Malware Families page 59 of 63
6,272 malware families profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- gd lockersec ransomware
- Our team members are from different countries and we are not interested in anything else, we are only interested in dollars.
- genesis ransomware
- Financial interests only. We do not provide or work with affiliate programs, no collaborations either. The requested payment must be made…
- get_pwd credential-stealertrojan
- Get_pwd is a malware known for extracting credentials from compromised systems.
- gh0st RAT ratbackdoor
- Also known as Mydoor, Moudoor. gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.
- ghost ransomware
- Also known as Ucul. aka Cring / Ghost (Cring) Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions…
- global trojan
- Also known as GLOBAL GROUP. Global is a cyber threat group sometimes associated with the alias GLOBAL GROUP.
- global cybernetic collective
- global secret group
- globe ransomware
- Globe is a ransomware family that first appeared in August 2016, notable for its highly customizable codebase that allows operators to…
- goDoH trojan
- Proof of concept for data exfiltration via DoH, written in Go.
- gokcpdoor backdoor
- According to LAC, this malware is written in Go and was observed in 2022 used by an unknown China-based APT across several incidents in…
- good day ransomware
- Good Day is a ransomware variant within the ARCrypter family, first observed in May 2023.
- goontact spyware
- Goontact is a mobile spyware targeting Android and iOS devices, often distributed through phishing techniques.
- grelos credential-stealer
- grelos is a skimmer used for magecart-style attacks.
- grep
- The name 'grep' generally refers to a command-line utility for searching plain-text data for matching strings.
- grinch trojan
- Grinch is a trojan known for its stealthy operations, often used in cybercrime activities.
- gsecdump credential-stealer
- gsecdump is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems.
- gunra trojan
- Gunra is a banking trojan designed to steal sensitive information such as online banking credentials.
- gwisin ransomware
- Gwisin is a targeted ransomware group first publicly reported in July 2022, believed to operate primarily within South Korea.
- handala trojan
- Handala is a trojan known to target government entities, primarily in the Palestinian territories.
- hcdLoader rat
- hcdLoader is a remote access tool (RAT) that has been used by APT18.
- helix
- hellcat ransomware
- Hellcat is a ransomware family that primarily targets government and financial sectors in the US and Russia.
- helldown trojanbackdoor
- Helldown is a sophisticated trojan and backdoor malware family used primarily in cyber-espionage campaigns targeting government and…
- hellogookie rat
- Hellogookie is a remote access trojan (RAT) primarily targeting financial and government sectors in Asia.
- help_restoremydata ransomware
- .help_restoremydata ext : .help_restoremydata note : HOW_TO_RECOVERY_FILES.html mail : [email protected] md5…
- hermes ransomwarewiper
- Hermes is a ransomware family first observed in the wild in February 2017, believed to have been developed by a group operating out of Asia.
- heyoka backdoorrat
- Heyoka is a known malware family primarily used for cyber espionage.
- himalayaa backdoor
- Himalayaa is a backdoor that allows unauthorized access to compromised systems.
- himan
- himan is a malware with limited available information.
- holyghost ransomware
- HolyGhost is a ransomware group first publicly reported in July 2022, believed to be operated by a North Korean state-sponsored threat…
- homeland ratspyware
- Homeland is a remote access tool (RAT) that has been used in cyber espionage campaigns targeting government and infrastructure sectors in…
- htpRAT rat
- htpRAT is a Remote Access Trojan (RAT) used to gain unauthorized access and control over infected computers.
- http_troy trojan
- Http_troy is a trojan primarily leveraged for data exfiltration and reconnaissance activities within financial and government sectors.
- httpclient backdoor
- httpclient is malware used by Putter Panda.
- httpdropper dropper
- Also known as httpdr0pper. HTTPDropper is a type of malware designed to stealthily introduce other malicious software into a system by using HTTP for communication.
- hunters trojanrat
- Also known as Hunters International. Hunters is a malware family associated with cybercrime operations, often targeting financial services and technology sectors.
- hyflock ransomware
- Hyflock is a ransomware family known for encrypting victims' files and demanding a ransom payment in exchange for decryption.
- iGZa4C ransomware
- iGZa4C is a ransomware variant known for encrypting files on infected systems and demanding payment for decryption.
- iKitten spyware
- Also known as OSX/MacDownloader. iKitten is a macOS exfiltration agent also known as OSX/MacDownloader.
- iLock ransomware
- iLock is a ransomware that encrypts files on the infected system and demands a ransom for decryption.
- iLockLight ransomware
- iLockLight is a ransomware variant known for encrypting files and demanding a ransom payment for decryption.
- iMuler downloaderdropperbackdoor
- Also known as Revir. The threat was a multi-stage malware displaying a decoy that appeared to the victim as a Chinese language article on the long-running…
- iRansom ransomware
- iRansom is a ransomware that encrypts files on the victim's system, demanding a ransom for their decryption.
- iSpy Keylogger keyloggercredential-stealer
- iSpy Keylogger is a notorious malware family known for its ability to capture keystrokes and steal sensitive information from infected…
- iah647
- ifconfig
- ifconfig is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system.
- imn crew trojan
- IMN Crew is a sophisticated threat actor associated with cyber espionage and targeting government and financial sectors.
- imnotavillian
- inc ransom ransomware
- Inc Ransom is a ransomware family known for encrypting files on compromised systems and demanding ransom payments for decryption.
- insane ransomware ransomware
- Insane is a relatively obscure ransomware family first reported in late 2021, with few confirmed incidents in public threat intelligence.
- inter
- No description available for the malware named 'inter'.
- interlock ransomware
- Interlock is a ransomware family known for encrypting files on infected systems and demanding a ransom for decryption keys.
- invaderx
- Invaderx is a piece of malware with limited available information.
- iox webshell
- A maliciously abused open source tool for port forwarding & intranet proxy.
- ipconfig
- ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration.
- ironchain
- Ironchain is a malware with limited public information available.
- izis backdoortrojan
- Izis is a sophisticated malware family known for its backdoor and trojan capabilities, primarily targeting financial and government…
- j group
- The 'j group' malware is known with limited information available.
- j ransomware ransomware
- J ransomware is a malicious software targeting various industries by encrypting files on compromised systems and demanding a ransom for…
- jCandy ransomware
- jCandy is a ransomware strain that encrypts victims' files and demands a ransom for decryption.
- jRAT ratbackdoorspyware
- Also known as JSocket, AlienSpy, Frutas. jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012.
- jSpy spywareratkeylogger
- jSpy is a sophisticated remote access tool (RAT) used for cyber-espionage.
- jackalock
- jason credential-stealerexploit-kit
- Jason is a graphic tool implemented to perform Microsoft exchange account brute-force in order to “harvest” the highest possible emails…
- jo of satan ransomware
- Jo of Satan is a ransomware family known for encrypting files and demanding a ransom from victims to restore access.
- join.me rat
- join.me is a remote access program from the producers of LogMeIn that provides quick access to another computer over an internet browser.
- js.wd downloader
- The threat actor of this family compromised Chrome extension developer accounts and attached malicious code to the extensions.
- jspRAT rat
- jspRAT is a remote access tool (RAT) primarily used for cyber espionage activities.
- jsworm ransomware
- JSWorm is a ransomware family that first appeared in May 2019 and is notable for undergoing multiple rebrands and evolutions, later…
- kairos
- karma ransomware
- Karma is a ransomware known for encrypting files on infected systems and demanding a ransom for decryption.
- kasseika ransomware
- Kasseika is a ransomware variant first publicly reported in January 2024, identified as a new evolution of the BlackMatter/LockBit…
- kawa
- kazu rat
- Kazu is a remote access trojan used to infiltrate government, financial, and technology sectors, providing attackers with stealthy access…
- kerberods backdoorrootkit
- Kerberods is a Linux-based malware that primarily functions as a backdoor and rootkit, targeting financial, government, and healthcare…
- key group
- No detailed information is currently available about the malware named 'key group.' Further research and analysis are required to…
- kfos backdoor
- Kfos is a backdoor malware often used in attacks targeting the financial services and government sectors.
- killada rat
- Killada is a remote access Trojan (RAT) known for its espionage capabilities targeting governmental and energy sectors.
- killsec ransomware
- KillSec is a ransomware family known for encrypting files and demanding a ransom for the decryption key.
- killsec3 ransomware
- Killsec3 is a ransomware family that targets government and financial services sectors primarily in the United States and United Kingdom.
- kirov backdoorrat
- Kirov is a sophisticated malware often used for cyber espionage activities.
- kitty-socks5
- Kitty-socks5 is a malicious software component designed to facilitate SOCKS5 proxy operations, enabling threat actors to redirect and…
- kittykatkrew ddos
- Kittykatkrew is a malware variant primarily known for its use in DDoS attacks.
- kkRAT ratscreen-capture
- According to Zscaler, a malware sharing similarities with GhostRAT and Big Bad Wolf.
- knight ransomware
- Also known as Cyclops. Knight, also known as Cyclops, is a ransomware family that targets critical infrastructure and various industries.
- kraken ransomware
- Kraken, also known as HelloKitty, is a ransomware family known for operating a leak site where they publish stolen data from victims.
- krybit ransomware
- Krybit is a ransomware family that targets the financial and technology sectors.
- krypt ransomware
- Krypt is a ransomware malware family known for encrypting user data and demanding ransom payments.
- kryptina ransomware
- Kryptina is a ransomware family known for encrypting files on infected systems and demanding payment for the decryption key.
- kryptos ratspyware
- Kryptos is a remote access tool primarily used for espionage against government and technology sectors.
- kuiper trojan
- Kuiper is a trojan malware with minimal distinguishing features publicly documented.
- kuza
- kuza is a piece of malware with limited public information regarding its capabilities, targets, or origins.
- kyber
- Kyber is a relatively obscure malware strain with limited available public information.
- l group
- la piovra ratspyware
- La Piovra is a sophisticated remote access tool (RAT) used primarily for espionage purposes.
- lamashtu rat
- Lamashtu is a Remote Access Trojan (RAT) known for targeting government and defense sectors.
- lambda
- No information is available about the malware named 'lambda', including its operation, types, or targeted sectors and regions.
- lamialocker ransomware
- Lamialocker is a ransomware family known for encrypting files and demanding a ransom for file restoration.
- lampion downloader
- Malware is delivered by emails, containing links to ZIP files or ZIP attachments.