Botnets

	Alias	Group	Feature
.CryptoHasYou.		Cryptolocker	.enc YOUR FILES ARE LOCKED.txt AES (256) encryption
AbaddonPOS
Accdfisa	Accdfisa	Police lock	Lock system Encrypt files Decryption of locked files
Acebot		DDoSing	DDoS File download Password theft Shared drive vector
Ackposts		Stealing	Contact theft
Admin.HLP		Stealing
Adneukine		Police lock Ransomware
Adrenalin		RAT	Keylogger Screen capture Encryption of captured data Removal of competing malware
Agobot	Agobot	Spamming DDoSing	Keylogger Rootkit Worm DDoS
Ainslot		Downloading	Removal of competing malware Removable drive vector File download
Akbot	Akbot	Stealing	Keylogger Rootkit Data theft System information gathering Worm Certificate theft File download Password theft Shared drive vector
Aldi		DDoSing
Alebrije		Downloading Spamming	Pharming MSN vector USB vector Javascript injection Gmail spam Startpage modification Send spam File download
AlertLock		Police lock
Alina		Point-of-sale	Credit card data theft Memory scrapping Regular expression filtering XOR encoding Logging UPX Packing Visual Basic crypter UPX Protector
Alphacrypt		Cryptolocker Ransomware
Americana Dreams		Police lock
Andromeda	Andromeda	Downloading	File download
AnnLoader		Downloading	Keylogger Pharming File download Password theft
Anunak (botnet)		Trojan Banking
Apbot		DDoSing	DDoS
Arcom		RAT	Screen capture Backdoor Remote control Form data theft Camera capture Microphone capture Password theft
Asprox	Asprox	Server attack Spamming	Fast flux SQL Injection Phishing Send spam
Athena		DDoSing
Atrax		Stealing
Avatar		Downloading	Rootkit Virtual machine detection Hidden file storage SOCKS5 File download
Avzahn		DDoSing
Backoff		Point-of-sale
Backscript		Downloading	Pay-per-install
Bafruz		Downloading Cryptocurrency mining DDoSing Stealing	Facebook password theft Anti-virus blocking Bitcoin mining Vkontakte password theft DDoS File download
Bagle		Trojan	Backdoor Worm
Bahama		Click frauding
Bamital		Click frauding
Bancos		Banking
BandarChor		Cryptolocker
BankPatch	Patcher BankPatch	Banking
Barracuda		DDoSing Stealing	Proxy Email harvesting VPN DDoS Password theft
Bashlight
Bedep		Downloading	File download
Beebone	Beebone	Downloading	Domain generation algorithm File download
BernhardPOS		Point-of-sale
Bitcrypt		Cryptolocker
BlackEnergy		DDoSing
BlackPOS	BlackPOS	Point-of-sale
BlackPOS2		Point-of-sale
BlackShades		RAT
Bmaster	Bmaster	Premium rate	Premium SMS Premium calls Premium services
Bobax	Bobax	Spamming	Domain generation algorithm Dynamic DNS Worm
Bomba Locker		Police lock
BoteAR		DDoSing Stealing	SQL Injection DDoS Password theft
Boxer		Premium rate	Premium SMS
Bozok		RAT
Bradop		Stealing	Banking credential theft Web password theft Credit card data theft
Bredolab		Spamming
BroDoS	Itsoknoproblembro		Booter
BrutPOS		Point-of-sale
Butterfly	Butterfly	Downloading Banking	Banking credential theft Credit card data theft Kit File download
CTB-Locker	CTB-Locker	Ransomware	Bitcoin payment Elliptic curve encryption Lock system Diffie-Hellman Encrypt files
Carberp	Carberp	Banking
Carna		Probing
Casier	Casier	Police lock Ransomware	Affiliation
Cbeplay.P		Police lock
Cerber		Cryptolocker	Bitcoin payment .cerber
Cerberus		RAT
Chameleon		Click frauding
ChePro		Banking
ChewBacca		Point-of-sale
Chidol	Chidol	Police lock
Chthonic		Banking
Cimbot		Click frauding Spamming	Click fraud Email harvesting Produce spam from templates
Citadel		Downloading Banking	Backconnect server Luhn algorithm check Video screen capture Firefox cookie theft Dynamic webinject configuration update File download
Clampi	Clampi	Stealing	VMProtect Password theft
Claretore		Click frauding	Webinject
CoinVault		Cryptolocker
Coinbitclip
Comfoo		RAT	Keylogger Screen capture System information gathering File upload File execute Command shell Network information gathering File download
Conficker	Conficker	Trojan	Domain generation algorithm Worm
CoreBot		Banking Stealing	Domain generation algorithm Form data theft Webinject Browser password theft File execute Dynamic webinject configuration update VNC server File download
Coreflood		Banking Stealing	Banking credential theft Data theft Web password theft Email password theft
Coverton		Cryptolocker
CozyDuke		Spying
Cridex		Banking
Crisis		Downloading	File download
Cryakl	Cryakl	Cryptolocker
CryptXXX		Cryptolocker	Data theft Virtual machine detection Launch delay Monitor mouse events Check CPU name in registry Encrypt files
CryptoDefense	CryptoDefense	Cryptolocker
CryptoLocker		Cryptolocker Ransomware
Cryptoblocker		Ransomware
Cryptowall		Cryptolocker Ransomware
Cutwail	Cutwail	Spamming	Send spam
Cythosia		DDoSing
DGAv14		Click frauding Downloading	Click fraud File download
DNSChanger		Click frauding	DNS blocking of AV companies DNS hijack
DaRK DDoSseR	BKDR ADDNEW	DDoSing
Dabvegi		Downloading	File download
Dapato
Daredevil		Point-of-sale
Dark-Mailer		Spamming
DarkComet		RAT
DarkMegi	DarkMegi	Downloading Trojan
DarkSeoul		Destructive
Darkmailer		Spamming
Darkness		DDoSing
Decebal		Point-of-sale
Dendroid		RAT
Destory		RAT
Destover		Destructive
Devdar		Police lock
Dexter		Point-of-sale
Dharma		Ransomware
Di BoTNet		DDoSing
Dirt Jumper		DDoSing	GET flood Kit SYN flood POST flood DDoS
Dirt Jumper September		DDoSing	DDoS
Disker		Stealing	WoW password theft
DistTrack	DistTrack Shamoon	Destructive Spying
Dlena		Spamming
Dofoil		Downloading	File download
Donbot	Donbot	Spamming
Dorifel	Dorifel	Trojan	Worm Encrypt files
Dorkbot	Dorkbot	DDoSing	USB vector IM password theft Skype vector Twitter password theft Facebook password theft Bebo password theft Friendster password theft Paypal password theft Netflix password theft Sendspace password theft Geolocalisation DNS blocking of AV companies Slowloris UDP flood Bitcoin mining SYN flood File download
Dridex		Banking
Duqu		Spying
Dyre	Dyre	Banking	Banking credential theft Man in the browser Backconnect server Custom C&C encryption algorithm Domain generation algorithm
Eagle		Point-of-sale
Eggdrop
Emit		Downloading	File download
Encriyoko		Stealing	File theft Encrypt files
Epubb		Police lock
EraseMBR		Destructive
Ertfor		Downloading	File download
Etumbot		Spying	String stacking
Expiro	Expiro	Click frauding Stealing	SOCKS Credit card data theft URL redirection Cross-infection HTTP proxy TCP flood Chrome browser extension Mozilla browser extension FileZilla password theft Outlook password theft Internet Explorer password theft
Fakavalert		Downloading Spamming
FakeM		RAT
FakeToken
Feederbot		Spying
Festi		Spamming	Send spam
FighterPOS	FighterPOS	Point-of-sale	Keylogger Credit card data theft Memory scrapping DDoS
Finfisher		Lawful interception	Keylogger Geolocalisation File theft Email surveillance IM surveillance Anti-virus blocking Skype surveillance Voice-over-IP surveillance Camera capture Microphone capture Remote forensics Data filtering
Fivetoone	Fivetoone	Spamming
Flagui	Trojan:Win32/VB.AJV	Police lock
Flame		Spying
Flashback	Flashback	Downloading Trojan	Domain generation algorithm File download
Flimrans		Police lock
Floki		Point-of-sale
Foag		Police lock
Forbot		DDoSing Stealing
FrameworkPOS		Point-of-sale	Memory scrapping
Frutas		RAT	Query system processes Kill system processes Browse file systems Display pop-up message Open website in browser DDoS File download
Fuflo		Spamming
GTbot		DDoSing	Worm DDoS
Galock		Police lock
GamaPoS		Point-of-sale	Credit card data theft Memory scrapping
Gameover	Gameover	Banking	Domain generation algorithm Webinject Automated transfer system (ATS)
Gamker	Gamker	Banking	Keylogger Proxy VNC server
Gammima		Stealing
GandCrab	GandCrab	Ransomware
Gapz		Downloading	Domain generation algorithm Bootkit File download
Gauss		Spying
Gbot		Downloading	File download
Gema	Gema	Police lock
Gendarmerie		Police lock
Getmypass		Point-of-sale
Gh0st RAT		RAT
Gheg	Gheg	Spamming
Ghostnet		Spying
Gimemo		Police lock
GlassRAT		RAT
GoldInstall		Downloading	File download
Goldenbaks		Police lock Ransomware
GootKit		Banking
Goscri		Police lock
Gozi	Neverquest Prinimalka	Banking
Gpcode	Gpcode	Ransomware
Grum	Grum	Spamming
Grups		Spying
Gumblar		Click frauding Server attack	FTP password theft Worm
HTran		Proxying
Haglacod		Click frauding
Hammertoss		Spying	Handle generation algorithm
Hamweq		Downloading DDoSing	DDoS File download
HangOver		Spying
Harasom		Ransomware
Harnig	Harnig	Downloading	Anti-virus blocking File download
Havex	Havex	RAT
HelloGirl		Spamming
Heloag		DDoSing
HerpesNet		RAT	Keylogger Screen capture DDoS File download
Hesperbot		Banking	Man in the browser Domain generation algorithm Keylogger Screen capture Form data theft Webinject SOCKS5 SMS interception Video screen capture VNC server Twofish encryption MTAN interception
Hikit		Spying	Rootkit
Hiloti		Downloading Trojan	Webinject File download
Hodprot		Downloading	Register as print processor Custom encryption algorithm File download
Hydraq		Trojan Spying
IBotnet		Downloading Trojan	Backdoor AES encryption File download
IKee.B (botnet)		Banking	Worm SMS interception
IMDDOS
ISR Stealer		Stealing
IceIX		Banking
IcoScript		RAT	Component Object Model (COM)
Illusion		DDoSing
Infinity		DDoSing
Ipeur		Police lock
Ircbot		Downloading	File download
JabberZeuS		Banking
Jabberbot			Removable drive vector
JackPOS		Point-of-sale
Jagfu		Police lock
Janicab		RAT
Jenxcus		Stealing
Jigsaw		Cryptolocker
Jrbot		Downloading	File download
KINS		Banking
Kaiten		DDoSing	DDoS
Karagany		RAT
Karn!v0r3x		Banking	Keylogger
Katusha	Katusha	Downloading	File download
Kelihos		Spamming	Keylogger USB vector FTP password theft Bitcoin wallet theft Virtual machine detection Double fastflux Winpcap interception Fast flux Bitcoin mining Firefox password theft Send spam DDoS
Khan		DDoSing	DDoS
Kiribot	Kiribot	RAT
Kjw0rm		RAT
Kneber
Koler		Police lock Ransomware
Koobface		Stealing	Cookie theft Web server IM password theft Email password theft Search results manipulation Browser password theft FTP client password theft DNS configuration modification CAPTCHA display to solve Facebook vector Software ID theft
Kovter		Police lock
Kraken	Oderoor		Domain generation algorithm
Kuluoz		Spamming Stealing	Data theft FTP password theft Send spam
Leouncia		Spying
Lethic		Spamming
Lingbo		Spying
LockBit		Cryptolocker Ransomware	AES encryption Affiliation ECC
LockScreen.CI	EURO Winlocker	Police lock Ransomware
Locky		Cryptolocker
LogPOS		Point-of-sale	Credit card data theft Memory scrapping Mailslot Luhn algorithm check
Lukitus		Cryptolocker	.lukitus
Lurk		Downloading	File download
LusyPOS		Point-of-sale
Luuuk
Lyposit	Lyposit	Police lock
MDK		Adware	Advertising Data theft AES encryption
MP-DDoser	MP-DDoser	DDoSing	ApacheKiller Slowloris UDP flood HTTP flood Bandwidth flood Layer 7 attack File download
Maazben		Spamming
Madi	Mahdi	Spying	Keylogger Screen capture File theft Email surveillance IM surveillance
Mahdi		Spying
Maistealer		Stealing	Contact theft
Makadocs		Stealing
Maktub Locker		Cryptolocker	Encrypt without C&C connection Encrypt files
Malex		Police lock
MalumPoS		Point-of-sale	Credit card data theft Memory scrapping Regular expression filtering
Marcher		Banking
Mariachi		Trojan	Phishing File download
Mariposa		Downloading Stealing
Medfos	Medfos	Click frauding
Mega-D	Mega-D	Spamming	Send spam
Mehika	Mehika	Pharming (group)	Pharming MSN vector Open website in browser File download
Metulji		Banking	Banking credential theft Credit card data theft
Miner		Distributed calculation Cryptocurrency mining	Store data in ADS Bitcoin mining
MiniDuke	SandyEva	Spying
Mirage	Mirage	Spying
Mirai		DDoSing	Worm GRE flood DDoS
Miuref		Click frauding
Mlano		Ransomware
Mocbot	Mocbot	Downloading
ModPOS		Point-of-sale
Monkif	Monkif	Downloading	JPEG encoding File download
Morto		Downloading	RDP vector File download
Multi-Locker		Police lock
Murofet	Murofet	Banking Stealing	Domain generation algorithm
Mytob	Mytob	Spamming	Worm Send spam
NanoCore		RAT
Necurs		Downloading Spamming	Backdoor Anti-virus blocking Debugging Send spam File download
Nemanja		Point-of-sale
Nemucod
Nertra		Police lock
NetTraveler		Spying	Keylogger File theft System information gathering
NetWeird		Stealing	Email password theft Browser password theft
Netdevil		Trojan DDoSing	Backdoor DDoS
Netsky
Neverquest	Neverquest	Banking
NewPOSThings		Point-of-sale	Keylogger Memory scrapping VNC password theft
NitlovePOS		Point-of-sale	Credit card data theft Memory scrapping Store data in ADS Mailslot
Nitol		DDoSing
Nitro		RAT
NjRAT		RAT
Njw0rm	Njw0rm	RAT
Nucrypt	Nucrypt	Spamming
Nugache		DDoSing	Backdoor Enigma Worm DDoS
Nymaim		Police lock
Obad		Premium rate
OneWordSub		Spamming
OphionLocker		Ransomware
OutFlare		DDoSing	DDoS
PTA		Stealing
Pandora		DDoSing	DDoS
Petya		Cryptolocker	Bitcoin payment MBR overwrite Encrypt MFT
Pexby		Police lock
Phatbot		Spamming Stealing	Email harvesting Worm AOL password theft Send spam
PiceBOT		Banking	Pharming
PickPocket		DDoSing Stealing	Email harvesting Anti-virus blocking Open website in browser Send spam DDoS File download
Pirpi		Spying
Pitou		Spamming
PlugX	PlugX	RAT
Pobelka		Banking
Poison Ivy		RAT Spying
PokerAgent		Stealing
Polybot		Spamming	Polymorphism Keylogger DNS blocking of AV companies Worm DDoS
Ponmocup	Ponmocup	Adware	Pharming Email password theft DNS blocking of AV companies Display advertising pop-ups File download
Pony	Pony	Stealing	Web password theft Email password theft FTP client password theft File download
Poseidon		DDoSing
Power Bot
Pramro		Proxying	SOCKS Proxy
PrettyPark		Stealing	Email worm Password theft
Prinimalka	Prinimalka	Banking
Psybot	Psybot	DDoSing	Worm Brute-force DDoS Password theft
Punkey		Point-of-sale	Keylogger Credit card data theft Memory scrapping Luhn algorithm check AES encryption
Pushdo		Downloading	Domain generation algorithm
Qadars		Banking
RBot	RBot	Click frauding Spamming DDoSing	Keylogger Click fraud Anti-virus blocking Port scanning Network sniffing Kit Email worm Send spam DDoS
RDPdoor		Trojan Spying	Rootkit
Ramdo		Click frauding	Domain generation algorithm
Ramnit		Banking Stealing	Banking credential theft Domain generation algorithm Screen capture Backdoor Cookie theft FTP password theft Update File download
Ranbyus	Ranbyus	Banking
Ranky		Spamming
Rannoh	Trustezeb	Police lock
Ransom.EY	Ransom.EY	Police lock Ransomware
Ransom.HY		Ransomware
Ransom.IF		Police lock
Ransom.II	Madlerax.A	Police lock
Ransom.JU		Fake antivirus
RawPOS		Point-of-sale
Raxm		Police lock
Rdasrv		Point-of-sale	Regular expression filtering
Reactor Mailer		Spamming
Regin		Spying
Renos	Renos	Downloading	File download
Revenge RAT		RAT	Kit
Reveton		Police lock Ransomware
Revoyem		Police lock
Rocra		Spying
Rodecap		Downloading	File download
Rovnix		Downloading	Bootkit
Russkill		DDoSing	DDoS
Rustock	Rustock	Spamming
S.A.P.Z.		Banking	Pharming
SDBot	SDBot	Downloading	MSN vector Pay-per-install File download
SMSZombie		Premium rate	SMS payment
SYSMain		RAT
Sage		Ransomware
Sality		Downloading Probing
SamSam		Ransomware
ScarePakage		Police lock
Scatter
Seaduke		Spying
Shade
Shamoon		Destructive
Sheldor		Trojan
Shifu		Banking
Shylock	Shylock	Banking
Silence Locker		Police lock
Silent Winlocker		Police lock Ransomware	Kit
Silon		Banking
Simda		Downloading	Banking credential theft Backdoor Pharming Hosts modification File download Password theft
Simple		DDoSing
Simplocker		Cryptolocker Ransomware	AES encryption MoneXy payment Encrypt files
Sinit		Downloading	File download
Sinowal	Sinowal	Stealing	Banking credential theft Rootkit Backdoor FTP password theft Email password theft HTTP password theft MBR installation
Sir DoOom		RAT
Skunkx		DDoSing	Removal of competing malware MSN vector USB vector Slowloris UDP flood HTTP flood SYN flood YIM vector Torrent vector Mozilla Sqlite data theft DDoS File download
Skynet		Banking	Banking credential theft Bitcoin mining
Slapper		DDoSing	Backdoor Worm DDoS
Slenfbot		Spamming
Smoke Bot		Downloading
Snap		DDoSing	SOCKS DDoS File download
Sninfs		Downloading	File download
Sobig	Sobig Mankx	Spamming	Email harvesting Worm Email worm TELock Send spam
Sogu		RAT
Solar	Solar	Stealing	FTP password theft SOCKS Bitcoin wallet theft Slowloris UDP flood SPDY grabbing POP3 password theft GET flood Bitcoin mining Slow POST Internet Explorer form data theft Firefox form data theft Chrome form data theft File download
Sopelka		Banking
Soraya		Point-of-sale
Spachanel		Stealing
SpamSoldier		Spamming	SMS spam Send spam
SpamThru	SpamThru	Spamming
Spamuzle	Mariofev	Spamming	Data theft Worm Send spam File download Shared drive vector
Spark		Point-of-sale
SpyBot		DDoSing
SpyEye		Banking
Srizbi		Spamming	Domain generation algorithm Upload minidump
Storm	Storm	Spamming DDoSing	Server-side polymorphism Produce spam from templates DDoS
Studma		Police lock
Stuxnet		Spying	USB vector
Supern0va	Kuluoz.B	Police lock
Swizzor		Downloading
Sykipot		Spying
SynoLocker		Ransomware
TDL-3		Downloading
TDL-4		Downloading	Removal of competing malware Proxy Bootkit Affiliation Custom XOR-based encryption Register as print processor File download
TDSS		Downloading	File download
TVT		RAT
Taidoor		Spying
Tatanarg		Banking	Man in the browser
Tatanga	Tatanga	Banking
Tequila		Click frauding Downloading Banking	Netcat Pharming Run commands MSN vector USB vector Display advertising pop-ups Hosts modification Open website in browser Startpage modification DDoS File download
TeslaCrypt		Cryptolocker
The Mask		Spying
Thoper		RAT
Thor		Not witnessed yet
Tigger	Tigger	Stealing	Keylogger Removal of competing malware Backdoor Form data theft Data theft Downloading
Tilon	Tilon	Banking
Tinba	Tatanga Tinba Gataka	Banking	Domain generation algorithm
TinyNuke		Banking
Tobfy	Tobfy	Police lock
Tobfy.N		Police lock
Torpig	Torpig	Banking
TorrentLocker		Cryptolocker Ransomware
Travnet		Stealing Spying	Data theft Document theft Base64 encoding
TreasureHunt		Point-of-sale
Triada
Turla		Spying
TwitterNET		Downloading DDoSing	Kit DDoS File download
UBot	UBot	Downloading
ULocker		Police lock
Umbra		Downloading
Undefined-04		Police lock
Undefined-10		Police lock
Uniemv		Downloading	File download
Upas	Upas	Banking	Webinject Kit
Upatre		Downloading	File download
UrBot		Downloading	IRC
UrXBot		Downloading
Urausy		Police lock
Uremtoo		Police lock
VOlk		Banking
VSkimmer		Point-of-sale
Vernot		Stealing
VertexNet	VertexNet	Downloading
Vicas		Police lock
VinSelf		Spying
ViperRAT		RAT
VirLock		Cryptolocker Ransomware	Polymorphism Bitcoin payment Lock system Encrypt files
Virut		Downloading	Pay-per-install File download
Waledac	Kelihos Waledac	Spamming	Fast flux AES encryption Bitcoin mining Base64 encoding Send spam DDoS
Warbot		DDoSing
Warezov	Warezov	Spamming	Server-side polymorphism
Weelsof		Police lock
Whitewell		Downloading	Backdoor Base64 encoding File download
Wimmie		Spying
Winwebsec		Downloading	File download
Wiper		Destructive Spying
Wirenet		Stealing	AES encryption File download Password theft
Wopla	Wopla	Spamming
Xarvester	Xarvester	Spamming	Upload minidump Produce spam from templates
Xpaj		Stealing
XtremBot		Spamming DDoSing
Xtreme RAT		RAT
YoYo		DDoSing
Ysreef		Police lock
Zapchast		Spamming	Produce spam from templates
Zegost		RAT
Zemot		Downloading	File download
Zemra		DDoSing
ZeroAccess	ZeroAccess	Downloading	Rootkit FTP password theft Click fraud Debugging detection XOR encoding Bitcoin mining RC4 encryption File download
ZeroLocker		Cryptolocker
ZeuS		Banking
Zorenium		Stealing	Backdoor Data theft Worm
Zwangi		Downloading	File download