Botnets

• Banking
• Click frauding
• Cryptocurrency mining
• Cryptolocker
• DDoSing
• Downloading
• Phishing
• Point-of-sale
• Police lock
• Ransomware
• RAT
• Server attack
• Spamming
• Spying
• Stealing
• Trojan

	Feature	Group
.CryptoHasYou.	.enc YOUR FILES ARE LOCKED.txt AES (256) encryption	Cryptolocker
AbaddonPOS
Accdfisa	Lock system Encrypt files Decryption of locked files	Police lock
Acebot	DDoS File download Password theft Shared drive vector	DDoSing
Ackposts	Contact theft	Stealing
Admin.HLP		Stealing
Adneukine		Police lock Ransomware
Adrenalin	Keylogger Screen capture Encryption of captured data Removal of competing malware	RAT
Agobot	Keylogger Rootkit Worm DDoS	Spamming DDoSing
Ainslot	Removal of competing malware Removable drive vector File download	Downloading
Akbot	Keylogger Rootkit Data theft System information gathering Worm Certificate theft File download Password theft Shared drive vector	Stealing
Aldi		DDoSing
Alebrije	Pharming MSN vector USB vector Javascript injection Gmail spam Startpage modification Send spam File download	Downloading Spamming
AlertLock		Police lock
Alina	Credit card data theft Memory scrapping Regular expression filtering XOR encoding Logging UPX Packing Visual Basic crypter UPX Protector	Point-of-sale
Alphacrypt		Cryptolocker Ransomware
Americana Dreams		Police lock
Andromeda	File download	Downloading
AnnLoader	Keylogger Pharming File download Password theft	Downloading
Anunak (botnet)		Trojan Banking
Apbot	DDoS	DDoSing
Arcom	Screen capture Backdoor Remote control Form data theft Camera capture Microphone capture Password theft	RAT
Asprox	Fast flux SQL Injection Phishing Send spam	Server attack Spamming
Athena		DDoSing
Atrax		Stealing
Avatar	Rootkit Virtual machine detection Hidden file storage SOCKS5 File download	Downloading
Avzahn		DDoSing
Backoff		Point-of-sale
Backscript	Pay-per-install	Downloading
Bafruz	Facebook password theft Anti-virus blocking Bitcoin mining Vkontakte password theft DDoS File download	Downloading Cryptocurrency mining DDoSing Stealing
Bagle	Backdoor Worm	Trojan
Bahama		Click frauding
Bamital		Click frauding
Bancos		Banking
BandarChor		Cryptolocker
BankPatch		Banking
Barracuda	Proxy Email harvesting VPN DDoS Password theft	DDoSing Stealing
Bashlight
Bedep	File download	Downloading
Beebone	Domain generation algorithm File download	Downloading
BernhardPOS		Point-of-sale
Bitcrypt		Cryptolocker
BlackEnergy		DDoSing
BlackPOS		Point-of-sale
BlackPOS2		Point-of-sale
BlackShades		RAT
Bmaster	Premium SMS Premium calls Premium services	Premium rate
Bobax	Domain generation algorithm Dynamic DNS Worm	Spamming
Bomba Locker		Police lock
BoteAR	SQL Injection DDoS Password theft	DDoSing Stealing
Boxer	Premium SMS	Premium rate
Bozok		RAT
Bradop	Banking credential theft Web password theft Credit card data theft	Stealing
Bredolab		Spamming
BroDoS	Booter
BrutPOS		Point-of-sale
Butterfly	Banking credential theft Credit card data theft Kit File download	Downloading Banking
CTB-Locker	Bitcoin payment Elliptic curve encryption Lock system Diffie-Hellman Encrypt files	Ransomware
Carberp		Banking
Carna		Probing
Casier	Affiliation	Police lock Ransomware
Cbeplay.P		Police lock
Cerber	Bitcoin payment .cerber	Cryptolocker
Cerberus		RAT
Chameleon		Click frauding
ChePro		Banking
ChewBacca		Point-of-sale
Chidol		Police lock
Chthonic		Banking
Cimbot	Click fraud Email harvesting Produce spam from templates	Click frauding Spamming
Citadel	Backconnect server Luhn algorithm check Video screen capture Firefox cookie theft Dynamic webinject configuration update File download	Downloading Banking
Clampi	VMProtect Password theft	Stealing
Claretore	Webinject	Click frauding
CoinVault		Cryptolocker
Coinbitclip
Comfoo	Keylogger Screen capture System information gathering File upload File execute Command shell Network information gathering File download	RAT
Conficker	Domain generation algorithm Worm	Trojan
CoreBot	Domain generation algorithm Form data theft Webinject Browser password theft File execute Dynamic webinject configuration update VNC server File download	Banking Stealing
Coreflood	Banking credential theft Data theft Web password theft Email password theft	Banking Stealing
Coverton		Cryptolocker
CozyDuke		Spying
Cridex		Banking
Crisis	File download	Downloading
Cryakl		Cryptolocker
CryptXXX	Data theft Virtual machine detection Launch delay Monitor mouse events Check CPU name in registry Encrypt files	Cryptolocker
CryptoDefense		Cryptolocker
CryptoLocker		Cryptolocker Ransomware
Cryptoblocker		Ransomware
Cryptowall		Cryptolocker Ransomware
Cutwail	Send spam	Spamming
Cythosia		DDoSing
DGAv14	Click fraud File download	Click frauding Downloading
DNSChanger	DNS blocking of AV companies DNS hijack	Click frauding
DaRK DDoSseR		DDoSing
Dabvegi	File download	Downloading
Dapato
Daredevil		Point-of-sale
Dark-Mailer		Spamming
DarkComet		RAT
DarkMegi		Downloading Trojan
DarkSeoul		Destructive
Darkmailer		Spamming
Darkness		DDoSing
Decebal		Point-of-sale
Dendroid		RAT
Destory		RAT
Destover		Destructive
Devdar		Police lock
Dexter		Point-of-sale
Dharma		Ransomware
Di BoTNet		DDoSing
Dirt Jumper	GET flood Kit SYN flood POST flood DDoS	DDoSing
Dirt Jumper September	DDoS	DDoSing
Disker	WoW password theft	Stealing
DistTrack		Destructive Spying
Dlena		Spamming
Dofoil	File download	Downloading
Donbot		Spamming
Dorifel	Worm Encrypt files	Trojan
Dorkbot	USB vector IM password theft Skype vector Twitter password theft Facebook password theft Bebo password theft Friendster password theft Paypal password theft Netflix password theft Sendspace password theft Geolocalisation DNS blocking of AV companies Slowloris UDP flood Bitcoin mining SYN flood File download	DDoSing
Dridex		Banking
Duqu		Spying
Dyre	Banking credential theft Man in the browser Backconnect server Custom C&C encryption algorithm Domain generation algorithm	Banking
Eagle		Point-of-sale
Eggdrop
Emit	File download	Downloading
Encriyoko	File theft Encrypt files	Stealing
Epubb		Police lock
EraseMBR		Destructive
Ertfor	File download	Downloading
Etumbot	String stacking	Spying
Expiro	SOCKS Credit card data theft URL redirection Cross-infection HTTP proxy TCP flood Chrome browser extension Mozilla browser extension FileZilla password theft Outlook password theft Internet Explorer password theft	Click frauding Stealing
Fakavalert		Downloading Spamming
FakeM		RAT
FakeToken
Feederbot		Spying
Festi	Send spam	Spamming
FighterPOS	Keylogger Credit card data theft Memory scrapping DDoS	Point-of-sale
Finfisher	Keylogger Geolocalisation File theft Email surveillance IM surveillance Anti-virus blocking Skype surveillance Voice-over-IP surveillance Camera capture Microphone capture Remote forensics Data filtering	Lawful interception
Fivetoone		Spamming
Flagui		Police lock
Flame		Spying
Flashback	Domain generation algorithm File download	Downloading Trojan
Flimrans		Police lock
Floki		Point-of-sale
Foag		Police lock
Forbot		DDoSing Stealing
FrameworkPOS	Memory scrapping	Point-of-sale
Frutas	Query system processes Kill system processes Browse file systems Display pop-up message Open website in browser DDoS File download	RAT
Fuflo		Spamming
GTbot	Worm DDoS	DDoSing
Galock		Police lock
GamaPoS	Credit card data theft Memory scrapping	Point-of-sale
Gameover	Domain generation algorithm Webinject Automated transfer system (ATS)	Banking
Gamker	Keylogger Proxy VNC server	Banking
Gammima		Stealing
GandCrab		Ransomware
Gapz	Domain generation algorithm Bootkit File download	Downloading
Gauss		Spying
Gbot	File download	Downloading
Gema		Police lock
Gendarmerie		Police lock
Getmypass		Point-of-sale
Gh0st RAT		RAT
Gheg		Spamming
Ghostnet		Spying
Gimemo		Police lock
GlassRAT		RAT
GoldInstall	File download	Downloading
Goldenbaks		Police lock Ransomware
GootKit		Banking
Goscri		Police lock
Gozi		Banking
Gpcode		Ransomware
Grum		Spamming
Grups		Spying
Gumblar	FTP password theft Worm	Click frauding Server attack
HTran		Proxying
Haglacod		Click frauding
Hammertoss	Handle generation algorithm	Spying
Hamweq	DDoS File download	Downloading DDoSing
HangOver		Spying
Harasom		Ransomware
Harnig	Anti-virus blocking File download	Downloading
Havex		RAT
HelloGirl		Spamming
Heloag		DDoSing
HerpesNet	Keylogger Screen capture DDoS File download	RAT
Hesperbot	Man in the browser Domain generation algorithm Keylogger Screen capture Form data theft Webinject SOCKS5 SMS interception Video screen capture VNC server Twofish encryption MTAN interception	Banking
Hikit	Rootkit	Spying
Hiloti	Webinject File download	Downloading Trojan
Hodprot	Register as print processor Custom encryption algorithm File download	Downloading
Hydraq		Trojan Spying
IBotnet	Backdoor AES encryption File download	Downloading Trojan
IKee.B (botnet)	Worm SMS interception	Banking
IMDDOS
ISR Stealer		Stealing
IceIX		Banking
IcoScript	Component Object Model (COM)	RAT
Illusion		DDoSing
Infinity		DDoSing
Ipeur		Police lock
Ircbot	File download	Downloading
JabberZeuS		Banking
Jabberbot	Removable drive vector
JackPOS		Point-of-sale
Jagfu		Police lock
Janicab		RAT
Jenxcus		Stealing
Jigsaw		Cryptolocker
Jrbot	File download	Downloading
KINS		Banking
Kaiten	DDoS	DDoSing
Karagany		RAT
Karn!v0r3x	Keylogger	Banking
Katusha	File download	Downloading
Kelihos	Keylogger USB vector FTP password theft Bitcoin wallet theft Virtual machine detection Double fastflux Winpcap interception Fast flux Bitcoin mining Firefox password theft Send spam DDoS	Spamming
Khan	DDoS	DDoSing
Kiribot		RAT
Kjw0rm		RAT
Kneber
Koler		Police lock Ransomware
Koobface	Cookie theft Web server IM password theft Email password theft Search results manipulation Browser password theft FTP client password theft DNS configuration modification CAPTCHA display to solve Facebook vector Software ID theft	Stealing
Kovter		Police lock
Kraken	Domain generation algorithm
Kuluoz	Data theft FTP password theft Send spam	Spamming Stealing
Leouncia		Spying
Lethic		Spamming
Lingbo		Spying
LockBit	AES encryption Affiliation ECC	Cryptolocker Ransomware
LockScreen.CI		Police lock Ransomware
Locky		Cryptolocker
LogPOS	Credit card data theft Memory scrapping Mailslot Luhn algorithm check	Point-of-sale
Lukitus	.lukitus	Cryptolocker
Lurk	File download	Downloading
LusyPOS		Point-of-sale
Luuuk
Lyposit		Police lock
MDK	Advertising Data theft AES encryption	Adware
MP-DDoser	ApacheKiller Slowloris UDP flood HTTP flood Bandwidth flood Layer 7 attack File download	DDoSing
Maazben		Spamming
Madi	Keylogger Screen capture File theft Email surveillance IM surveillance	Spying
Mahdi		Spying
Maistealer	Contact theft	Stealing
Makadocs		Stealing
Maktub Locker	Encrypt without C&C connection Encrypt files	Cryptolocker
Malex		Police lock
MalumPoS	Credit card data theft Memory scrapping Regular expression filtering	Point-of-sale
Marcher		Banking
Mariachi	Phishing File download	Trojan
Mariposa		Downloading Stealing
Medfos		Click frauding
Mega-D	Send spam	Spamming
Mehika	Pharming MSN vector Open website in browser File download	Pharming (group)
Metulji	Banking credential theft Credit card data theft	Banking
Miner	Store data in ADS Bitcoin mining	Distributed calculation Cryptocurrency mining
MiniDuke		Spying
Mirage		Spying
Mirai	Worm GRE flood DDoS	DDoSing
Miuref		Click frauding
Mlano		Ransomware
Mocbot		Downloading
ModPOS		Point-of-sale
Monkif	JPEG encoding File download	Downloading
Morto	RDP vector File download	Downloading
Multi-Locker		Police lock
Murofet	Domain generation algorithm	Banking Stealing
Mytob	Worm Send spam	Spamming
NanoCore		RAT
Necurs	Backdoor Anti-virus blocking Debugging Send spam File download	Downloading Spamming
Nemanja		Point-of-sale
Nemucod
Nertra		Police lock
NetTraveler	Keylogger File theft System information gathering	Spying
NetWeird	Email password theft Browser password theft	Stealing
Netdevil	Backdoor DDoS	Trojan DDoSing
Netsky
Neverquest		Banking
NewPOSThings	Keylogger Memory scrapping VNC password theft	Point-of-sale
NitlovePOS	Credit card data theft Memory scrapping Store data in ADS Mailslot	Point-of-sale
Nitol		DDoSing
Nitro		RAT
NjRAT		RAT
Njw0rm		RAT
Nucrypt		Spamming
Nugache	Backdoor Enigma Worm DDoS	DDoSing
Nymaim		Police lock
Obad		Premium rate
OneWordSub		Spamming
OphionLocker		Ransomware
OutFlare	DDoS	DDoSing
PTA		Stealing
Pandora	DDoS	DDoSing
Petya	Bitcoin payment MBR overwrite Encrypt MFT	Cryptolocker
Pexby		Police lock
Phatbot	Email harvesting Worm AOL password theft Send spam	Spamming Stealing
PiceBOT	Pharming	Banking
PickPocket	Email harvesting Anti-virus blocking Open website in browser Send spam DDoS File download	DDoSing Stealing
Pirpi		Spying
Pitou		Spamming
PlugX		RAT
Pobelka		Banking
Poison Ivy		RAT Spying
PokerAgent		Stealing
Polybot	Polymorphism Keylogger DNS blocking of AV companies Worm DDoS	Spamming
Ponmocup	Pharming Email password theft DNS blocking of AV companies Display advertising pop-ups File download	Adware
Pony	Web password theft Email password theft FTP client password theft File download	Stealing
Poseidon		DDoSing
Power Bot
Pramro	SOCKS Proxy	Proxying
PrettyPark	Email worm Password theft	Stealing
Prinimalka		Banking
Psybot	Worm Brute-force DDoS Password theft	DDoSing
Punkey	Keylogger Credit card data theft Memory scrapping Luhn algorithm check AES encryption	Point-of-sale
Pushdo	Domain generation algorithm	Downloading
Qadars		Banking
RBot	Keylogger Click fraud Anti-virus blocking Port scanning Network sniffing Kit Email worm Send spam DDoS	Click frauding Spamming DDoSing
RDPdoor	Rootkit	Trojan Spying
Ramdo	Domain generation algorithm	Click frauding
Ramnit	Banking credential theft Domain generation algorithm Screen capture Backdoor Cookie theft FTP password theft Update File download	Banking Stealing
Ranbyus		Banking
Ranky		Spamming
Rannoh		Police lock
Ransom.EY		Police lock Ransomware
Ransom.HY		Ransomware
Ransom.IF		Police lock
Ransom.II		Police lock
Ransom.JU		Fake antivirus
RawPOS		Point-of-sale
Raxm		Police lock
Rdasrv	Regular expression filtering	Point-of-sale
Reactor Mailer		Spamming
Regin		Spying
Renos	File download	Downloading
Revenge RAT	Kit	RAT
Reveton		Police lock Ransomware
Revoyem		Police lock
Rocra		Spying
Rodecap	File download	Downloading
Rovnix	Bootkit	Downloading
Russkill	DDoS	DDoSing
Rustock		Spamming
S.A.P.Z.	Pharming	Banking
SDBot	MSN vector Pay-per-install File download	Downloading
SMSZombie	SMS payment	Premium rate
SYSMain		RAT
Sage		Ransomware
Sality		Downloading Probing
SamSam		Ransomware
ScarePakage		Police lock
Scatter
Seaduke		Spying
Shade
Shamoon		Destructive
Sheldor		Trojan
Shifu		Banking
Shylock		Banking
Silence Locker		Police lock
Silent Winlocker	Kit	Police lock Ransomware
Silon		Banking
Simda	Banking credential theft Backdoor Pharming Hosts modification File download Password theft	Downloading
Simple		DDoSing
Simplocker	AES encryption MoneXy payment Encrypt files	Cryptolocker Ransomware
Sinit	File download	Downloading
Sinowal	Banking credential theft Rootkit Backdoor FTP password theft Email password theft HTTP password theft MBR installation	Stealing
Sir DoOom		RAT
Skunkx	Removal of competing malware MSN vector USB vector Slowloris UDP flood HTTP flood SYN flood YIM vector Torrent vector Mozilla Sqlite data theft DDoS File download	DDoSing
Skynet	Banking credential theft Bitcoin mining	Banking
Slapper	Backdoor Worm DDoS	DDoSing
Slenfbot		Spamming
Smoke Bot		Downloading
Snap	SOCKS DDoS File download	DDoSing
Sninfs	File download	Downloading
Sobig	Email harvesting Worm Email worm TELock Send spam	Spamming
Sogu		RAT
Solar	FTP password theft SOCKS Bitcoin wallet theft Slowloris UDP flood SPDY grabbing POP3 password theft GET flood Bitcoin mining Slow POST Internet Explorer form data theft Firefox form data theft Chrome form data theft File download	Stealing
Sopelka		Banking
Soraya		Point-of-sale
Spachanel		Stealing
SpamSoldier	SMS spam Send spam	Spamming
SpamThru		Spamming
Spamuzle	Data theft Worm Send spam File download Shared drive vector	Spamming
Spark		Point-of-sale
SpyBot		DDoSing
SpyEye		Banking
Srizbi	Domain generation algorithm Upload minidump	Spamming
Storm	Server-side polymorphism Produce spam from templates DDoS	Spamming DDoSing
Studma		Police lock
Stuxnet	USB vector	Spying
Supern0va		Police lock
Swizzor		Downloading
Sykipot		Spying
SynoLocker		Ransomware
TDL-3		Downloading
TDL-4	Removal of competing malware Proxy Bootkit Affiliation Custom XOR-based encryption Register as print processor File download	Downloading
TDSS	File download	Downloading
TVT		RAT
Taidoor		Spying
Tatanarg	Man in the browser	Banking
Tatanga		Banking
Tequila	Netcat Pharming Run commands MSN vector USB vector Display advertising pop-ups Hosts modification Open website in browser Startpage modification DDoS File download	Click frauding Downloading Banking
TeslaCrypt		Cryptolocker
The Mask		Spying
Thoper		RAT
Thor		Not witnessed yet
Tigger	Keylogger Removal of competing malware Backdoor Form data theft Data theft Downloading	Stealing
Tilon		Banking
Tinba	Domain generation algorithm	Banking
TinyNuke		Banking
Tobfy		Police lock
Tobfy.N		Police lock
Torpig		Banking
TorrentLocker		Cryptolocker Ransomware
Travnet	Data theft Document theft Base64 encoding	Stealing Spying
TreasureHunt		Point-of-sale
Triada
Turla		Spying
TwitterNET	Kit DDoS File download	Downloading DDoSing
UBot		Downloading
ULocker		Police lock
Umbra		Downloading
Undefined-04		Police lock
Undefined-10		Police lock
Uniemv	File download	Downloading
Upas	Webinject Kit	Banking
Upatre	File download	Downloading
UrBot	IRC	Downloading
UrXBot		Downloading
Urausy		Police lock
Uremtoo		Police lock
VOlk		Banking
VSkimmer		Point-of-sale
Vernot		Stealing
VertexNet		Downloading
Vicas		Police lock
VinSelf		Spying
ViperRAT		RAT
VirLock	Polymorphism Bitcoin payment Lock system Encrypt files	Cryptolocker Ransomware
Virut	Pay-per-install File download	Downloading
Waledac	Fast flux AES encryption Bitcoin mining Base64 encoding Send spam DDoS	Spamming
Warbot		DDoSing
Warezov	Server-side polymorphism	Spamming
Weelsof		Police lock
Whitewell	Backdoor Base64 encoding File download	Downloading
Wimmie		Spying
Winwebsec	File download	Downloading
Wiper		Destructive Spying
Wirenet	AES encryption File download Password theft	Stealing
Wopla		Spamming
Xarvester	Upload minidump Produce spam from templates	Spamming
Xpaj		Stealing
XtremBot		Spamming DDoSing
Xtreme RAT		RAT
YoYo		DDoSing
Ysreef		Police lock
Zapchast	Produce spam from templates	Spamming
Zegost		RAT
Zemot	File download	Downloading
Zemra		DDoSing
ZeroAccess	Rootkit FTP password theft Click fraud Debugging detection XOR encoding Bitcoin mining RC4 encryption File download	Downloading
ZeroLocker		Cryptolocker
ZeuS		Banking
Zorenium	Backdoor Data theft Worm	Stealing
Zwangi	File download	Downloading