Win32.Alreay, and Win32/Alreay) is a crypto-ransomw...
aque	Ransomware	`2`	Aque (classified in antivirus detection telemetry under designations including Ransom:Win32/Aque, Ransom.Win32.Aque, and Win32/Aque) is a crypto-ransomware desi...
arhost	Ransomware	`2`	Arhost (classified in antivirus detection telemetry under designations including Ransom:Win32/Arhost, Ransom.Win32.Arhost, and Win32/Arhost) is a crypto-ransomw...
bagsu	Ransomware	`2`	Bagsu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bagsu, Ransom.Win32.Bagsu, and Win32/Bagsu) is a crypto-ransomware ...
bank	Ransomware	`2`	Bank (classified in antivirus detection telemetry under designations including Ransom:Win32/Bank, Ransom.Win32.Bank, and Win32/Bank) is a crypto-ransomware desi...
banspy	Infostealer	`2`	Banspy (classified in antivirus detection telemetry under designations including PWS:Win32/Banspy, PWS.Win32.Banspy, and Win32/Banspy) is a dedicated informatio...
bccrypt	Ransomware	`2`	Bccrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Bccrypt, Ransom.Win32.Bccrypt, and Win32/Bccrypt) is a crypto-ran...
begseabug	Ransomware	`2`	Begseabug (classified in antivirus detection telemetry under designations including Ransom:Win32/Begseabug, Ransom.Win32.Begseabug, and Win32/Begseabug) is a cr...
bisonal	Trojan	`2`	Bisonal (classified in antivirus detection telemetry under designations including Trojan:Win32/Bisonal, Trojan.Win32.Bisonal, and Win32/Bisonal) is a multi-stag...
bluewushu	Ransomware	`2`	Bluewushu (classified in antivirus detection telemetry under designations including Ransom:Win32/Bluewushu, Ransom.Win32.Bluewushu, and Win32/Bluewushu) is a cr...
boopcel	Ransomware	`2`	Boopcel (classified in antivirus detection telemetry under designations including Ransom:Win32/Boopcel, Ransom.Win32.Boopcel, and Win32/Boopcel) is a crypto-ran...
bruhorn	Ransomware	`2`	Bruhorn (classified in antivirus detection telemetry under designations including Ransom:Win32/Bruhorn, Ransom.Win32.Bruhorn, and Win32/Bruhorn) is a crypto-ran...
bustem	Ransomware	`2`	Bustem (classified in antivirus detection telemetry under designations including Ransom:Win32/Bustem, Ransom.Win32.Bustem, and Win32/Bustem) is a crypto-ransomw...
bybz	Ransomware	`2`	Bybz (classified in antivirus detection telemetry under designations including Ransom:Win32/Bybz, Ransom.Win32.Bybz, and Win32/Bybz) is a crypto-ransomware desi...
cakl	Ransomware	`2`	Cakl (classified in antivirus detection telemetry under designations including Ransom:Win32/Cakl, Ransom.Win32.Cakl, and Win32/Cakl) is a crypto-ransomware desi...
capredeam	Ransomware	`2`	Capredeam (classified in antivirus detection telemetry under designations including Ransom:Win32/Capredeam, Ransom.Win32.Capredeam, and Win32/Capredeam) is a cr...
carbanak	Banking Trojan	`2`	Carbanak (also cataloged across international law enforcement and intelligence communities as Anunak) is an elite, multi-million dollar cyber heist malware fram...
cdvq	Ransomware	`2`	Cdvq (classified in antivirus detection telemetry under designations including Ransom:Win32/Cdvq, Ransom.Win32.Cdvq, and Win32/Cdvq) is a crypto-ransomware desi...
ceckno	Ransomware	`2`	Ceckno (classified in antivirus detection telemetry under designations including Ransom:Win32/Ceckno, Ransom.Win32.Ceckno, and Win32/Ceckno) is a crypto-ransomw...
chanitor	Ransomware	`2`	Trojan:Win32/Chanitor (also widely tracked as Hancitor) is a notorious, highly active trojan downloader. Its sole purpose is to serve as the initial infecti...
chekafev	Ransomware	`2`	Trojan:Win32/Chekafev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
chistudi	Ransomware	`2`	Trojan:Win32/Chistudi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
chupik	Ransomware	`2`	Trojan:Win32/Chupik is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
cloverplus	Ransomware	`2`	Trojan:Win32/Cloverplus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
coantor	Ransomware	`2`	Trojan:Win32/Coantor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
cobra	Ransomware	`2`	Trojan:Win32/Cobra is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
codewall	Ransomware	`2`	Trojan:Win32/Codewall is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
comisproc	Ransomware	`2`	Trojan:Win32/Comisproc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
confucius	Trojan	`2`	Trojan:Win32/Confucius is a specialized espionage trojan and backdoor associated with the 'Confucius' Advanced Persistent Threat (APT) group (often linked to So...
cordis	Ransomware	`2`	Trojan:Win32/Cordis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
crime	Ransomware	`2`	Trojan:Win32/Crime is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
crisisht	Ransomware	`2`	Trojan:Win32/Crisisht is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
crypt0l0cker	Ransomware	`2`	Ransomware:Win32/Crypt0l0cker is a highly destructive ransomware variant, often considered a direct clone or spiritual successor to the original, infamous Crypt...
dacic	Ransomware	`2`	Trojan:Win32/Dacic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
darkneuron	Ransomware	`2`	Trojan:Win32/Darkneuron is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
davobevix	Ransomware	`2`	Trojan:Win32/Davobevix is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
dazi	Ransomware	`2`	Trojan:Win32/Dazi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
deliric	Ransomware	`2`	Trojan:Win32/Deliric is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
delpem	Ransomware	`2`	Trojan:Win32/Delpem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
desurou	Ransomware	`2`	Trojan:Win32/Desurou is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
detplock	Ransomware	`2`	Trojan:Win32/Detplock is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
downloaderb	Ransomware	`2`	Trojan:Win32/Downloaderb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
droma	Ransomware	`2`	Trojan:Win32/Droma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ekisoli	Ransomware	`2`	Trojan:Win32/Ekisoli is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
eszjuxuan	Ransomware	`2`	Trojan:Win32/Eszjuxuan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
etap	Ransomware	`2`	Trojan:Win32/Etap is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
facemoi	Ransomware	`2`	Trojan:Win32/Facemoi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
famvt	Ransomware	`2`	Trojan:Win32/Famvt is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
fasem	Ransomware	`2`	Trojan:Win32/Fasem is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
fdoh	Ransomware	`2`	Trojan:Win32/Fdoh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
fearso	Ransomware	`2`	Trojan:Win32/Fearso is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
flawedammyy	Ransomware	`2`	Backdoor:Win32/Flawedammyy is a highly prevalent Remote Access Trojan (RAT) that gained massive notoriety due to its heavy deployment by the cybercriminal syndi...
gamaredon	Trojan	`2`	Trojan:Win32/Gamaredon (also tracked as Actinium, Shuckworm, or Primitive Bear) represents the malware ecosystem of a highly active Advanced Persistent Threat (...
gena	Ransomware	`2`	Trojan:Win32/Gena is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
genasep	Ransomware	`2`	Trojan:Win32/Genasep is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
genericrxca	Ransomware	`2`	Trojan:Win32/Genericrxca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxdm	Ransomware	`2`	Trojan:Win32/Genericrxdm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxeq	Ransomware	`2`	Trojan:Win32/Genericrxeq is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxfq	Ransomware	`2`	Trojan:Win32/Genericrxfq is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxft	Ransomware	`2`	Trojan:Win32/Genericrxft is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxfv	Ransomware	`2`	Trojan:Win32/Genericrxfv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxgj	Ransomware	`2`	Trojan:Win32/Genericrxgj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genx	Ransomware	`2`	Trojan:Win32/Genx is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
gojdu	Ransomware	`2`	Trojan:Win32/Gojdu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
goppel	Ransomware	`2`	Trojan:Win32/Goppel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hallaj	Ransomware	`2`	Trojan:Win32/Hallaj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
harnig	Ransomware	`2`	Trojan:Win32/Harnig is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hbov	Ransomware	`2`	Trojan:Win32/Hbov is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
homles	Ransomware	`2`	Trojan:Win32/Homles is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hostwack	Ransomware	`2`	Trojan:Win32/Hostwack is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
hpgen	Ransomware	`2`	Trojan:Win32/Hpgen is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
hrup	Ransomware	`2`	Trojan:Win32/Hrup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
isnev	Ransomware	`2`	Trojan:Win32/Isnev is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
isof	Ransomware	`2`	Trojan:Win32/Isof is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
itva	Ransomware	`2`	Trojan:Win32/Itva is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
jbomi	Ransomware	`2`	Trojan:Win32/Jbomi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
jyfi	Ransomware	`2`	Trojan:Win32/Jyfi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
kate	Ransomware	`2`	Trojan:Win32/Kate is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
keyboy	Trojan	`2`	Backdoor:Win32/Keyboy is a sophisticated Remote Access Trojan (RAT) and backdoor heavily utilized by Chinese-speaking Advanced Persistent Threat (APT) groups, m...
kovloer	Ransomware	`2`	Trojan:Win32/Kovloer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
krolol	Ransomware	`2`	Trojan:Win32/Krolol is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
leymo	Ransomware	`2`	Trojan:Win32/Leymo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
lightsee	Ransomware	`2`	Trojan:Win32/Lightsee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
lojulox	Ransomware	`2`	Trojan:Win32/Lojulox is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
ludicrouz	Ransomware	`2`	Trojan:Win32/Ludicrouz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
macrodrop	Ransomware	`2`	TrojanDownloader:O97M/Macrodrop is a highly prevalent category of malware that utilizes weaponized Microsoft Office macros (VBA code) to establish an initial fo...
malushka	Ransomware	`2`	Trojan:Win32/Malushka is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
manbat	Ransomware	`2`	Trojan:Win32/Manbat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mantana	Ransomware	`2`	Trojan:Win32/Mantana is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
matsnu	Ransomware	`2`	Trojan:Win32/Matsnu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
metel	Trojan	`2`	Trojan:Win32/Metel (also known as Corkow) is a highly sophisticated, multi-stage Banking Trojan and APT-style framework that achieved massive notoriety in 2015 ...
mimilove	Ransomware	`2`	Trojan:Win32/Mimilove is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
minggy	Ransomware	`2`	Trojan:Win32/Minggy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
moljec	Ransomware	`2`	Trojan:Win32/Moljec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mresmon	Ransomware	`2`	Trojan:Win32/Mresmon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
msilinj	Trojan	`2`	Trojan:MSIL/Msilinj (often denoting a Microsoft Intermediate Language Injector) is a specific detection for a loader or 'crypter' written in the .NET framework ...
msposer	Ransomware	`2`	Trojan:Win32/Msposer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
murlo	Ransomware	`2`	Trojan:Win32/Murlo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
narcha	Ransomware	`2`	Trojan:Win32/Narcha is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
nebuler	Ransomware	`2`	Trojan:Win32/Nebuler is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
necurs	Spam Bot	`2`	Botnet:Win32/Necurs was one of the largest, most pervasive botnet infrastructures in cybercrime history, comprising over 9 million compromised computers across ...
nosok	Ransomware	`2`	Trojan:Win32/Nosok is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
nscauth	Ransomware	`2`	Trojan:Win32/Nscauth is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
offend	Ransomware	`2`	Trojan:Win32/Offend is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
oficla	Trojan	`2`	Trojan:Win32/Oficla (also widely known as Sasfis) is a historically massive botnet and trojan downloader that peaked in activity between 2010 and 2012. Its prim...
olala	Ransomware	`2`	Trojan:Win32/Olala is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
oligo	Ransomware	`2`	Trojan:Win32/Oligo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
outbreak	Ransomware	`2`	Trojan:Win32/Outbreak is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
pacex	Ransomware	`2`	Trojan:Win32/Pacex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
perkesh	Ransomware	`2`	Trojan:Win32/Perkesh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
pfoenic	Ransomware	`2`	Trojan:Win32/Pfoenic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
pieshua	Ransomware	`2`	Trojan:Win32/Pieshua is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
piker	Ransomware	`2`	Trojan:Win32/Piker is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
pincher	Ransomware	`2`	Trojan:Win32/Pincher is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
plimrost	Ransomware	`2`	Trojan:Win32/Plimrost is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
pophot	Ransomware	`2`	Trojan:Win32/Pophot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
pramro	Ransomware	`2`	Trojan:Win32/Pramro is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
psyokym	Ransomware	`2`	Trojan:Win32/Psyokym is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
quchispy	Ransomware	`2`	Trojan:Win32/Quchispy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
rapkill	Ransomware	`2`	Trojan:Win32/Rapkill is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
refpron	Ransomware	`2`	Trojan:Win32/Refpron is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
remas	Ransomware	`2`	Trojan:Win32/Remas is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
renaz	Ransomware	`2`	Trojan:Win32/Renaz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rifbu	Ransomware	`2`	Trojan:Win32/Rifbu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rofin	Ransomware	`2`	Trojan:Win32/Rofin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ruby	Ransomware	`2`	Trojan:Win32/Ruby is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
ructo	Ransomware	`2`	Trojan:Win32/Ructo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rukoma	Ransomware	`2`	Trojan:Win32/Rukoma is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
ryzerlo	Ransomware	`2`	Trojan:Win32/Ryzerlo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
selltim	Ransomware	`2`	Trojan:Win32/Selltim is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
seodec	Ransomware	`2`	Trojan:Win32/Seodec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
sheldor	Ransomware	`2`	Trojan:Win32/Sheldor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
shrejh	Ransomware	`2`	Trojan:Win32/Shrejh is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
shufab	Ransomware	`2`	Trojan:Win32/Shufab is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
silcon	Ransomware	`2`	Trojan:Win32/Silcon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
slipafext	Ransomware	`2`	Trojan:Win32/Slipafext is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
snoload	Ransomware	`2`	TrojanDownloader:Win32/Snoload is a stealthy, first-stage downloader designed specifically to establish a foothold on a compromised system and securely retrieve...
sorcurat	Ransomware	`2`	Trojan:Win32/Sorcurat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
soul	Ransomware	`2`	Trojan:Win32/Soul is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
ssebot	Ransomware	`2`	Trojan:Win32/Ssebot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
sysdrop	Ransomware	`2`	Trojan:Win32/Sysdrop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
tarifarch	Ransomware	`2`	Trojan:Win32/Tarifarch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
teamspy	Backdoor	`2`	Backdoor:Win32/Teamspy (also known as TeamSpy Crew or 'The TeamSpy Operation') is a highly sophisticated cyber-espionage toolkit (APT). Its defining characteris...
tirrip	Ransomware	`2`	Trojan:Win32/Tirrip is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tnega	Ransomware	`2`	Trojan:Win32/Tnega is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
toauta	Ransomware	`2`	Trojan:Win32/Toauta is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
togapy	Ransomware	`2`	Trojan:Win32/Togapy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
torr	Ransomware	`2`	Trojan:Win32/Torr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
trabin	Ransomware	`2`	Trojan:Win32/Trabin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
trafog	Ransomware	`2`	Trojan:Win32/Trafog is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
trojanbanker	Ransomware	`2`	Trojan:Win32/TrojanBanker is a broad classification encompassing some of the most sophisticated and financially damaging malware in existence (including familie...
tulong	Ransomware	`2`	Trojan:Win32/Tulong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tvido	Ransomware	`2`	Trojan:Win32/Tvido is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
typic	Ransomware	`2`	Trojan:Win32/Typic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
tzabf	Ransomware	`2`	Trojan:Win32/Tzabf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ufraie	Ransomware	`2`	Trojan:Win32/Ufraie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
uloader	Ransomware	`2`	Trojan:Win32/Uloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
utoti	Ransomware	`2`	Trojan:Win32/Utoti is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
vake	Ransomware	`2`	Trojan:Win32/Vake is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
vbcheman	Ransomware	`2`	Trojan:Win32/Vbcheman is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
vedpoz	Ransomware	`2`	Trojan:Win32/Vedpoz is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
virtum	Ransomware	`2`	Trojan:Win32/Virtum is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
virtumod	Ransomware	`2`	Trojan:Win32/Virtumod is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
vkdj	Ransomware	`2`	Trojan:Win32/Vkdj is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
webhat	Ransomware	`2`	Trojan:Win32/Webhat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
wemosis	Ransomware	`2`	Trojan:Win32/Wemosis is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
wiliky	Ransomware	`2`	Trojan:Win32/Wiliky is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
windapp	Ransomware	`2`	Trojan:Win32/Windapp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
writos	Ransomware	`2`	Trojan:Win32/Writos is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
xanfpezes	Ransomware	`2`	Trojan:Win32/Xanfpezes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
xdisccorp	Ransomware	`2`	Trojan:Win32/Xdisccorp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
xiaoba	Ransomware	`2`	Trojan:Win32/Xiaoba is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
xiquitir	Ransomware	`2`	Trojan:Win32/Xiquitir is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
xpun	Ransomware	`2`	Trojan:Win32/Xpun is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
xxyheo	Ransomware	`2`	Trojan:Win32/Xxyheo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
yobdam	Ransomware	`2`	Trojan:Win32/Yobdam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
zapinit	Ransomware	`2`	Trojan:Win32/Zapinit is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
zeleffo	Ransomware	`2`	Trojan:Win32/Zeleffo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
zjaisino	Ransomware	`2`	Trojan:Win32/Zjaisino is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
agile	Ransomware	`1`	Agile (classified in antivirus detection telemetry under designations including Ransom:Win32/Agile, Ransom.Win32.Agile, and Win32/Agile) is a crypto-ransomware ...
akely	Ransomware	`1`	Akely (classified in antivirus detection telemetry under designations including Ransom:Win32/Akely, Ransom.Win32.Akely, and Win32/Akely) is a crypto-ransomware ...
arload	Ransomware	`1`	Arload (classified in antivirus detection telemetry under designations including Ransom:Win32/Arload, Ransom.Win32.Arload, and Win32/Arload) is a crypto-ransomw...
artel	Ransomware	`1`	Artel (classified in antivirus detection telemetry under designations including Ransom:Win32/Artel, Ransom.Win32.Artel, and Win32/Artel) is a crypto-ransomware ...
autophyte	Trojan	`1`	Autophyte (classified in antivirus detection telemetry under designations including Trojan:Win32/Autophyte, Trojan.Win32.Autophyte, and Win32/Autophyte) is a mu...
axbn	Ransomware	`1`	Axbn (classified in antivirus detection telemetry under designations including Ransom:Win32/Axbn, Ransom.Win32.Axbn, and Win32/Axbn) is a crypto-ransomware desi...
azero	Ransomware	`1`	Azero (classified in antivirus detection telemetry under designations including Ransom:Win32/Azero, Ransom.Win32.Azero, and Win32/Azero) is a crypto-ransomware ...
bagif	Ransomware	`1`	Bagif (classified in antivirus detection telemetry under designations including Ransom:Win32/Bagif, Ransom.Win32.Bagif, and Win32/Bagif) is a crypto-ransomware ...
bancobras	Trojan	`1`	Bancobras (classified in antivirus detection telemetry under designations including Trojan:Win32/Bancobras, Trojan.Win32.Bancobras, and Win32/Bancobras) is a mu...
bankfraud	Trojan	`1`	Bankfraud (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankfraud, Trojan.Win32.Bankfraud, and Win32/Bankfraud) is a mu...
bankoren	Trojan	`1`	Bankoren (classified in antivirus detection telemetry under designations including Trojan:Win32/Bankoren, Trojan.Win32.Bankoren, and Win32/Bankoren) is a multi-...
baryumka	Ransomware	`1`	Baryumka (classified in antivirus detection telemetry under designations including Ransom:Win32/Baryumka, Ransom.Win32.Baryumka, and Win32/Baryumka) is a crypto...
betkrypt	Ransomware	`1`	Betkrypt (classified in antivirus detection telemetry under designations including Ransom:Win32/Betkrypt, Ransom.Win32.Betkrypt, and Win32/Betkrypt) is a crypto...
bitter	Trojan	`1`	Bitter (classified in antivirus detection telemetry under designations including Trojan:Win32/Bitter, Trojan.Win32.Bitter, and Win32/Bitter) is a multi-stage tr...
blacoleref	Ransomware	`1`	Blacoleref (classified in antivirus detection telemetry under designations including Ransom:Win32/Blacoleref, Ransom.Win32.Blacoleref, and Win32/Blacoleref) is ...
blind	Ransomware	`1`	Blind (classified in antivirus detection telemetry under designations including Ransom:Win32/Blind, Ransom.Win32.Blind, and Win32/Blind) is a crypto-ransomware ...
blueeagle	Ransomware	`1`	Blueeagle (classified in antivirus detection telemetry under designations including Ransom:Win32/Blueeagle, Ransom.Win32.Blueeagle, and Win32/Blueeagle) is a cr...
bredavi	Ransomware	`1`	Bredavi (classified in antivirus detection telemetry under designations including Ransom:Win32/Bredavi, Ransom.Win32.Bredavi, and Win32/Bredavi) is a crypto-ran...
brobaneup	Ransomware	`1`	Brobaneup (classified in antivirus detection telemetry under designations including Ransom:Win32/Brobaneup, Ransom.Win32.Brobaneup, and Win32/Brobaneup) is a cr...
broduplo	Ransomware	`1`	Broduplo (classified in antivirus detection telemetry under designations including Ransom:Win32/Broduplo, Ransom.Win32.Broduplo, and Win32/Broduplo) is a crypto...
bsdownloader	Trojan Downloader	`1`	Bsdownloader (classified in antivirus detection telemetry under designations including TrojanDownloader:Win32/Bsdownloader, TrojanDownloader.Win32.Bsdownloader,...
buhtrap	Ransomware	`1`	Buhtrap (classified in antivirus detection telemetry under designations including Ransom:Win32/Buhtrap, Ransom.Win32.Buhtrap, and Win32/Buhtrap) is a crypto-ran...
busky	Ransomware	`1`	Busky (classified in antivirus detection telemetry under designations including Ransom:Win32/Busky, Ransom.Win32.Busky, and Win32/Busky) is a crypto-ransomware ...
bwod	Ransomware	`1`	Bwod (classified in antivirus detection telemetry under designations including Ransom:Win32/Bwod, Ransom.Win32.Bwod, and Win32/Bwod) is a crypto-ransomware desi...
cafecup	Ransomware	`1`	Cafecup (classified in antivirus detection telemetry under designations including Ransom:Win32/Cafecup, Ransom.Win32.Cafecup, and Win32/Cafecup) is a crypto-ran...
cbot	Ransomware	`1`	Cbot (classified in antivirus detection telemetry under designations including Ransom:Win32/Cbot, Ransom.Win32.Cbot, and Win32/Cbot) is a crypto-ransomware desi...
cebot	Ransomware	`1`	Cebot (classified in antivirus detection telemetry under designations including Ransom:Win32/Cebot, Ransom.Win32.Cebot, and Win32/Cebot) is a crypto-ransomware ...
chepdu	Ransomware	`1`	Trojan:Win32/Chepdu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
cleaman	Ransomware	`1`	Trojan:Win32/Cleaman is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
clhf	Ransomware	`1`	TrojanDownloader:Win32/Clhf is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a backdo...
cosratu	Ransomware	`1`	Trojan:Win32/Cosratu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
cridex	Trojan	`1`	<h3>Executive Summary</h3> Cridex is a highly influential banking trojan and worm that emerged in 2011, notorious for being the direct predecessor to the devast...
crifi	Ransomware	`1`	Trojan:Win32/Crifi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
crispit	Ransomware	`1`	Trojan:Win32/Crispit is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
csom	Ransomware	`1`	Trojan:Win32/Csom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
cypress	Ransomware	`1`	Trojan:Win32/Cypress is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
dalbot	Ransomware	`1`	Trojan:Win32/Dalbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
darkhotel	Backdoor	`1`	Backdoor:Win32/Darkhotel is an advanced, highly surgical cyber-espionage threat campaign and modular backdoor active since at least 2007, first publicly reveale...
datper	Ransomware	`1`	Trojan:Win32/Datper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
defmid	Ransomware	`1`	Trojan:Win32/Defmid is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
doqv	Ransomware	`1`	Trojan:Win32/Doqv is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
drefir	Ransomware	`1`	Trojan:Win32/Drefir is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
drowor	Ransomware	`1`	Trojan:Win32/Drowor is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
dupate	Ransomware	`1`	Trojan:Win32/Dupate is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
elite	Ransomware	`1`	<h3>Executive Summary</h3> Elite is a classification commonly associated with highly destructive ransomware variants (often adopting the "Elite" moniker in thei...
emotetn	Ransomware	`1`	<h3>Executive Summary</h3> EmotetN represents a specific detection signature or component variant of the notorious Emotet malware family. Originally designed as...
esprot	Ransomware	`1`	Trojan:Win32/Esprot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
estapa	Ransomware	`1`	Trojan:Win32/Estapa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
excrevie	Ransomware	`1`	Trojan:Win32/Excrevie is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
farsistall	Ransomware	`1`	Trojan:Win32/Farsistall is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
fayu	Ransomware	`1`	Trojan:Win32/Fayu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
feebs	Trojan	`1`	<h3>Executive Summary</h3> Feebs is a highly destructive and self-replicating polymorphic Worm and Trojan that gained significant notoriety in the mid-2000s. De...
fgarb	Ransomware	`1`	Trojan:Win32/Fgarb is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
figyek	Ransomware	`1`	Trojan:Win32/Figyek is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
filoskeed	Ransomware	`1`	Trojan:Win32/Filoskeed is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
flowershop	Ransomware	`1`	Trojan:Win32/Flowershop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
flusihoc	Ransomware	`1`	Trojan:Win32/Flusihoc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
flystudi	Ransomware	`1`	Trojan:Win32/Flystudi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
forbot	Ransomware	`1`	Trojan:Win32/Forbot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
foxhiex	Ransomware	`1`	Trojan:Win32/Foxhiex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
genericrxam	Ransomware	`1`	Trojan:Win32/Genericrxam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
genericrxfo	Ransomware	`1`	Trojan:Win32/Genericrxfo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
gibe	Advanced Threat	`1`	<h3>Executive Summary</h3> Gibe (also known as Swen or Gibe.F) is a highly deceptive mass-mailing computer worm that gained notoriety in the early 2000s. It dif...
goodpic	Ransomware	`1`	Trojan:Win32/Goodpic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
graybird	Ransomware	`1`	Trojan:Win32/Graybird is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
hamaetot	Ransomware	`1`	Trojan:Win32/Hamaetot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
happy	Ransomware	`1`	Trojan:Win32/Happy is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
headache	Ransomware	`1`	Trojan:Win32/Headache is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
hexloader	Ransomware	`1`	Trojan:Win32/Hexloader is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
hexzone	Ransomware	`1`	Trojan:Win32/Hexzone is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
hkmain	Ransomware	`1`	Trojan:Win32/Hkmain is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
hokobot	Ransomware	`1`	Trojan:Win32/Hokobot is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
ident	Ransomware	`1`	Trojan:Win32/Ident is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
jatif	Ransomware	`1`	Trojan:Win32/Jatif is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
jhee	Ransomware	`1`	Trojan:Win32/Jhee is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
jobcrypter	Ransomware	`1`	<h3>Executive Summary</h3> JobCrypter is a destructive Ransomware family designed to extort financial payment from victims by encrypting their critical data. It...
juntador	Trojan	`1`	<h3>Executive Summary</h3> Juntador is not a traditional standalone malware family, but rather a specific classification for a "Binder" or "Joiner" utility. The...
karius	Ransomware	`1`	Trojan:Win32/Karius is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
kazus	Ransomware	`1`	Trojan:Win32/Kazus is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
killnotes	Ransomware	`1`	Trojan:Win32/Killnotes is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
konni	Trojan	`1`	<h3>Executive Summary</h3> Konni is a sophisticated Remote Access Trojan (RAT) and the namesake of the Advanced Persistent Threat (APT) group that wields it. Th...
krament	Ransomware	`1`	Trojan:Win32/Krament is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
krdr	Ransomware	`1`	Trojan:Win32/Krdr is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
kryptpck	Ransomware	`1`	<h3>Executive Summary</h3> Kryptpck (often a variant identifier for Cryptolocker-style ransomware or generic heavily packed ransomware) is a highly destructive ...
kykymber	Ransomware	`1`	Trojan:Win32/Kykymber is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
ledruppi	Ransomware	`1`	Trojan:Win32/Ledruppi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
leopard	Ransomware	`1`	Trojan:Win32/Leopard is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
lightmoon	Ransomware	`1`	Trojan:Win32/Lightmoon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
liimpact	Ransomware	`1`	Trojan:Win32/Liimpact is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
lockyc	Ransomware	`1`	<h3>Executive Summary</h3> Lockyc (often detected as a direct variant or sophisticated copycat of the infamous Locky ransomware) is a highly destructive malware...
loveletter	Ransomware	`1`	<h3>Executive Summary</h3> Loveletter (infamously known as the "ILOVEYOU" bug) is a historic, highly destructive mass-mailing worm that caused catastrophic glob...
luna	Ransomware	`1`	Trojan:Win32/Luna is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
lyckriks	Ransomware	`1`	Trojan:Win32/Lyckriks is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
machaer	Ransomware	`1`	Trojan:Win32/Machaer is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
magnat	Ransomware	`1`	Trojan:Win32/Magnat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
magni	Ransomware	`1`	Trojan:Win32/Magni is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
malmaker	Ransomware	`1`	<h3>Executive Summary</h3> "Malmaker" (often flagged as HackTool.Malmaker or Riskware.MalwareBuilder) is not a specific malware family, but a detection classifi...
mamianune	Ransomware	`1`	Trojan:Win32/Mamianune is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
meinhudong	Ransomware	`1`	Trojan:Win32/Meinhudong is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
mezzo	Ransomware	`1`	Trojan:Win32/Mezzo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
minimal	Ransomware	`1`	TrojanDownloader:Win32/Minimal is a specialized, highly compact trojan designed to breach endpoint defenses and securely deliver secondary payloads. True to its...
mirkov	Ransomware	`1`	Trojan:Win32/Mirkov is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mofin	Ransomware	`1`	Trojan:Win32/Mofin is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
mosu	Ransomware	`1`	Trojan:Win32/Mosu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
mrdec	Ransomware	`1`	Trojan:Win32/Mrdec is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
multim	Ransomware	`1`	Trojan:Win32/Multim is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
mutuodo	Ransomware	`1`	Trojan:Win32/Mutuodo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
mytob	Backdoor	`1`	<h3>Executive Summary</h3> Mytob is a highly prolific and historically significant mass-mailing worm and botnet agent that first emerged in the mid-2000s. Based...
nabasa	Ransomware	`1`	Trojan:Win32/Nabasa is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
naco	Ransomware	`1`	Trojan:Win32/Naco is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
nadrac	Ransomware	`1`	Trojan:Win32/Nadrac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
nbcont	Ransomware	`1`	Trojan:Win32/Nbcont is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
negasteal	Trojan	`1`	<h3>Executive Summary</h3> NegaSteal is a sophisticated Information Stealer (InfoStealer) and credential harvesting trojan. Often sold as Malware-as-a-Service (...
nemucod	Ransomware	`1`	TrojanDownloader:JS/Nemucod (or VBS/Nemucod) is one of the most prolific and historically significant malware downloaders. Primarily distributed via massive spa...
netinject	Ransomware	`1`	Trojan:Win32/Netinject is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
ngvck	Ransomware	`1`	Trojan:Win32/Ngvck is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
nyxem	Advanced Threat	`1`	<h3>Executive Summary</h3> Nyxem (widely known as Kama Sutra, Blackmal, or MyWife) is a highly destructive mass-mailing computer worm that gained global infamy ...
oceanlotus	Backdoor	`1`	<h3>Executive Summary</h3> OceanLotus (also widely known as APT32 or Canvas Assassin) is a highly sophisticated Advanced Persistent Threat (APT) group believed ...
ocna	Ransomware	`1`	Trojan:Win32/Ocna is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
offtoup	Ransomware	`1`	Trojan:Win32/Offtoup is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
otezinu	Ransomware	`1`	Trojan:Win32/Otezinu is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
oztar	Ransomware	`1`	Trojan:Win32/Oztar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
pandview	Ransomware	`1`	Trojan:Win32/Pandview is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
pantera	Ransomware	`1`	Trojan:Win32/Pantera is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
pgpsnippet	Ransomware	`1`	Trojan:Win32/Pgpsnippet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransom...
pikachu	Advanced Threat	`1`	<h3>Executive Summary</h3> The Pikachu Worm (often detected as W32/Pikachu.worm) is a classic, early-2000s mass-mailing computer worm designed to appeal to chil...
pizchao	Ransomware	`1`	Trojan:Win32/Pizchao is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
ploprolo	Ransomware	`1`	Trojan:Win32/Ploprolo is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
potao	Trojan	`1`	<h3>Executive Summary</h3> Potao (also known as Potao Express) is a highly targeted espionage Trojan and Custom Backdoor frequently attributed to nation-state l...
primawega	Ransomware	`1`	Trojan:Win32/Primawega is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
pushel	Ransomware	`1`	Trojan:Win32/Pushel is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
putabmow	Ransomware	`1`	Trojan:Win32/Putabmow is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
qqmima	Ransomware	`1`	Trojan:Win32/Qqmima is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
quervar	Ransomware	`1`	Trojan:Win32/Quervar is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
quireap	Ransomware	`1`	Trojan:Win32/Quireap is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
rarmal	Ransomware	`1`	Trojan:Win32/Rarmal is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
rastabaf	Ransomware	`1`	Trojan:Win32/Rastabaf is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
ravs	Ransomware	`1`	Trojan:Win32/Ravs is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
redneck	Ransomware	`1`	Trojan:Win32/Redneck is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
regub	Ransomware	`1`	Trojan:Win32/Regub is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rimic	Ransomware	`1`	Trojan:Win32/Rimic is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rogan	Ransomware	`1`	Trojan:Win32/Rogan is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
rubat	Ransomware	`1`	Trojan:Win32/Rubat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
ruho	Ransomware	`1`	Trojan:Win32/Ruho is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
rupttass	Ransomware	`1`	Trojan:Win32/Rupttass is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
sadenav	Ransomware	`1`	Trojan:Win32/Sadenav is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
sagonaire	Ransomware	`1`	Trojan:Win32/Sagonaire is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
scarcruft	Trojan	`1`	<h3>Executive Summary</h3> ScarCruft (also known widely as APT37, Reaper, or Group123) is a highly capable, state-sponsored Advanced Persistent Threat (APT) gro...
shaskooth	Ransomware	`1`	Trojan:Win32/Shaskooth is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
simple	Ransomware	`1`	Trojan:Win32/Simple is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
sipia	Ransomware	`1`	Trojan:Win32/Sipia is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
sixmuch	Ransomware	`1`	Trojan:Win32/Sixmuch is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
sminager	Ransomware	`1`	Trojan:Win32/Sminager is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
smuatemisagi	Ransomware	`1`	Trojan:Win32/Smuatemisagi is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like rans...
snorm	Ransomware	`1`	Trojan:Win32/Snorm is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
snow	Ransomware	`1`	<h3>Executive Summary</h3> Snow (often associated with the Snow Ransomware family or a specific Trojan downloader) is a malicious threat designed to infiltrate ...
stercogs	Ransomware	`1`	Trojan:Win32/Stercogs is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
strictorcrtd	Ransomware	`1`	Trojan:Win32/Strictorcrtd is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like rans...
suite	Ransomware	`1`	Trojan:Win32/Suite is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
syscon	Ransomware	`1`	Trojan:Win32/Syscon is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
temcac	Ransomware	`1`	Trojan:Win32/Temcac is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
terkcop	Ransomware	`1`	Trojan:Win32/Terkcop is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
thoper	Ransomware	`1`	Trojan:Win32/Thoper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
tinydl	Ransomware	`1`	TrojanDownloader:Win32/Tinydl is a specialized, highly compact trojan designed to breach endpoint defenses and securely deliver secondary payloads. True to its ...
tipp	Ransomware	`1`	Trojan:Win32/Tipp is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
tougle	Ransomware	`1`	Trojan:Win32/Tougle is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
travnet	Trojan	`1`	<h3>Executive Summary</h3> TravNet (also widely tracked as NetTraveler) is a sophisticated Remote Access Trojan (RAT) and information-stealing framework heavily...
trpctrooper	Ransomware	`1`	Trojan:Win32/Trpctrooper is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ranso...
ursnifdropper	Trojan	`1`	<h3>Executive Summary</h3> UrsnifDropper is a specialized, first-stage Trojan designed explicitly to facilitate the delivery and execution of the notorious Ursn...
valcaryx	Ransomware	`1`	Trojan:Win32/Valcaryx is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwa...
vbcode	Ransomware	`1`	<h3>Executive Summary</h3> VBCode is a general classification given to malicious scripts or Trojans written entirely or predominantly in Visual Basic Script (VB...
verecno	Ransomware	`1`	Trojan:Win32/Verecno is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
vidar	Infostealer	`1`	Trojan:Win32/Vidar (commercially marketed as Vidar Stealer) is a prolific, commercially available information-stealing trojan first observed on underground Russ...
vixenpanda	Backdoor	`1`	<h3>Executive Summary</h3> Vixen Panda (also widely tracked by the cybersecurity community as APT15, Ke3chang, and Playful Dragon) is a highly sophisticated, st...
vopackage	Ransomware	`1`	Trojan:Win32/Vopackage is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomw...
vxidl	Advanced Threat	`1`	<h3>Executive Summary</h3> Vxidl (often detected as VBS/Vxidl or Virus.VBS.Vxidl) is a classification for legacy script-based viruses and worms, typically writt...
weenloc	Ransomware	`1`	Trojan:Win32/Weenloc is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
werpoapt	Backdoor	`1`	<h3>Executive Summary</h3> WerpoAPT is a sophisticated Advanced Persistent Threat (APT) group and associated malware framework characterized by highly targeted ...
winemm	Ransomware	`1`	TrojanDownloader:Win32/Winemm is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a back...
winner	Ransomware	`1`	Trojan:Win32/Winner is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
wmfap	Advanced Threat	`1`	Exploit:Win32/Wmfap denotes a malicious file specifically crafted to exploit a critical, historic vulnerability in the Windows Metafile (WMF) format (most notab...
wombat	Ransomware	`1`	Trojan:Win32/Wombat is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
wraut	Ransomware	`1`	Trojan:Win32/Wraut is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
wuca	Ransomware	`1`	Trojan:Win32/Wuca is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
wuji	Ransomware	`1`	Trojan:Win32/Wuji is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
xihet	Ransomware	`1`	Trojan:Win32/Xihet is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
xorpix	Ransomware	`1`	Trojan:Win32/Xorpix is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
zacom	Ransomware	`1`	Trojan:Win32/Zacom is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
zbiw	Ransomware	`1`	Trojan:Win32/Zbiw is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware, ...
zepto	Ransomware	`1`	<h3>Executive Summary</h3> Zepto is a highly destructive ransomware variant that gained massive notoriety in mid-2016. It is a direct evolution (and effectively...
zloyfly	Ransomware	`1`	Trojan:Win32/Zloyfly is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomwar...
zombam	Ransomware	`1`	Trojan:Win32/Zombam is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware...
zorex	Ransomware	`1`	Trojan:Win32/Zorex is a persistent, stealthy trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads like ransomware,...
zxrloader	Ransomware	`1`	TrojanDownloader:Win32/Zxrloader is a specialized trojan designed to breach endpoint defenses and securely deliver secondary, high-severity payloads. Unlike a b...
vbs_worm_generator	Worm	`Sampled`	VBS Worm Generator (widely known as VBSWG and documented in security records as Worm.VBSWG or VBS Worm Generator by [K]Alamar) is an infamous malware constructi...