mapping.csv

"^b106-(bladabindi|cb|jenxcus)$",bladabindi/jenxcus,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_b106.pdf
"^bladabindi/jenxcus$",bladabindi/jenxcus,
"^delf(inject|in-?fam)?$",delfinject,https://www.solvusoft.com/en/malware/viruses/troj-delfin-fam/
"^b106-delf(snif|inject)?$",delfinject,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool%3AWin32%2FInjector.gen!Z
"^(b106-)?otran$",otran,used by microsoft
"^b54-(base|code|config|old|dga1)$",citadel,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_citadel.pdf
"^b58-(chtoz|code1|crsh|dga1|dga2|(dns[1-5])|xplt|notc)$",bamital,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_bamital.pdf
"^((avalanche-|avalanchebotnet-)?andromeda|andromeda-b66)$",andromeda,shadowserver,http://blog.shadowserver.org/2017/12/04/avalanche-year-two-this-time-with-andromeda/,cymru
"^b66-(exe|https?(-unknown)?|ir|tv(ir)?)$",andromeda,b66 is andromeda/gamarue: http://blog.shadowserver.org/2017/12/04/avalanche-year-two-this-time-with-andromeda/
"^(b6[67]{1}-ss-|andromeda |b106-)?gamarue$",andromeda,microsoft,malpedia,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ANDROMEDA
"^(b67-ss-generic|avalanche-(generic|unknown)|avalanchebotnet(-generic)?)$",avalanche-generic,https://www.us-cert.gov/ncas/alerts/TA16-336A,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?goznym$",goznym,microsoft,shadowserver,microsoft,combination of gozi isfb and nymaim http://securityaffairs.co/wordpress/46328/malware/goznym-trojan.html,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?kins$",zeus,https://krebsonsecurity.com/tag/kins-trojan/ shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?marcher$",marcher,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?matsnu$",matsnu,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?nymai[mn]$",nymaim,spamhaus,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?panda-?banker$",zeus,https://www.proofpoint.com/us/threat-insight/post/zeus-panda-banking-trojan-targets-online-holiday-shoppers shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?ranbyus$",ranbyus,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)rovnix$",reactorbot,shadowserver,microsoft,cymru
"^reactorbot$",reactorbot,
"^(b67-ss-|avalanche-|avalanchebotnet-)?teslacrypt$",teslacrypt,shadowserver,microsoft,cymru
"^cryptesla$",teslacrypt,https://success.trendmicro.com/solution/1113900-emerging-threat-on-ransom-cryptesla
"^(b67-ss-|avalanche-|avalanchebotnet-)?tinba$",tinba,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?urlzone2?$",urlzone,microsoft,bambenek,aka bebloh,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?(vawtrak|neverquest)$",vawtrak,shadowserver,microsoft,https://blog.trendmicro.com/trendlabs-security-intelligence/banking-malware-vawtrak-now-uses-malicious-macros-abuses-windows-powershell/,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?xswkit$",gootkit,malpedia,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?bolek$",bolek,microsoft,shadowserver,cymru
"^b67-ss-citadel$",citadel,microsoft
"^(b46-http-[cm]|b93-(base|config|hd|plugins))$",shylock,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x6/botnet_simda.pdf https://csirt.cesnet.cz/_media/cs/services/x4/botnet_caphaw.pdf
"^b157-([no]3|r[01L])$",zeus,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_gameoverzeus.pdf
"^(caphaw|shylock)$",shylock,malpedia
"^b68-(zeroaccess-)?(1|2)-(32|64)(bit)?(-supernode)?$",zeroaccess,shadowserver,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_zeroaccess.pdf
"^b68-(dns|tcp)$",zeroaccess,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_zeroaccess.pdf
"^zeroaccess$",zeroaccess,malpedia,https://en.wikipedia.org/wiki/ZeroAccess_botnet
"^b75-s(1|12|2)$",ramnit,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_ramnit.pdf
"^b85-r[1-2][sv]{1}$",dorkbot,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_dorkbot.pdf
"^(waled|waledpak|waledac)$",waledac,https://en.wikipedia.org/wiki/Waledac_botnet,microsoft
"^(b106-)?zbot$",zeus,https://en.wikipedia.org/wiki/Zeus_(malware)
"^(all4family_|manual)?pushdo$",pushdo,migrated from intelmq
"^(bitdefender-)?pykspa(_improved|_precursor)?$",pykspa,shadowserver
"^bitdefender-sumxa$",feodo,migrated from intelmq
"^(avalanche-|avalanchebotnet-)?citadel( certpl| ms|ch|-54|-b54)?$",citadel,migrated from intelmq,shadowserver,cymru
"^conficker(_?[ab]{1,2})?$",conficker,migrated from intelmq,used by microsoft
"^downadup$",conficker,shadowserver
"^downloaderbot-(mxb|2)$",downloader-bot,migrated from intelmq
"^downloader-bot$",downloader-bot,
"^(feodo|dridex(-data)?|cridex|geodo|emote[dt]|heodo|bugat|sumax)$",feodo,malpedia,history and naming: https://feodotracker.abuse.ch/ https://en.wikipedia.org/wiki/Avalanche_(phishing_group)#Malware_deprived_of_infrastructure
"^gameover[-_](zeus-)(dga|peer|p2p|proxy)$",zeus,shadowserver
"^((avalanche-|avalanchebotnet-)?gozi2?|(gozi )?(isfb|crm)|papras|snifula|(trojanspy\.)?ursnif|dreambot)$",gozi,malpedia,shadowserver,cymru
"^(avalanche-)?((p2p|vm)?zeus(_p2p|_gameover(_us)?|vm)?|botnet_certtw)$",zeus,migrated from intelmq,cert.pl
"^ramnit(-0x[0-9a-f]*)?$",ramnit,migrated from intelmq
"^sality([_-]?p2p)?(v)?[0-9]?$",sality,migrated from intelmq
"^sality_(virus|old)$",sality,shadowserver
"^b106-sality$",sality,microsoft,https://en.wikipedia.org/wiki/Sality
"^(tinba(-dga)?|zusy|(avalanche-)?tiny-?banker|illi)$",tinba,migrated from intelmq,malpedia,shadowserver
"^xcodeghost$",xcodeghost,migrated from intelmq
"^dorkbot([-_ ](ssl|ngrbot))?$",dorkbot,shadowserver,malpedia
"^worm_dorkbot$",dorkbot,spamhaus
"^(iot)?mirai( mirai bot|-wget-download|-newpass|-botnet(14)?)?$",mirai,cymru,shadowserver,spamhaus
"^nivdort$",nivdort,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Nivdort.A
"^(b106-)?virut$",virut,https://en.wikipedia.org/wiki/Virut
"^(n[eu]curs(web)?|pwszbot|zbal)$",necurs,malpedia,https://www.solvusoft.com/en/malware/trojans/pwszbot-fbku/,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Zbal.B&ThreatID=-2147277171
"^kbot$",kbot,
"^xpaj$",xpaj,
"^(mayachok|cidox|vundo)$",vundo,microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FVundo
"^(rovnix|bkloader)$",rovnix,
"^(beebone|(b106-)?vobfus|vbofus|changeup|aaeh)$",aaeh,microsoft,https://www.us-cert.gov/ncas/alerts/TA15-098A,https://aaeh.shadowserver.org/
"^(unknown([0-9]{4})?|sinkhole|ransomware|infected|bitdefender-foreign|unknown-apt|(s_)?other|generic(_malware)?|malware-generic)$",malware-generic,spamhaus,cert.pl,shadowserver
"^(wannacry|wannacrypt)$",wannacry,shadowserver,https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
"^(b106-)?zegost$",zegost,spamhaus,shadowserver,microsoft
"^(torpig|anserin|sinowal|mebroot|quarian|theola)$",torpig,shadowserver,spamhaus,https://en.wikipedia.org/wiki/Torpig,malpedia
"^(sphinx|anubisspy)$",zeus,https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/sphinx-scammers-got-scammed,https://blog.trendmicro.com/trendlabs-security-intelligence/cyberespionage-campaign-sphinx-goes-mobile-anubisspy/
"^(zeus_)?panda$",zeus,shadowserver
"^(avalanche-|avalanchebotnet-)?corebot$",corebot,shadowserver,malpedia,cymru
"^b67-ss-corebot$",corebot,microsoft
"^4shared$",4shared,adware
"^admogo$",admogo,on android
"^(adpeak|scorpionsaver)$",scorpionsaver,http://windowsproblemshelpcenter.blogspot.co.at/2013/12/how-to-remove-scorpion.html
"^adware(-generic)?$",adware-generic,
"^(adware)?gvance$",gvance,
"^(andro|android.)?fakeinst$",fakeinst,on android,https://www.avira.com/en/support-threats-summary/tid/144897/threat/Android.Dropper.Agent.PW.Gen
"^(android)?bauts$",bauts,on android,
"^androidlocker$",androidlocker,
"^(androidlucky|luckylocker)$",luckylocker,
"^(asprox|aseljo|badsrc)$",asprox,https://en.wikipedia.org/wiki/Asprox_botnet
"^(backdoor\.)?kbotrep$",kbotrep,possibly kbot?
"^bamital$",bamital,
"^(banjori|bankpatch|backpatcher|multibanker 2)$",banjori,malpedia
"^bedep$",bedep,
"^(betabot|(b106-)?neurevt)$",betabot,malpedia,microsoft
"^(b106-)?bifrose$",bifrose,
"^bitcoinminer$",bitcoinminer,
"^blakamba$",blakamba,
"^(bondat|jsproslikefan)$",bondat,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=JS/Bondat
"^bookworm$",bookworm,
"^calfbot$",calfbot,
"^carberp$",carberp,
"^carufax$",carufax,
"^chinad$",chinad,malpedia https://www.enigmasoftware.com/pupchinad-removal/ https://malwaretips.com/blogs/pup-optional-chinad-removal/
"^crossrider$",crossrider,
"^cryptowall$",cryptowall,
"^cutwail$",cutwail,malpedia
"^cycbot$",cycbot,
"^dark-?mailer[23]?$",darkmailer,spamhaus
"^dipverdle\.?a?$",dipverdle,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TROJAN:WIN32/DIPVERDLE.A
"^dircrypt$",dircrypt,malpedia
"^dofoil$",dofoil,
"^(dyndns-mirage-apt|mirage)$",mirage,
"^dyre(za)?$",dyre,malpedia
"^(enfal(-apt)?|lurid)$",enfal,malpedia,https://attack.mitre.org/wiki/Software/S0010,http://la.trendmicro.com/media/misc/lurid-downloader-enfal-report-en.pdf
"^esfury$",esfury,
"^expiro$",expiro,
"^festy$",festy,
"^flashback$",flashback,
"^fleercivet$",fleercivet,
"^foxbantrix( unknown)?$",foxbantrix,
"^fsysna$",fsysna,
"^gamut$",gamut,
"^ganlet$",ganlet,on android
"^genieo$",genieo,adware
"^ghost-?push$",ghostpush,on android
"^ginmaster$",ginmaster,
"^gluper$",gluper,
"^gootkit$",gootkit,malpedia
"^hawk$",hawk,
"^ibanking$",ibanking,on android
"^induc$",induc,
"^(infy(-apt)?|foudre)$",foudre,malpedia
"^installmonster$",installmonster,adware
"^installrex$",installrex,adware
"^newgoz$",zeus,https://github.com/baderj/domain_generation_algorithms#overview
"^joinkjot$",joinkjot,
"^(kelihos(c|\.e)?|hlux)$",kelihos,https://en.wikipedia.org/wiki/Kelihos_botnet
"^(trojan.)?kronos$",kronos,https://en.wikipedia.org/wiki/Kronos_(malware)
"^kuguo$",kuguo,adware,on android
"^(b106-)?ldpinch$",ldpinch,microsoft
"^lethic$",lethic,malpedia
"^locky$",locky,malpedia
"^machbot$",machbot,
"^madangel$",madangel,
"^madmax$",madmax,malpedia
"^mediadashboard$",mediadashboard,
"^(metel|corkow)$",metel,https://www.kaspersky.com/resource-center/threats/metel
"^mewsspy$",mewsspy,
"^mip$",mip,http://malware.wikia.com/wiki/Mip
"^mix[12]?$",mix,https://www.mcafee.com/threat-intelligence/malware/default.aspx?id=801
"^mkero$",mkero,on android
"^mobidash$",mobidash,on android
"^monerominer$",monerominer,
"^morto$",morto,
"^multiplug$",multiplug,adware
"^murofet$",murofet,malpedia
"^netsky$",netsky,https://en.wikipedia.org/wiki/Netsky_(computer_worm)
"^(neutrino|(worm.)?kasidet)$",neutrino,shadowserver,malpedia
"^njworm$",njworm,
"^oimobi$",oimobi,on android
"^padcrypt$",padcrypt,
"^palevo$",palevo,mariposa,butterfly,pilleuz,rimecud,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/palevo
"^pirrit$",pirrit,on mac,adware,malpedia
"^(pony|(b106-)?fareit)$",pony,malpedia
"^(poseidon|findpos)$",findpos,https://en.wikipedia.org/wiki/PoSeidon_(malware)
"^poweliks$",poweliks,malpedia
"^pwsbanker$",pwsbanker,
"^qadars$",qadars,malpedia
"^(qakbot|qbot|pinkslipbot)$",qakbot,malpedia
"^quantloader$",quantloader,
"^ramdo$",ramdo,malpedia,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Ramdo
"^renocide$",renocide,harakit,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Renocide.Y
"^rerdom$",rerdom,
"^(retefe|tsukuba|werdlod)$",retefe,malpedia
"^revmob$",revmob,on android
"^rinoreader$",rinoreader,
"^(android\.)?rootnik$",rootnik,on android,malpedia
"^sendsafe$",sendsafe,malpedia
"^shifu$",shifu,malpedia
"^shiz$",shiz,
"^simda$",simda,malpedia,https://www.us-cert.gov/ncas/alerts/TA15-105A
"^skeeyah$",skeeyah,
"^skunkx$",skunkx,
"^smokeloader$",smokeloader,malpedia
"^snappea(bot)?$",snappea,
"^sniperspy$",sniperspy,
"^sprotect$",sprotect,
"^spyeye$",spyeye,
"^stantinko$",stantinko,malpedia
"^(sykipot(-apt)?|getkys)$",sykipot,malpedia
"^(alureon|tdss|tdl-4)$",alureon,https://en.wikipedia.org/wiki/Alureon
"^techsnab$",techsnab,
"^tempedreve$",tempedreve,malpedia
"^terdot$",zeus,https://www.bleepingcomputer.com/news/security/terdot-banking-trojan-grows-into-a-sophisticated-threat/
"^torrentlocker$",torrentlocker,
"^unknownrat[23]?$",unknownrat,
"^uupay$",uupay,on android,
"^(keylogger( |-))?vbklip$",vbklip,https://www.cert.pl/en/news/single/how-to-identify-and-remove-the-vbklip-malware/
"^verst$",verst,
"^viknok$",viknok,
"^vinself$",vinself,
"^((win32)?hlubea|shieldren)$",shieldren,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Hlubea.A https://www.solvusoft.com/en/malware/adware/shieldren/
"^(wisdom_?eyes|shelldown)$",wisdomeyes,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_shelldown.c https://blog.malwarebytes.com/detections/trojan-wisdomeyes/
"^(worm_)?boinberg$",boinberg,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FBoinberg
"^(iot)?wopbot$",wopbot,used by spamhaus
"^ztorg$",ztorg,https://www.kaspersky.com/blog/ztorg-botnet/16914/
"^ebury$",ebury,https://www.cert-bund.de/ebury-faq
"^tofsee$",tofsee,shadowserver,microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Tofsee
"^srizbi$",srizbi,https://en.wikipedia.org/wiki/Srizbi_botnet
"^ponmocup$",ponmocup,shadowserver,spamhaus,https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf
"^pitou$",pitou,malpedia
"^(b106-)?sisron$",sisron,malpedia,used by microsoft
"^shiotob$",urlzone,malpedia
"^mumblehard$",mumblehard,
"^spyapp(-generic)?$",spyapp-generic,anubis,on android,
"^wauchos$",wauchos,shadowserver,
"^b106-(agent|autorun|inject(or)?|ircbot|ircbrute|keygen|keylogger|multi|obfuscator|possiblemalware|small)$",malware-generic,used by microsoft
"^(solarbot|b106-napolar)$",solarbot,malpedia,used by microsoft
"^(b106-)?poison_?ivy$",poison_ivy,malpedia,used by microsoft
"^(b106-)?agentbypass$",agentbypass,used by microsoft
"^(b106-)?ainslot$",ainslot,used by microsoft
"^(b106-)?amighelo$",amighelo,used by microsoft
"^(b106-)?ardamax$",ardamax,used by microsoft,malpedia
"^(b106-)?assasin$",assasin,used by microsoft
"^(b106-)?autoac$",autoac,used by microsoft
"^(b106-)?autinject$",autinject,used by microsoft
"^(b106-)?balidor$",balidor,used by microsoft
"^(b106-)?bancos$",bancos,used by microsoft
"^(b106-)?bandok$",bandok,used by microsoft
"^(b106-)?banker$",banker,used by microsoft
"^(b106-)?banload$",banload,used by microsoft
"^(b106-)?bariori$",bariori,used by microsoft
"^(b106-)?beastdoor$",beastdoor,used by microsoft
"^(b106-)?beaugrit$",beaugrit,used by microsoft
"^(b106-)?bexelets$",bexelets,used by microsoft
"^(b106-)?bezigate$",bezigate,used by microsoft
"^(b106-)?binder$",binder,used by microsoft
"^(b106-)?bisar$",bisar,used by microsoft
"^(b106-)?blohi$",blohi,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Blohi.B
"^(b106-)?browserpassview$",browserpassview,used by microsoft
"^(b106-)?cakl$",cakl,used by microsoft
"^(b106-)?cashback$",cashback,used by microsoft
"^(b106-)?ceatrg$",ceatrg,used by microsoft
"^(b106-)?cechip$",cechip,used by microsoft
"^(b106-)?ceeinject$",ceeinject,used by microsoft
"^(b106-)?chuchelo$",chuchelo,used by microsoft
"^(b106-)?chir$",chir,malepdia,used by microsoft
"^(b106-)?comame$",comame,used by microsoft
"^(b106-)?comisproc$",comisproc,used by microsoft
"^(b106-)?comitsproc$",comitsproc,used by microsoft
"^(b106-)?comrerop$",comrerop,used by microsoft
"^(b106-)?comroki$",comroki,used by microsoft
"^(b106-)?comsirig$",comsirig,used by microsoft
"^(b106-)?coolvidoor$",coolvidoor,used by microsoft
"^(b106-)?coremhead$",coremhead,used by microsoft
"^(b106-)?crime$",crime,used by microsoft
"^(b106-)?danglo$",danglo,used by microsoft,https://www.solvusoft.com/en/malware/viruses/troj-danglo-f/
"^(b106-)?darkddoser$",darkddoser,used by microsoft
"^(b106-)?darkmoon$",darkmoon,used by microsoft
"^(b106-)?decay$",decay,used by microsoft
"^(b106-)?defsel$",defsel,used by microsoft
"^(b106-)?dimegup$",dimegup,used by microsoft
"^(b106-)?dnr$",dnr,used by microsoft
"^(b106-)?dokstormac$",dokstormac,used by microsoft
"^(b106-)?dooxud$",dooxud,used by microsoft
"^b106-dorkbot$",dorkbot,microsoft
"^(b106-)?dusvext$",dusvext,used by microsoft
"^(b106-)?dynamer$",dynamer,used by microsoft
"^(b106-)?effbee$",effbee,used by microsoft
"^(b106-)?eyestye$",eyestye,used by microsoft
"^(b106-)?farfli$",farfli,used by microsoft
"^(b106-)?folyris$",folyris,used by microsoft
"^((b106-)?frosparf|feis)$",frosparf,used by microsoft,https://www.solvusoft.com/en/malware/trojans/trojan-feis/
"^(b106-)?(fynloski|klovbot)$",fynloski,malpedia,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Fynloski.G
"^(b106-)?gaobot$",gaobot,used by microsoft
"^(b106-)?geratid$",geratid,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper%2525253aWin32%2525252fGeratid.A
"^(b106-)?gernidru$",gernidru,used by microsoft
"^(b106-)?geycript$",geycript,used by microsoft
"^(b106-)?gratem$",gratem,used by microsoft
"^(b106-)?gspot$",gspot,used by microsoft
"^(b106-)?habbo$",habbo,used by microsoft
"^(b106-)?hamweq$",hamweq,malpedia
"^(b106-)?hanictik$",hanictik,used by microsoft
"^(b106-)?hiderun$",hiderun,used by microsoft
"^(b106-)?histboader$",histboader,used by microsoft
"^(b106-)?horsamaz$",horsamaz,used by microsoft
"^(b106-)?hoygunver$",hoygunver,used by microsoft
"^(b106-)?hupigon$",hupigon,used by microsoft
"^(b106-)?itsproc$",itsproc,used by microsoft
"^(b106-)?kilim$",kilim,used by microsoft
"^(b106-)?kkmaka$",kkmaka,used by microsoft
"^(b106-)?knowlog$",knowlog,used by microsoft
"^(b106-)?lenc$",lenc,used by microsoft
"^(b106-)?leodon$",leodon,used by microsoft
"^(b106-)?levitiang$",levitiang,used by microsoft
"^(b106-)?lybsus$",lybsus,used by microsoft
"^(b106-)?lypsacop$",lypsacop,used by microsoft
"^(b106-)?mafod$",mafod,used by microsoft,spyware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Mafod,https://www.solvusoft.com/en/malware/spyware/win32-mafod/
"^(b106-)?malagent$",malagent,used by microsoft
"^(b106-)?malex$",malex,used by microsoft
"^(b106-)?meredrop$",meredrop,used by microsoft
"^(b106-)?mielit$",mielit,used by microsoft
"^(b106-)?misbot$",misbot,used by microsoft
"^(b106-)?mobibez$",mobibez,used by microsoft
"^(b106-)?mosripe$",mosripe,used by microsoft
"^(b106-)?mosucker$",mosucker,used by microsoft
"^(b106-)?msposer$",msposer,used by microsoft
"^(b106-)?naprat$",naprat,used by microsoft
"^(b106-)?nayrabot$",nayrabot,used by microsoft
"^(b106-)?necast$",necast,used by microsoft
"^(b106-)?neeris$",neeris,used by microsoft
"^(b106-)?nemim$",nemim,used by microsoft
"^(b106-)?neop$",neop,used by microsoft
"^(b106-)?neshta$",neshta,used by microsoft
"^(b106-)?netbot$",netbot,used by microsoft
"^(b106-)?netwiredrc$",netwiredrc,used by microsoft
"^(b106-)?nitol$",nitol,malpedia,used by microsoft
"^(b106-)?noancooe$",noancooe,used by microsoft
"^(b106-)?nosrawec$",nosrawec,used by microsoft
"^(b106-)?nuqel$",nuqel,used by microsoft
"^(b106-)?nusump$",nusump,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Nusump
"^(b106-)?parama$",parama,used by microsoft
"^(b106-)?parite$",parite,used by microsoft
"^(b106-)?pcclient$",pcclient,used by microsoft
"^(b106-)?pdfjsc$",pdfjsc,used by microsoft
"^(b106-)?poison$",poison,used by microsoft
"^(b106-)?pontoeb$",pontoeb,used by microsoft
"^(b106-)?popiidor$",popiidor,used by microsoft
"^(b106-)?prorat$",prorat,used by microsoft
"^(b106-)?prosti$",prosti,used by microsoft
"^(b106-)?protos$",protos,used by microsoft
"^(b106-)?pushbot$",pushbot,used by microsoft
"^b106-ramnit$",ramnit,used by microsoft
"^(b106-)?ranos$",ranos,used by microsoft
"^(b106-)?rbot$",rbot,used by microsoft
"^(b106-)?rebhip$",cybergate,malpedia,used by microsoft
"^cybergate$",cybergate,
"^(b106-)?remhead$",remhead,used by microsoft
"^(b106-)?rimod$",rimod,used by microsoft
"^(b106-)?ritros$",ritros,used by microsoft
"^(b106-)?runner$",runner,used by microsoft
"^(b106-)?scar$",scar,used by microsoft
"^(b106-)?sdbot$",sdbot,used by microsoft
"^(b106-)?sharke$",sharke,used by microsoft
"^(b106-)?silby$",silby,used by microsoft
"^(b106-)?sillysharecopy$",sillysharecopy,used by microsoft
"^(b106-)?sisproc$",sisproc,used by microsoft
"^(b106-)?skypams$",skypams,used by microsoft
"^(b106-)?smpdoss$",smpdoss,used by microsoft
"^(b106-)?sormoeck$",sormoeck,used by microsoft
"^(b106-)?splori$",splori,used by microsoft
"^(b106-)?spybot$",spybot,malpedia,used by microsoft
"^(b106-)?squida$",squida,used by microsoft
"^(b106-)?ssonce$",ssonce,used by microsoft
"^(b106-)?sulunch$",sulunch,used by microsoft,https://en.wikipedia.org/wiki/Sulunch
"^((b106-)?(swisyn|arhost)|roopirs|ashwho)$",swisyn,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Roopirs.A,https://www.solvusoft.com/en/malware/trojans/tr-swisyn-ubp-13/
"^(b106-)?swrort$",swrort,used by microsoft
"^(b106-)?synflood$",synflood,used by microsoft
"^(b106-)?tapazom$",tapazom,used by microsoft
"^(b106-)?tawsebot$",tawsebot,used by microsoft
"^(b106-)?tearspear$",tearspear,used by microsoft
"^(b106-)?tendrit$",tendrit,used by microsoft
"^(b106-)?tenpeq$",tenpeq,used by microsoft
"^(b106-)?tobfy$",tobfy,used by microsoft
"^(b106-)?tocofob$",tocofob,used by microsoft
"^(b106-)?toobtox$",toobtox,used by microsoft
"^(b106-)?tumpadex$",tumpadex,used by microsoft
"^(b106-)?turkojan$",turkojan,used by microsoft
"^(b106-)?twores$",twores,used by microsoft
"^(b106-)?vahodon$",vahodon,used by microsoft
"^(b106-)?vake$",vake,used by microsoft
"^(b106-)?vb$",adclicker,used by microsoft,other name because vb is too generic,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/VB
"^adclicker$",adclicker,
"^(b106-)?vbcrypt$",vbcrypt,used by microsoft
"^(b106-)?vbinder$",vbinder,used by microsoft
"^(b106-)?vbinject$",vbinject,used by microsoft
"^(b106-)?vburses$",vburses,used by microsoft
"^(b106-)?vharke$",vharke,used by microsoft
"^(b106-)?vinject$",vinject,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vinject.A
"^(b106-)?vonriamt$",vonriamt,used by microsoft
"^(b106-)?vtub$",vtub,used by microsoft
"^(b106-)?weenkay$",weenkay,used by microsoft
"^(b106-)?wervik$",wervik,used by microsoft
"^(b106-)?xtrat$",xtrat,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=BACKDOOR:WIN32/XTRAT.A
"^(b106-)?xyligan$",xyligan,used by microsoft
"^(b106-)?yemrok$",yemrok,used by microsoft
"^(b106-)?zacusca$",zacusca,used by microsoft
"^(spyvoltar|buterat)$",buterat,shadowserver,https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/malware/troj_ransom.blu
"^(misfox|modpack)$",misfox,malpedia
"^darkshell$",darkshell,malpedia
"^(ircbot|clicker|(ssl-)?unknown-bot-test|downloader)$",malware-generic,shadowserver
"^(jadtre|killav)$",jadtre,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Jadtre.A
"^renos$",renos,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FRenos
"^exobot$",marcher,shadowserver,on android,https://clientsidedetection.com/marcher.html,malpedia
"^(midhos|medfos)$",medfos,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FMedfos
"^kraken$",kraken,
"^fosniw$",fosniw,
"^patriot$",patriot,
"^(koobface|jnanabot)$",koobface,malpedia,https://en.wikipedia.org/wiki/Koobface
"^emudbot$",emudbot,
"^vidro$",vidro,
"^eitest$",eitest,
"^vpnfilter(-ua)?$",vpnfilter,shadowserver,malpedia
"^(nukebot|nuclear bot|microbankingtrojan|xbot|tinynuke)$",tinynuke,malpedia,shadowserver
"^(android\.)?fobus$",fobus,https://blog.avast.com/2015/01/15/fobus-the-sneaky-little-thief-that-could/
"^disorderstatus$",disorderstatus,
"^domaiq$",domaiq,adware,https://www.symantec.com/security-center/writeup/2013-060202-4950-99
"^nionspy$",nionspy,https://www.blackhat.com/docs/eu-15/materials/eu-15-Balduzzi-Cybercrmine-In-The-Deep-Web.pdf
"^stealrat$",stealrat,
"^(worm\.)?phorpiex$",pushbot,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Phorpiex.M,https://johannesbader.ch/2016/02/phorpiex/
"^(adware\.)?domaiq$",domaiq,adware,https://deletemalware.blogspot.com/2013/06/how-to-remove-domaiq-removal.html
"^harnig$",harnig,malpedia
"^bulta$",bulta,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_bulta.av
"^fakeav$",malware-generic,https://www.symantec.com/security-center/writeup/2007-101013-3606-99
"^(downloader\.)talalpek$",gootkit,https://blog.trendmicro.com/trendlabs-security-intelligence/avalanche-thwarting-cybercriminal-hazards-with-law-enforcement-collaboration/,maps to xswkit
"^crypdef$",crypdef,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/CRYPDEF
"^harnig$",harnig,malpedia
"^(trojan\.)?autoit$",autoit,https://www.f-secure.com/v-descs/trojan_w32_autoit.shtml
"^pws.pony$",pony,malpedia
"^bebloh$",urlzone,malpedia
"^bulta$",bulta,maybe zeus? https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_zbot.yuyaev,https://malwaredb.nessus.org/malware/4242ddb71fb36f2d760edc9d72c68562
"^((ransom\.)genasom|stampado)$",stampado,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_stampado.a,https://malwarefixes.com/threats/ransomwin32genasom-jc/
"^(b67-ss-trusteer|fake-trusteer-app|(avalanche-|avalanchebotnet-)trusteer)$",fake-trusteer-app,http://blog.shadowserver.org/2016/12/01/avalanche/,cymru
"^tsifiri$",tsifiri,malpedia
"^android\.marcher$",marcher,malpedia
"^(android\.)?smsspy$",smsspy,malpedia
"^banwarum$",banwarum,https://www.f-secure.com/v-descs/banwarum_a.shtml
"^fakealert$",fakealert,https://www.welivesecurity.com/deutsch/2017/10/12/html-fakealert-malware-welle-europa/
"^yash( |-)rat$",yash-rat,http://www.thecre.com/fnews/wp-content/uploads/2013/05/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf
"^proxyback$",proxyback,https://researchcenter.paloaltonetworks.com/2015/12/proxyback-malware-turns-user-systems-into-proxies-without-consent/
"^ssl-vmzeus$",zeus,shadowserver
"^fakerea(n|m)$",fakerean,probably a typo,malpedia
"^(iot)?satori$",satori,malpedia
"^(android\.)?fakebank$",fakebank,android,https://www.symantec.com/blogs/threat-intelligence/fakebank-intercepts-calls-banks,https://www.cyber.nj.gov/threat-profiles/android-malware-variants/fakebank
"^(avalanche-|avalanchebotnet-|b66-ss-)?smartapp$",smartapp,adware,https://malwaretips.com/blogs/remove-smartapp/,cymru
"^blackbeard$",blackbeard,https://blog.emsisoft.com/en/3613/blackbeard-and-pigeon/
"^(lebreat|reatle|nujama)$",reatle,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Nujama.A,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Reatle.A@mm
"^siggen6$",siggen6,malpedia
"^redyms$",redyms,malpedia
"^(buzus|pushbot|yimfoca)$",pushbot,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Yimfoca.A http://www.trendmicro.co.in/vinfo/in/threat-encyclopedia/malware/worm_buzus.wzi https://www.symantec.com/security-center/writeup/2010-050209-1610-99
"^dresscode$",dresscode,android,https://blog.checkpoint.com/2016/08/31/dresscode-android-malware-discovered-on-google-play/
"^kryptovor$",kryptovor,https://www.fireeye.com/blog/threat-research/2015/04/analysis_of_kriptovo.html
"^volatile_cedar$",volatile_cedar,https://blog.checkpoint.com/2015/03/31/volatilecedar/
"^x-?agent$",x-agent,https://en.wikipedia.org/wiki/X-Agent,malpedia
"^(ransom\.)?cerber$",cerber,malpedia
"^((android\.)?smsbot|crosate)$",smsbot,https://news.drweb.com/show/review/?lng=en&i=9463 https://fortiguard.com/encyclopedia/virus/5536402/android-crosate-a-tr
"^coinminer$",coinminer,malpedia
"^keybase$",keybase,keylogger,https://voidsec.com/keybase-en/
"^android[\.-]pwstealer$",android-pwstealer,not the delf* family (pwstealer on windows platform)
"^lurk(banker)?$",lurk,https://securelist.com/lurk-banker-trojan-exclusively-for-russia/75040/ https://www.secureworks.com/research/malware-analysis-of-the-lurk-downloader
"^trafog$",trafog,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?ThreatID=-2147275144
"^dirtjumper$",dirtjumper,https://krebsonsecurity.com/tag/dirt-jumper/
"^hesperbot$",hesperbot,malpedia
"^banatrix$",banatrix,malpedia
"^kovter$",kovter,malpedia
"^b67-ss-gozi2$",gozi,
"^adware.eorezo$",adware.eorezo,shadowserver,https://blog.malwarebytes.com/detections/adware-eorezo/,https://www.symantec.com/security-center/writeup/2012-061213-2441-99
"^android.banker$",android.banker,shadowserver,android
"^android.cliaid$",android.cliaid,shadowserver,android
"^bagle$",bagle,shadowserver,malpedia
"^boaxxe$",boaxxe,shadowserver,malpedia
"^crypaura$",rakhni,shadowserver,malpedia,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_crypaura.a,https://support.kaspersky.com/10556
"^fobber$",fobber,shadowserver,malpedia
"^gspy$",gspy,shadowserver,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Gspy-A/detailed-analysis.aspx
"^hancitor$",hancitor,shadowserver,malpedia
"^htbot$",htbot,shadowserver,malpedia
"^shelltea$",shelltea,shadowserver,https://www.root9b.com/newsroom/shelltea-poslurp-malware/
"^silon$",silon,shadowserver,malpedia
"^tesch$",tesch,shadowserver,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Tesch
"^umbraloader$",umbraloader,shadowserver,https://zerosecurity.org/2012/04/a-look-into-http-botnets-umbra-loader,https://blog.threattrack.com/umbra-loader-botnet-behind-fake-123greeting-com-spam-campaign/
"^xshellghost$",shadowpad,shadowserver,malpedia