Malware Encyclopedia

Understand malware families: behavior, detection, and prevention.

• Agent Tesla Keylogger + info stealer
• Akira Ransomware Windows & ESXi; double extortion
• Amadey Bot Loader botnet for follow-on malware
• Andromeda Bot Loader botnet
• Agenda Ransomware RaaS (Qilin branch)
• Anubis Banking Trojan Android banking credentials
• Ares RAT Open-source remote access trojan
• Astaroth Malware Loader with anti-AV techniques
• AsyncRAT Windows remote surveillance
• Aurora Stealer Info stealer
• BazarLoader Initial-access loader (Wizard Spider)
• Bifrost RAT Linux/Windows backdoor
• BitPaymer Ransomware Targeted enterprise ransomware
• Black Basta Ransomware Critical infrastructure and enterprises; double extortion
• Black RAT Multi-purpose RAT
• BlackByte Ransomware RaaS double extortion
• BlackCat (ALPHV) Ransomware Multi-platform (Windows/Linux/ESXi); Rust-written ransomware
• BlackMatter Ransomware RaaS double extortion
• BlackRock Banking Trojan Android banking trojan on top of XHelper code
• BlueSky Ransomware RaaS; BlackCat successor cluster
• Bozok RAT Remote access trojan
• Buer Loader Loader malware
• Bumblebee Loader Loader for ransomware gangs
• Carbanak ATM/enterprise fraud
• Cerber Ransomware RaaS consumer malware
• Cerberus Banking Trojan (Android) Android banking/ransomware
• Chrysaor/Trident iOS/Android spyware using Trident chain
• Clop Ransomware Enterprises via exploited web app gateways; mass exploitation campaigns
• Cobalt Strike Commercial adversary-simulation framework (MITRE S0154) heavily abused by cybercriminals and APTs; Beacon implant provides HTTP/DNS/SMB C2, token and UAC abuse, PowerShell execution, keylogging and lateral movement.
• Conficker Worm Windows networks; self-propagating network worm
• Conti Ransomware Healthcare and enterprise networks; operator-led encryption
• CryptoLocker Ransomware Pioneering public ransomware
• DanaBot Banking trojan/loader
• DarkGate Malware Loader malvertising
• DarkSide Ransomware Large enterprises; stolen-access affiliates
• DCRat (DarkCrystal RAT) Remote access trojan
• DoppelPaymer Ransomware Enterprise double extortion
• Dridex (Bugat) Malware Banking credentials; global botnet for follow-on malware
• Dyre Wolf Banking trojan
• Egregor Ransomware RaaS double extortion
• Emotet Malware Global banking and enterprise networks; self-propagating loader
• Exodus Stealer Android info stealer
• Ficker Stealer Info stealer
• Formbook Form-grabbing stealer
• GandCrab Ransomware Consumers and SMBs; large-scale high-volume spam RaaS
• Glupteba Malware Cryptominer botnet + loader
• Gafgyt (BASHLITE) IoT DDoS botnet
• GootLoader SEO-poisoning loader
• GameOver Zeus P2P banking botnet
• GuLoader Loader using cloud resources
• Hive Ransomware RaaS double/triple extortion
• IcedID Malware Banking credentials; loader to ransomware operations
• Joker (Android) Android billing fraud
• KPOT Stealer Info stealer (credentials, cookies, crypto)
• Kronos Banking Trojan Banking fraud
• LockBit Ransomware Windows enterprise networks; exfiltration before encryption (double extortion)
• LokiBot Info stealer via malspam
• Magniber Ransomware SMB/consumer ransomware
• Matanbuchus Loader Loader with cybercrime panel
• Maze Ransomware Mid-size enterprises; pioneer of data-exfiltration ransomware
• Medusa Ransomware RaaS double extortion
• Metamorfo Banking Trojan Banking fraud (Brazil/LatAm/Spain)
• Mirai Botnet Malware IoT devices (routers, cameras, DVRs); massive DDoS
• Mispadu Stealer Latin America info stealer
• NanoCore RAT Remote access trojan
• Mozi Botnet IoT P2P botnet
• NetTraveler Espionage backdoor
• Mamba Ransomware Disk-encrypting ransomware
• NetWalker Ransomware RaaS double extortion
• NjRAT Remote access trojan
• NotPetya (GoldenEye) Destructive wiper masquerading as ransomware
• Nymaim Loader + ransomware drop
• Pegasus Spyware Mobile devices (iOS/Android); targeted zero-click surveillance
• Phobos Ransomware RaaS double extortion
• Pikabot Loader Loader for C2/botnet
• Pony Stealer Credential stealer
• QakBot (QBot) Malware Banking credentials; initial access for ransomware operators
• Quasar RAT Open-source remote access trojan
• RagnarLocker Ransomware Targeted VM/lower-stealth ransomware
• Ramnit Banking Trojan Banking trojan + worm
• RansomExx (Defray777) Targeted enterprise ransomware
• RedLine Stealer Info stealer with RAT elements
• Remcos Remote Access Trojan Windows devices; commercial RAT for surveillance
• REvil (Sodinokibi) Ransomware Managed service providers and large enterprises; double extortion
• Rhysida Ransomware RaaS double extortion
• Ryuk Ransomware Large organizations; targeted human-operated attacks
• Sality File-infecting polymorphic malware
• Snake Keylogger Info stealer + keylogger
• SpyNote (Android) Android spyware via malicious apps
• Stealc Malware Info stealer
• Stuxnet Industrial control system malware
• SUNBURST Trojanized SolarWinds Orion DLL used in the 2020 supply-chain compromise; delivered a backdoor with DNS and HTTP C2, sleep-based evasion and dynamic resolution.
• TrickBot Malware Banking credentials; enterprise network reconnaissance
• Tsunami (Kaiten) Linux DDoS backdoor
• Vidar Stealer Info stealer (fork of Arkei)
• Warzone RAT (Ave Maria) Remote access trojan
• WastedLocker Ransomware Enterprise human-operated ransomware (Evil Corp)
• What is a Remote Access Trojan (RAT)? A RAT gives attackers remote control of your device. Learn its behavior, targets, associated techniques, and how to defend.
• What is Ransomware? Ransomware encrypts your files and demands payment. Learn how it works, how to detect an infection, and how to protect against it.
• What is Trojan Malware? A Trojan is malware disguised as legitimate software. Learn how Trojans work, how to detect them, and how to protect yourself.
• XLoader Form-grabbing stealer successor to Formbook
• XorDDoS Malware Linux DDoS botnet
• XWorm RAT Remote access trojan
• Zeus (Zbot) Malware Banking credentials; foundational formgrabber botnet
• ZLoader Banking trojan successor to Zeus