Malware Families page 61 of 63
6,272 malware families profiled on the Maltiverse Threat Observatory, listed alphabetically. Each profile collects aliases, MITRE ATT&CK mapping, arsenal and campaigns, detection rules and the indicators of compromise attributed to it.
- orca rat
- Orca is a sophisticated remote access Trojan (RAT) used primarily for cyber espionage.
- orion ransomware
- Jan13, 2026: We believe the group might be related to Babuk-Bjorka.
- orova
- osiris ransomware
- Osiris is a ransomware family known for encrypting files on victim machines and demanding ransom payments for decryption keys.
- ostap downloaderloader
- Ostap is a commodity JScript downloader first seen in campaigns in 2016.
- osyolorz collective rat
- Osyolorz Collective is a remote access trojan (RAT) utilized primarily for cyber-espionage.
- ox thief credential-stealer
- Ox Thief is an information-stealing malware primarily focused on harvesting credentials, often distributed through phishing campaigns.
- p0sT5n1F3r spywarewebshell
- According to Yarix digital security, this is a malware that allows to sniff on HTTPS traffic, implemented as Apache module.
- p0wnyshell webshell
- Also known as Ponyshell, Pownyshell. P0wnyshell is a webshell that allows attackers to execute arbitrary commands on a compromised web server.
- paladin rat
- Paladin RAT is a variant of Gh0st RAT used by PittyPanda active since at least 2011.
- panzer
- paradise ransomware
- Paradise ransomware is known for encrypting files and demanding a ransom in exchange for the decryption key.
- paradise2 ransomware
- Paradise2 is a ransomware family used by cybercriminals to encrypt victim data and demand ransoms for decryption keys.
- parasite_http ratbackdoor
- Parasite_http is a remote access trojan (RAT) utilized primarily for cyber espionage purposes.
- payload
- The 'payload' malware lacks detailed description and specific behavioral characteristics, making it challenging to categorize precisely.
- payoutsking ransomware
- Payouts King Group. We are not RaaS. No affiliates are accepted. We use Tox messaging protocol.
- pbot botnetddos
- PBot is a peer-to-peer botnet derived from the Mirai source code.
- pcTattletale spyware
- According to TechCrunch, this is a remote surveillance app that allows ordinary consumers to buy software capable of tracking people and…
- pear ransomware
- ABOUT US: "Pure Extraction And Ransom (PEAR) Team is the community of highly responsible and strictly disciplined members.
- perfctl trojankeylogger
- Also known as perfcc. Perfctl, also known as perfcc, is a trojan malware that specifically targets government and financial sectors.
- pgift downloader
- Also known as ReRol. Information gathering and downloading tool used to deliver second stage malware to the infected system
- phalcon
- Phalcon is a malware with limited publicly available information, making it difficult to categorize its functions or targets at this time.
- phantom trojanrat
- Phantom is a remote access Trojan (RAT) known for targeting government, energy, and financial sectors.
- php.shin_webshell webshell
- A PHP webshell that allows file system management, data exfiltration and command execution.
- pipcreat trojandownloader
- Pipcreat is a malware designed to steal credentials and deliver further payloads, primarily targeting financial services and retail sectors.
- piratelock ransomware
- Piratelock is a ransomware family known for encrypting data and demanding ransom payments in cryptocurrency.
- play ransomware
- Also known as PlayCrypt. Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations…
- playboy
- No specific information is currently available about the 'playboy' malware.
- playwork trojanspyware
- Playwork is a sophisticated malware family primarily targeting government and financial services sectors in North America.
- ployx trojan
- Ployx is a trojan malware family primarily targeting the technology and financial services sectors.
- pngdowner downloader
- pngdowner is malware used by Putter Panda.
- polyvice rat
- Also known as Chily. PolyVice, also known as Chily, is a remote access trojan used primarily for cyber espionage.
- portless backdoorcredential-stealer
- Portless is a malware that lacks a typical port signature, complicating detection efforts.
- poscardstealer credential-stealer
- PosCardStealer is malware designed to extract payment card information from point-of-sale systems.
- poweRAT rat
- poweRAT is a remote access trojan (RAT) known for targeting financial services and government sectors.
- powerkatz credential-stealer
- PowerKatz is a PowerShell-based variant of Mimikatz used for extracting credentials.
- powershell_web_backdoor backdoorwebshell
- Powershell Web Backdoor is a malicious script designed to provide unauthorized remote access through a web interface.
- prb_backdoor backdoor
- prb_backdoor is a type of backdoor malware often associated with cyberespionage activities.
- prinz eugen ransomware
- Prinz Eugen is a ransomware family known for encrypting files on compromised systems and demanding ransom payments for decryption keys.
- proteus credential-stealertrojan
- Proteus is a versatile malware family known for targeting financial services and government sectors.
- providence ratbackdoor
- Providence is a sophisticated remote access tool (RAT) observed in attacks against government and critical infrastructure sectors.
- proxima ransomwaretrojan
- Proxima is a sophisticated ransomware family known for targeting critical infrastructure sectors and financial services.
- punisher ransomware
- Punisher is a ransomware family known for targeting financial services and government sectors.
- pupy (ELF) ratloader
- Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python.
- pupy (Python) rat
- Pupy is an open-source, cross-platform remote administration tool (RAT) written in Python.
- pupy (Windows) rat
- Also known as Patpoopy. Pupy is an open-source, cross-platform RAT and post-exploitation framework mainly written in python.
- purpleink backdoorrat
- PurpleInk is a remote access trojan (RAT) known for its capabilities to establish backdoor access to compromised systems.
- puzzlemaker dropperrat
- The dropper module is used to install two executables that pretend to be legitimate files belonging to Microsoft Windows OS.
- pwdump credential-stealer
- pwdump is a credential dumper designed to extract password hashes from Windows systems.
- pwnpos
- PwnPOS is a point-of-sale malware designed to capture and exfiltrate credit card data from infected systems.
- pyback backdoor
- PyBack is a Python-based backdoor that is typically used for remote access and control.
- pyrx trojanbackdoor
- Pyrx is a Trojan and backdoor malware that primarily targets sectors such as technology, financial services, and government.
- qilin-securotrop ratbackdoor
- Qilin-Securotrop is a sophisticated remote access Trojan (RAT) used primarily for cyber espionage, targeting government and defense sectors.
- qiulong backdoortrojan
- Qiulong is an advanced persistent threat primarily used for cyber espionage, targeting critical sectors like government and energy globally.
- qkG ransomware
- Security researchers have discovered a new ransomware strain named qkG that targets only Office documents for encryption and infects the…
- quicklock ransomware
- Quicklock is a ransomware family known for encrypting data on victim systems, typically targeting sectors like government, energy, and…
- quoter
- Quoter is a malware with limited publicly available information, making it challenging to specify its behavior or targets.
- r2r2
- R2r2 is a lesser-known malware with limited available information and is unlikely to be widely recognized as a distinct family or variant.
- r77 rootkit
- Also known as r77 Rootkit. According to the author, r77 is a ring 3 rootkit that hides everything: * Files, directories * Processes & CPU usage * Registry keys &…
- ra group ransomware
- The RA Group is a cybercriminal organization known for deploying ransomware attacks targeting various industries.
- rabbit hole
- No detailed information is available for this malware, and it lacks a standard identification description.
- radar spyware
- Radar is a type of spyware known for its usage in surveillance activities.
- radiant group ratspyware
- Radiant Group is a sophisticated cyber-espionage group known for targeting government and technology sectors.
- ralord ransomware
- Ralord is a ransomware known for targeting various sectors, predominantly healthcare and financial services.
- rancoz ransomwaretrojan
- Rancoz is a ransomware family that first emerged in mid-2020, mainly targeting government and financial sectors.
- ranion ransomware
- Ranion is a ransomware as a service (RaaS) platform that allows cybercriminals to lease ransomware to execute attacks on various targets.
- ransom corp ransomware
- Ransom Corp is a notorious ransomware family that targets multiple sectors, focusing on financial and critical infrastructure.
- ransombay ransomware
- Ransombay is a ransomware targeting various industries, particularly in India and the US.
- ransomcortex ransomware
- Ransomcortex is a ransomware family that encrypts victims' data and demands payment for decryption.
- ransomed ransomware
- Ransomed is a ransomware type malware that encrypts files on the victim's system, demanding a ransom for decryption.
- ransomedvc2 ransomware
- RansomedVC2 aka RebornVC aka RansomedVC (rebrand) under new leadership.
- ransomware blog ransomware
- Ransomware Blog, also known as MedusaLocker, is a notorious ransomware that emerged in late 2019.
- raptum
- rapture rat
- Rapture is a sophisticated remote access tool (RAT) often used in cyber espionage campaigns.
- rarstar ransomware
- This ransomware encrypts all user’s data on the PC (photos, documents, excel tables, music, videos, etc), adds its specific extension to…
- rat_hodin rat
- Rat_hodin is a remote access trojan used for cyber espionage, predominantly targeting government and critical infrastructure sectors.
- raznatovic trojanrat
- Raznatovic is a remote access trojan (RAT) used primarily for cyber espionage.
- rbs_srv trojan
- rbs_srv is a banking trojan primarily targeting financial institutions in North America.
- rdasrv rat
- rdasrv is a remote access trojan designed to stealthily infiltrate systems for surveillance and data exfiltration.
- reGeorg webshell
- reGeorg is an open-source web shell written in Python that can be used as a proxy to bypass firewall rules and tunnel data in and out of…
- red ransomware ransomware
- Red ransomware is known for encrypting files on victim systems and demanding a ransom for decryption keys.
- redact
- regulus
- reynolds trojan
- Reynolds is a piece of malware with insufficient public documentation.
- rhysida ransomware
- Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023.
- risen ransomware
- Risen, which is a fully optimized and high-speed program, is the result of our years of experience in the field of malware writing.
- robbing hood ransomware
- Robbing Hood is a ransomware family that targets financial services and government sectors.
- rock ransomware
- Also known as yellowalbatross. Rock, also known as YellowAlbatross, is a ransomware family targeting mainly government, financial, and tech sectors in the US, UK, and…
- root rootkit
- The 'root' malware is a type of rootkit often used to gain unauthorized access and maintain stealthy control over a compromised system.
- route
- route can be used to find or change information within the local system IP routing table.
- rtm locker ransomware
- Also known as Read The Manual Locker. RTM Locker, also known as Read The Manual Locker, is a ransomware family that encrypts files on infected systems, demanding a ransom…
- rtpos
- RTPOS is a type of point-of-sale malware designed to steal payment card data from infected systems.
- run some wares
- The malware 'run some wares' currently has no detailed description available, indicating limited public knowledge about its functionality…
- rustylocker ransomware
- RustyLocker is a ransomware family that encrypts files on compromised systems, often targeting government, financial services, and…
- s1ngularity Stealer credential-stealer
- According to StepSecurity, this is a stealer deployed through a compromised Nx package, targeting system environment properties…
- sLoad downloaderscreen-capture
- Also known as Starslord. sLoad is a PowerShell downloader that most frequently delivers Ramnit banker and includes noteworthy reconnaissance features.
- sRDI loader
- Also known as DAVESHELL. sRDI allows for the conversion of DLL files to position independent shellcode.
- safepay ransomware
- SafePay ransomware started in October 2024 as a new ransomware service, using some of the leaked LockBit source code.
- sarcoma ransomware
- Also known as Sarcoma Ransomware Group. Sarcoma is a ransomware group that emerged in October 2024 and has been actively targeting various organizations.
- satancd ransomware
- Satancd is a ransomware family known for encrypting files on victims' systems to extort payments.