mapping.csv

"^b106-(bladabindi|cb|jenxcus)$",bladabindi/jenxcus,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_b106.pdf
"^bladabindi/jenxcus$",bladabindi/jenxcus,
"^dunihi$",bladabindi/jenxcus,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/dunihi
"^delf(inject|in-?fam)?$",delfinject,https://www.solvusoft.com/en/malware/viruses/troj-delfin-fam/
"^b106-delf(snif|inject)?$",delfinject,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool%3AWin32%2FInjector.gen!Z
"^(b106-)?otran$",otran,used by microsoft
"^b54-(base|code|config|old|dga1)$",citadel,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_citadel.pdf
"^b58-(chtoz|code1|crsh|dga1|dga2|(dns[1-5])|xplt|notc)$",bamital,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_bamital.pdf
"^((avalanche-|avalanchebotnet-)?andromeda|andromeda-b66)$",andromeda,shadowserver,http://blog.shadowserver.org/2017/12/04/avalanche-year-two-this-time-with-andromeda/,cymru
"^b66(-(exe|https?(-unknown)?|ir|tv(ir)?))?$",andromeda,b66 is andromeda/gamarue: http://blog.shadowserver.org/2017/12/04/avalanche-year-two-this-time-with-andromeda/
"^(b6[67]{1}-ss-|andromeda |b106-)?gamarue$",andromeda,microsoft,malpedia,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ANDROMEDA
"^(b67-ss-generic|avalanche-(generic|unknown)|avalanchebotnet(-generic)?)$",avalanche-generic,https://www.us-cert.gov/ncas/alerts/TA16-336A,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?goznym$",goznym,microsoft,shadowserver,microsoft,combination of gozi isfb and nymaim http://securityaffairs.co/wordpress/46328/malware/goznym-trojan.html,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?kins$",zeus,https://krebsonsecurity.com/tag/kins-trojan/ shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?marcher$",marcher,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?matsnu$",matsnu,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?nymai[mn]$",nymaim,spamhaus,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?panda-?banker$",zeus,https://www.proofpoint.com/us/threat-insight/post/zeus-panda-banking-trojan-targets-online-holiday-shoppers shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?ranbyus$",ranbyus,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)rovnix$",reactorbot,shadowserver,microsoft,cymru
"^reactorbot$",reactorbot,
"^(b67-ss-|avalanche-|avalanchebotnet-)?teslacrypt$",teslacrypt,shadowserver,microsoft,cymru
"^cryptesla$",teslacrypt,https://success.trendmicro.com/solution/1113900-emerging-threat-on-ransom-cryptesla
"^((b67-ss-|avalanche-|avalanchebotnet-)?tinba|tinba-dga|zusy|(avalanche-)?tiny-?banker|illi)$",tinba,migrated from intelmq,malpedia,shadowserver
"^(b67-ss-|avalanche-|avalanchebotnet-)?urlzone2?$",urlzone,microsoft,bambenek,aka bebloh,shadowserver,microsoft,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?(vawtrak|neverquest)$",vawtrak,shadowserver,microsoft,https://blog.trendmicro.com/trendlabs-security-intelligence/banking-malware-vawtrak-now-uses-malicious-macros-abuses-windows-powershell/,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?xswkit$",gootkit,malpedia,cymru
"^(b67-ss-|avalanche-|avalanchebotnet-)?bolek$",bolek,microsoft,shadowserver,cymru
"^b67-ss-citadel$",citadel,microsoft
"^(b46-http-[cm]|b93-(base|config|hd|plugins))$",shylock,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x6/botnet_simda.pdf https://csirt.cesnet.cz/_media/cs/services/x4/botnet_caphaw.pdf
"^b157-([no]3|r[01L])$",zeus,used by microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_gameoverzeus.pdf
"^(caphaw|shylock)$",shylock,malpedia
"^b68-(zeroaccess-)?(1|2)-(32|64)(bit)?(-supernode)?$",zeroaccess,shadowserver,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_zeroaccess.pdf
"^b68-(dns|tcp)$",zeroaccess,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_zeroaccess.pdf
"^zeroaccess$",zeroaccess,malpedia,https://en.wikipedia.org/wiki/ZeroAccess_botnet
"^b75-s(1|12|2)$",ramnit,microsoft,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_ramnit.pdf
"^b85-r[1-2][sv]{1}$",dorkbot,https://csirt.cesnet.cz/_media/cs/services/x4/botnet_dorkbot.pdf
"^(waled|waledpak|waledac)$",waledac,https://en.wikipedia.org/wiki/Waledac_botnet,microsoft
"^(b106-)?zbot$",zeus,https://en.wikipedia.org/wiki/Zeus_(malware)
"^(all4family_|manual)?pushdo$",pushdo,migrated from intelmq
"^(bitdefender-)?pykspa(_improved|_precursor|_v1)?$",pykspa,malpedia
"^bitdefender-sumxa$",dridex,migrated from intelmq: https://github.com/certtools/intelmq/commit/9124fdb9e945c75d64e35518aadfb179cab062b4
"^(avalanche-|avalanchebotnet-)?citadel( certpl| ms|ch|-54|-b54)?$",citadel,migrated from intelmq,shadowserver,cymru
"^conficker(_?[ab]{1,2}|_c)?$",conficker,
"^downadup$",conficker,shadowserver
"^downloaderbot-(mxb|2)$",downloader-bot,migrated from intelmq
"^downloader-bot$",downloader-bot,
"^(cridex|bugat|feodo)$",cridex,malpedia,history and naming: https://feodotracker.abuse.ch/
"^(emote[dt]|geodo|heodo|emotet-c2|b77-gvu?)$",emotet,malpedia,history and naming: https://feodotracker.abuse.ch/
"^dridex(-data)?$",dridex,malpedia
"^gameover[-_](zeus-)(dga|peer|p2p|proxy)$",zeus,shadowserver
"^((avalanche-|avalanchebotnet-)?gozi2?|(gozi )?(isfb|crm)|papras|snifula|(trojanspy\.)?ursnif|dreambot|goziiisfb)$",gozi,malpedia,shadowserver,cymru
"^(avalanche-)?((p2p|vm)?zeus(_p2p|_gameover(_us)?|vm)?|botnet_certtw)$",zeus,migrated from intelmq,cert.pl
"^ramnit(-0x[0-9a-f]*)?$",ramnit,migrated from intelmq
"^sality([_-]?p2p)?(v)?[0-9]?$",sality,migrated from intelmq
"^sality_(virus|old)$",sality,shadowserver
"^b106-sality$",sality,microsoft,https://en.wikipedia.org/wiki/Sality
"^xcodeghost$",xcodeghost,migrated from intelmq
"^dorkbot([-_ ](ssl|ngrbot))?$",dorkbot,shadowserver,malpedia
"^worm_dorkbot$",dorkbot,spamhaus
"^(iot)?mirai( mirai bot|-wget-download|-newpass|-botnet(14)?)?$",mirai,cymru,shadowserver,spamhaus
"^nivdort$",nivdort,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Nivdort.A
"^(b106-)?virut$",virut,https://en.wikipedia.org/wiki/Virut
"^(n[eu]curs(web)?|pwszbot|zbal)$",necurs,malpedia,https://www.solvusoft.com/en/malware/trojans/pwszbot-fbku/,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Zbal.B&ThreatID=-2147277171
"^kbot$",kbot,
"^xpaj$",xpaj,
"^(mayachok|cidox|vundo)$",vundo,microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FVundo
"^(rovnix|bkloader)$",rovnix,
"^(beebone|(b106-)?vobfus|vbofus|changeup|aaeh)$",aaeh,microsoft,https://www.us-cert.gov/ncas/alerts/TA15-098A,https://aaeh.shadowserver.org/
"^(unknown([0-9]{4})?|sinkhole|ransomware|infected|bitdefender-foreign|(s_)?other|generic(_malware)?|malware-generic)$",malware-generic,spamhaus,cert.pl,shadowserver
"^(wannacry|wannacrypt)$",wannacry,shadowserver,https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
"^(b106-)?zegost$",zegost,spamhaus,shadowserver,microsoft
"^(torpig|anserin|sinowal|mebroot|theola)$",torpig,shadowserver,spamhaus,https://en.wikipedia.org/wiki/Torpig,malpedia
"^(sphinx|anubisspy)$",zeus,https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/sphinx-scammers-got-scammed,https://blog.trendmicro.com/trendlabs-security-intelligence/cyberespionage-campaign-sphinx-goes-mobile-anubisspy/
"^(zeus_)?panda$",zeus,shadowserver
"^(avalanche-|avalanchebotnet-)?corebot$",corebot,shadowserver,malpedia,cymru
"^b67-ss-corebot$",corebot,microsoft
"^4shared$",4shared,not only adware,spyware,downloader,https://www.2-spyware.com/remove-4shared.html
"^admogo$",admogo,on android,file infector,https://www.fortiguard.com/encyclopedia/mobile/6870277
"^(adpeak|scorpionsaver)$",scorpionsaver,http://windowsproblemshelpcenter.blogspot.co.at/2013/12/how-to-remove-scorpion.html
"^adware(-generic)?$",adware-generic,adware
"^(adware)?gvance$",gvance,adware
"^(andro|android\.?)?fakeinst$",fakeinst,on android,https://www.avira.com/en/support-threats-summary/tid/144897/threat/Android.Dropper.Agent.PW.Gen
"^(android\.?)?bauts$",bauts,on android,adware,https://www.solvusoft.com/en/malware/potentially-unwanted-application/android-bauts-a/
"^androidlocker$",androidlocker,
"^(androidlucky|luckylocker)$",luckylocker,
"^(asprox|aseljo|badsrc)$",asprox,https://en.wikipedia.org/wiki/Asprox_botnet
"^(backdoor\.)?kbotrep$",kbotrep,possibly kbot?
"^bamital$",bamital,
"^(banjori|bankpatch|backpatcher|multibanker 2)$",banjori,malpedia
"^bedep$",bedep,
"^beeinject$",beeinject,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/BeeInject
"^(betabot|(b106-)?neurevt|win\.neurevt)$",betabot,malpedia,microsoft
"^(b106-)?bifros[et]$",bifrost,https://en.wikipedia.org/wiki/Bifrost_(Trojan_horse)
"^bitcoinminer$",bitcoinminer,
"^blakamba$",blakamba,
"^((js\.(worm\.)?)?bondat|jsproslikefan)$",bondat,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=JS/Bondat https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm.js.bondat.dnn
"^bookworm$",bookworm,https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/
"^calfbot$",calfbot,https://www.virusradar.com/en/Perl_Calfbot.A/description
"^carberp$",carberp,https://de.wikipedia.org/wiki/Carberp
"^carufax$",carufax,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Carufax-B/detailed-analysis.aspx
"^chinad$",chinad,malpedia https://www.enigmasoftware.com/pupchinad-removal/ https://malwaretips.com/blogs/pup-optional-chinad-removal/
"^crossrider$",crossrider,adware,https://blog.malwarebytes.com/detections/adware-crossrider/
"^cryptowall$",cryptowall,https://forums.malwarebytes.com/topic/150193-removal-instructions-for-cryptowall/
"^cutwail$",cutwail,malpedia
"^cycbot$",cycbot,
"^dark-?mailer[23]?$",darkmailer,spamhaus
"^dipverdle\.?a?$",dipverdle,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TROJAN:WIN32/DIPVERDLE.A
"^dircrypt$",dircrypt,malpedia
"^(dougat|quarian|turian)$",quarian,https://www.welivesecurity.com/deutsch/2021/06/11/backdoordiplomacy-von-quarian-zu-turian/ https://threatconnect.com/blog/divide-and-conquer/
"^(dyndns-mirage-apt|mirage)$",mirage,apt
"^dyre(za)?$",dyre,malpedia
"^emogen$",emogen,sophos
"^(enfal(-apt)?|lurid)$",enfal,malpedia,apt,https://attack.mitre.org/wiki/Software/S0010,http://la.trendmicro.com/media/misc/lurid-downloader-enfal-report-en.pdf
"^esfury$",esfury,
"^expiro$",expiro,
"^festy$",festy,
"^(osx\.)?flashback|(osx\.)?fakeflash$",flashback,malpedia https://en.wikipedia.org/wiki/Flashback_(Trojan)
"^fleercivet$",fleercivet,
"^foxbantrix( unknown)?$",foxbantrix,
"^fsysna$",fsysna,
"^gamut$",gamut,
"^ganlet$",ganlet,on android,not only adware,downloader,pua,spyware,https://www.connect.de/news/malware-virus-android-kaspersky-top-5-2071618.html
"^genieo$",genieo,adware
"^ghost-?push$",ghostpush,on android
"^ginmaster$",ginmaster,
"^gluper$",gluper,
"^gootkit$",gootkit,malpedia
"^hawk$",hawk,
"^ibanking$",ibanking,on android
"^induc$",induc,
"^(infy(-apt)?|foudre)$",foudre,malpedia,apt
"^installmonster$",installmonster,not only adware,PUA
"^installrex$",installrex,adware
"^newgoz$",zeus,https://github.com/baderj/domain_generation_algorithms#overview
"^joinkjot$",joinkjot,
"^(kelihos(c|\.e)?|hlux)$",kelihos,https://en.wikipedia.org/wiki/Kelihos_botnet
"^krafcot$",krafcot,https://www.trendmicro.com/vinfo/ie/threat-encyclopedia/malware/bkdr_krafcot.b
"^(trojan.)?kronos$",kronos,https://en.wikipedia.org/wiki/Kronos_(malware)
"^kuguo$",kuguo,not only adware,downloader,spyware,trojan,on android
"^((b106-)?ldpinch|chksyn)$",ldpinch,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chksyn
"^lethic$",lethic,malpedia
"^(downloader\.)?(locky|ponik)$",locky,malpedia,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_locky.th809 https://www.symantec.com/security-center/writeup/2012-110915-5758-99 https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Ponik-A.aspx
"^machbot$",machbot,
"^madangel$",madangel,
"^madmax$",madmax,malpedia
"^mediadashboard$",mediadashboard,
"^(metel|corkow)$",metel,https://www.kaspersky.com/resource-center/threats/metel
"^mewsspy$",mewsspy,
"^mip$",mip,http://malware.wikia.com/wiki/Mip
"^mix[12]?$",mix,https://www.mcafee.com/threat-intelligence/malware/default.aspx?id=801
"^mkero$",mkero,on android
"^mobidash$",mobidash,on android
"^monero[ _-]?miner$",monerominer,malpedia
"^miner\.monero$",monerominer,malpedia
"^morto$",morto,
"^multiplug$",multiplug,adware
"^murofet$",murofet,malpedia
"^netsky$",netsky,https://en.wikipedia.org/wiki/Netsky_(computer_worm)
"^(neutrino|(worm.)?kasidet)$",neutrino,shadowserver,malpedia
"^njworm$",njworm,
"^oimobi$",oimobi,on android,not only adware,spyware,https://fortiguard.com/encyclopedia/virus/6861089
"^padcrypt$",padcrypt,
"^(mariposa|palevo|rimecud)$",mariposa,butterfly,pilleuz,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/palevo,malpedia
"^pirrit$",pirrit,on windows and on mac,not only adware,clickfraud,trojan,webinjector,malpedia
"^(pony|(b106-)?fareit)$",pony,malpedia
"^(poseidon|findpos)$",findpos,https://en.wikipedia.org/wiki/PoSeidon_(malware)
"^poweliks$",poweliks,malpedia
"^pudshell$",pudshell,https://www.trendmicro.com/vinfo/ie/threat-encyclopedia/network/ddi-rule-1513 https://twitter.com/threatconnect/status/571049528771665920
"^pwsbanker$",pwsbanker,
"^qadars$",qadars,malpedia
"^(qakbot|qbot|pinkslipbot)$",qakbot,malpedia
"^quant[ _-]?loader$",quantloader,malpedia
"^ramdo$",ramdo,malpedia,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Ramdo
"^renocide$",renocide,harakit,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Renocide.Y
"^rerdom$",rerdom,
"^(retefe|tsukuba|werdlod)$",retefe,malpedia
"^revmob$",revmob,on android,adware
"^rinoreader$",rinoreader,
"^(android\.)?rootnik$",rootnik,on android,malpedia
"^sendsafe$",sendsafe,malpedia
"^shifu$",shifu,malpedia
"^shiz$",shiz,
"^simda$",simda,malpedia,https://www.us-cert.gov/ncas/alerts/TA15-105A
"^skeeyah$",skeeyah,
"^skunkx$",skunkx,
"^(smokeloader|(avalanche(botnet)?-|b67-ss-)?dofoil)$",smokeloader,malpedia
"^snappea(bot)?$",snappea,
"^sniperspy$",sniperspy,
"^sprotect$",sprotect,
"^spyeye$",spyeye,
"^stantinko$",stantinko,malpedia
"^(sykipot(-apt)?|getkys|wkysol|wisp)$",sykipot,malpedia,apt,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/sykipot https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=APT%204%2C%20Maverick%20Panda%2C%20Wisp%20Team
"^(alureon|tdss|tdl-4|dnschanger|xpack|wowlik)$",alureon,https://en.wikipedia.org/wiki/Alureon https://www.johannesbader.ch/2016/01/the-dga-in-alureon-dnschanger/ https://www.f-secure.com/v-descs/trojan_w32_dnschanger_arnf.shtml https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj64_wowlik.vt
"^techsnab$",techsnab,
"^tempedreve$",tempedreve,malpedia
"^terdot$",zeus,https://www.bleepingcomputer.com/news/security/terdot-banking-trojan-grows-into-a-sophisticated-threat/
"^torrentlocker$",torrentlocker,
"^unknownrat[23]?$",unknownrat,
"^uupay$",uupay,on android,
"^(keylogger( |-))?vbklip$",vbklip,https://www.cert.pl/en/news/single/how-to-identify-and-remove-the-vbklip-malware/
"^verst$",verst,
"^vilsel$",vilsel,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/BKDR_VILSEL.RIA/ https://www.microsoft.com/en-us/wdsi/threats/threat-search?query=vilsel
"^viknok$",viknok,
"^vinself$",vinself,
"^((win32)?hlubea|shieldren)$",shieldren,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Hlubea.A https://www.solvusoft.com/en/malware/adware/shieldren/
"^(wisdom_?eyes|shelldown)$",wisdomeyes,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_shelldown.c https://blog.malwarebytes.com/detections/trojan-wisdomeyes/
"^(worm_)?boinberg$",boinberg,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FBoinberg
"^(iot)?wopbot$",wopbot,used by spamhaus
"^ebury$",ebury,https://www.cert-bund.de/ebury-faq
"^tofsee$",tofsee,shadowserver,microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Tofsee
"^srizbi$",srizbi,https://en.wikipedia.org/wiki/Srizbi_botnet
"^ponmocup$",ponmocup,shadowserver,spamhaus,https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf
"^pitou$",pitou,malpedia
"^(b106-)?sisron$",sisron,malpedia,used by microsoft
"^shiotob$",urlzone,malpedia
"^mumblehard$",mumblehard,
"^spyapp(-generic)?$",spyapp-generic,anubis,on android,
"^wauchos$",wauchos,shadowserver,
"^b106-(agent|autorun|inject(or)?|ircbot|ircbrute|keygen|keylogger|multi|obfuscator|possiblemalware|small)$",malware-generic,used by microsoft
"^(solarbot|b106-napolar)$",solarbot,malpedia,used by microsoft
"^(b106-)?poison_?ivy$",poison_ivy,malpedia,used by microsoft
"^(b106-)?agentbypass$",agentbypass,used by microsoft
"^(b106-)?ainslot$",ainslot,used by microsoft
"^(b106-)?amighelo$",amighelo,used by microsoft
"^(b106-)?ardamax$",ardamax,used by microsoft,malpedia
"^(b106-)?assasin$",assasin,used by microsoft
"^(b106-)?autoac$",autoac,used by microsoft
"^(b106-)?autinject$",autinject,used by microsoft
"^(b106-)?balidor$",balidor,used by microsoft
"^(b106-)?bancos$",bancos,used by microsoft
"^(b106-)?bandok$",bandok,used by microsoft
"^(b106-)?banker$",banker,used by microsoft
"^(b106-)?banload$",banload,used by microsoft
"^(b106-)?bariori$",bariori,used by microsoft
"^(b106-)?beastdoor$",beastdoor,used by microsoft
"^(b106-)?beaugrit$",beaugrit,used by microsoft
"^(b106-)?bexelets$",bexelets,used by microsoft
"^(b106-)?bezigate$",bezigate,used by microsoft
"^(b106-)?binder$",binder,used by microsoft
"^(b106-)?bioazih$",bioazih,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Bioazih
"^(b106-)?bisar$",bisar,used by microsoft
"^(bisonal|korlia)$",korlia,https://malpedia.caad.fkie.fraunhofer.de/details/win.korlia
"^(b106-)?blohi$",blohi,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Blohi.B
"^(b106-)?browserpassview$",browserpassview,used by microsoft
"^(b106-)?cakl$",cakl,used by microsoft
"^(b106-)?cashback$",cashback,used by microsoft
"^(b106-)?ceatrg$",ceatrg,used by microsoft
"^(b106-)?cechip$",cechip,used by microsoft
"^(b106-)?ceeinject$",ceeinject,used by microsoft
"^(b106-)?chuchelo$",chuchelo,used by microsoft
"^(b106-)?chir$",chir,malepdia,used by microsoft
"^(b106-)?comame$",comame,used by microsoft
"^(b106-)?comisproc$",comisproc,used by microsoft
"^(b106-)?comitsproc$",comitsproc,used by microsoft
"^(b106-)?comrerop$",comrerop,used by microsoft
"^(b106-)?comroki$",comroki,used by microsoft
"^(b106-)?comsirig$",comsirig,used by microsoft
"^(b106-)?coolvidoor$",coolvidoor,used by microsoft
"^(b106-)?coremhead$",coremhead,used by microsoft
"^(b106-)?crime$",crime,used by microsoft
"^(b106-)?danglo$",danglo,used by microsoft,https://www.solvusoft.com/en/malware/viruses/troj-danglo-f/
"^(b106-)?dapato$",dapato,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/threat-search?query=dapato
"^(b106-)?darkddoser$",darkddoser,used by microsoft
"^(b106-)?darkmoon$",darkmoon,used by microsoft
"^(daserf|nioupale|muirim)$",daserf,https://malpedia.caad.fkie.fraunhofer.de/details/win.daserf
"^(b106-)?decay$",decay,used by microsoft
"^dedipros$",dedipros,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FDedipros.A&ThreatID=-2147310483
"^(b106-)?defsel$",defsel,used by microsoft
"^(b106-)?dimegup$",dimegup,used by microsoft
"^(b106-)?dnr$",dnr,used by microsoft
"^(b106-)?dokstormac$",dokstormac,used by microsoft
"^dorifel$",dorifel,https://threatpost.com/dorifel-malware-encrypts-files-steals-financial-data-may-be-related-zeus-or-citadel-081012/76900/
"^(b106-)?dooxud$",dooxud,used by microsoft
"^b106-dorkbot$",dorkbot,microsoft
"^(b106-)?dusvext$",dusvext,used by microsoft
"^(b106-)?dynamer$",dynamer,used by microsoft
"^(b106-)?effbee$",effbee,used by microsoft
"^(etumbot|hightide)$",etumbot,https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot
"^(b106-)?eyestye$",eyestye,used by microsoft
"^(b106-)?farfli$",farfli,used by microsoft
"^(b106-)?folyris$",folyris,used by microsoft
"^((b106-)?frosparf|feis)$",frosparf,used by microsoft,https://www.solvusoft.com/en/malware/trojans/trojan-feis/
"^(b106-)?(fynloski|klovbot)$",fynloski,malpedia,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Fynloski.G
"^(b106-)?gaobot$",gaobot,used by microsoft
"^(b106-)?geratid$",geratid,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper%2525253aWin32%2525252fGeratid.A
"^(b106-)?gernidru$",gernidru,used by microsoft
"^(b106-)?geycript$",geycript,used by microsoft
"^graftor$",graftor,https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor
"^(b106-)?gratem$",gratem,used by microsoft
"^(b106-)?gspot$",gspot,used by microsoft
"^(b106-)?habbo$",habbo,used by microsoft
"^(b106-)?hamweq$",hamweq,malpedia
"^(b106-)?hanictik$",hanictik,used by microsoft
"^(b106-)?hiderun$",hiderun,used by microsoft
"^(b106-)?histboader$",histboader,used by microsoft
"^(b106-)?horsamaz$",horsamaz,used by microsoft
"^(b106-)?hoygunver$",hoygunver,used by microsoft
"^(b106-)?hupigon$",hupigon,used by microsoft
"^(b106-)?itsproc$",itsproc,used by microsoft
"^jukbot$",jukbot,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Jukbot.B
"^(b106-)?kilim$",kilim,used by microsoft
"^(b106-)?kkmaka$",kkmaka,used by microsoft
"^(b106-)?knowlog$",knowlog,used by microsoft
"^(b106-)?lenc$",lenc,used by microsoft
"^(b106-)?leodon$",leodon,used by microsoft
"^(b106-)?levitiang$",levitiang,used by microsoft
"^(b106-)?lybsus$",lybsus,used by microsoft
"^(b106-)?lypsacop$",lypsacop,used by microsoft
"^(b106-)?mafod$",mafod,used by microsoft,spyware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Mafod,https://www.solvusoft.com/en/malware/spyware/win32-mafod/
"^(b106-)?malagent$",malagent,used by microsoft
"^(b106-)?malex$",malex,used by microsoft
"^(b106-)?meredrop$",meredrop,used by microsoft
"^(b106-)?mielit$",mielit,used by microsoft
"^(b106-)?misbot$",misbot,used by microsoft
"^(b106-)?mobibez$",mobibez,used by microsoft
"^morix$",morix,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/morix
"^(b106-)?mosripe$",mosripe,used by microsoft
"^(b106-)?mosucker$",mosucker,used by microsoft
"^(b106-)?msposer$",msposer,used by microsoft
"^(naikon|sacto)$",naikon,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Sacto.B!dha malmedia
"^(b106-)?naprat$",naprat,used by microsoft
"^(b106-)?nayrabot$",nayrabot,used by microsoft
"^(b106-)?necast$",necast,used by microsoft
"^(b106-)?neeris$",neeris,used by microsoft
"^(b106-)?nemim$",nemim,used by microsoft
"^(b106-)?neop$",neop,used by microsoft
"^(b106-)?neshta$",neshta,used by microsoft
"^(b106-)?netbot$",netbot,used by microsoft
"^(b106-)?netwiredrc$",netwiredrc,used by microsoft
"^((b106-)?nitol|servstart)$",nitol,malpedia,https://www.virusbulletin.com/virusbulletin/2019/12/vb2019-paper-exploring-chinese-ddos-threat-landscape/
"^(b106-)?noancooe$",noancooe,used by microsoft
"^(b106-)?nosrawec$",nosrawec,used by microsoft
"^(b106-)?nuqel$",nuqel,used by microsoft
"^(b106-)?nusump$",nusump,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Nusump
"^(b106-)?parama$",parama,used by microsoft
"^(b106-)?parite$",parite,used by microsoft
"^(b106-)?pcclient$",pcclient,used by microsoft
"^(b106-)?pdfjsc$",pdfjsc,used by microsoft
"^(plugx|korplug)$",plugx,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/plugx
"^plugax$",plugax,https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/malware/BKDR_PLUGAX.A
"^(b106-)?poison$",poison,used by microsoft
"^(b106-)?pontoeb$",pontoeb,used by microsoft
"^(b106-)?popiidor$",popiidor,used by microsoft
"^(b106-)?prorat$",prorat,used by microsoft
"^(b106-)?prosti$",prosti,used by microsoft
"^(b106-)?protos$",protos,used by microsoft
"^((b106-)?pushbot|buzus|yimfoca)$",pushbot,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Yimfoca.A http://www.trendmicro.co.in/vinfo/in/threat-encyclopedia/malware/worm_buzus.wzi https://www.symantec.com/security-center/writeup/2010-050209-1610-99
"^b106-ramnit$",ramnit,used by microsoft
"^(b106-)?ranos$",ranos,used by microsoft
"^(b106-)?rbot$",rbot,used by microsoft
"^(b106-)?rebhip$",cybergate,malpedia,used by microsoft
"^redsip$",redsip,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FRedsip.B!svc
"^cybergate$",cybergate,
"^(b106-)?remhead$",remhead,used by microsoft
"^reveton$",reveton,used by microsoft
"^(b106-)?rimod$",rimod,used by microsoft
"^(b106-)?ritros$",ritros,used by microsoft
"^rtfdrop$",rtfdrop,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~RTFDrop-BL.aspx
"^(b106-)?runner$",runner,used by microsoft
"^(b106-)?scar$",scar,used by microsoft
"^(schwarzesonne|talsab)$",schwarzesonne,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Talsab.C
"^(b106-)?sdbot$",sdbot,used by microsoft
"^(b106-)?sharke$",sharke,used by microsoft
"^(b106-)?silby$",silby,used by microsoft
"^(b106-)?sillysharecopy$",sillysharecopy,used by microsoft
"^(b106-)?sisproc$",sisproc,used by microsoft
"^(b106-)?skypams$",skypams,used by microsoft
"^(b106-)?smpdoss$",smpdoss,used by microsoft
"^(b106-)?sormoeck$",sormoeck,used by microsoft
"^(b106-)?splori$",splori,used by microsoft
"^(b106-)?spybot$",spybot,malpedia,used by microsoft
"^(b106-)?squida$",squida,used by microsoft
"^(b106-)?ssonce$",ssonce,used by microsoft
"^(b106-)?sulunch$",sulunch,used by microsoft,https://en.wikipedia.org/wiki/Sulunch
"^((b106-)?(swisyn|arhost)|roopirs|ashwho)$",swisyn,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Roopirs.A,https://www.solvusoft.com/en/malware/trojans/tr-swisyn-ubp-13/
"^swizzor$",swizzor,used by microsoft
"^(b106-)?swrort$",swrort,used by microsoft
"^(b106-)?synflood$",synflood,used by microsoft
"^(b106-)?tapazom$",tapazom,used by microsoft
"^(b106-)?tawsebot$",tawsebot,used by microsoft
"^(b106-)?tearspear$",tearspear,used by microsoft
"^((b106-)?tendrit|sesent)$",tendrit,used by microsoft
"^(b106-)?tenpeq$",tenpeq,used by microsoft
"^(b106-)?tobfy$",tobfy,used by microsoft
"^(b106-)?tocofob$",tocofob,used by microsoft
"^(b106-)?toobtox$",toobtox,used by microsoft
"^(b106-)?tumpadex$",tumpadex,used by microsoft
"^(b106-)?turkojan$",turkojan,used by microsoft
"^(b106-)?twores$",twores,used by microsoft
"^(b106-)?vahodon$",vahodon,used by microsoft
"^(b106-)?vake$",vake,used by microsoft
"^(b106-)?vb$",adclicker,used by microsoft,other name because vb is too generic,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/VB
"^adclicker$",adclicker,
"^(b106-)?vbcrypt$",vbcrypt,used by microsoft
"^(b106-)?vbinder$",vbinder,used by microsoft
"^(b106-)?vbinject$",vbinject,used by microsoft
"^(b106-)?vburses$",vburses,used by microsoft
"^(b106-)?vharke$",vharke,used by microsoft
"^(b106-)?vinject$",vinject,used by microsoft,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Vinject.A
"^(b106-)?vonriamt$",vonriamt,used by microsoft
"^(b106-)?vtub$",vtub,used by microsoft
"^(b106-)?weenkay$",weenkay,used by microsoft
"^(b106-)?wervik$",wervik,used by microsoft
"^((b106-)?xtrat|xtreme)$",xtrat,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=BACKDOOR:WIN32/XTRAT.A
"^(b106-)?xyligan$",xyligan,used by microsoft
"^(yayih|bbsinfo|aumlib)$",yayih,https://malpedia.caad.fkie.fraunhofer.de/details/win.yayih
"^(b106-)?yemrok$",yemrok,used by microsoft
"^yonsole$",yonsole,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Yonsole.A&threatId=-2147333563
"^(b106-)?zacusca$",zacusca,used by microsoft
"^(spyvoltar|buterat)$",buterat,shadowserver,https://www.trendmicro.com/vinfo/gb/threat-encyclopedia/malware/troj_ransom.blu
"^(misfox|modpack)$",misfox,malpedia
"^darkshell$",darkshell,malpedia
"^(ircbot|clicker|(ssl-)?unknown-bot-test|downloader|iframe exploit)$",malware-generic,shadowserver
"^(jadtre|killav)$",jadtre,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Jadtre.A
"^renos$",renos,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FRenos
"^daws$",daws,https://www.microsoft.com/en-us/wdsi/threats/threat-search?query=daws Daws is a generic detection that may have overlapped with sanny. But it's more generic than that
"^exobot$",marcher,shadowserver,on android,https://clientsidedetection.com/marcher.html,malpedia
"^(midhos|medfos)$",medfos,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2FMedfos
"^kraken$",kraken,
"^fosniw$",fosniw,
"^patriot$",patriot,
"^(koobface|jnanabot)$",koobface,malpedia,https://en.wikipedia.org/wiki/Koobface,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Boonana-A.aspx,https://www.theregister.co.uk/2011/01/19/mac_linux_bot_vulnerabilities/,https://www.intego.com/mac-security-blog/intego-security-memo-trojan-horse-osxkoobface-a-affects-mac-os-x-mac-koobface-variant-spreads-via-facebook-twitter-and-more/
"^emudbot$",emudbot,
"^vidro$",vidro,
"^eitest$",eitest,
"^dark(c|k)omet$",darkcomet,https://threats.kaspersky.com/en/threat/Backdoor.Win32.DarkKomet/
"^redos(dru)?$",redosdru,https://www.trendmicro.com/vinfo/uk/threat-encyclopedia/malware/troj_redosdru.em/
"^(crash( ?override)?|industroyer)$",industroyer,https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer
"^vpnfilter(-ua|_stage3)?$",vpnfilter,malpedia plus more names
"^(nukebot|nuclear bot|microbankingtrojan|xbot|tinynuke(_md5dga)?)$",tinynuke,malpedia
"^(android\.)?fobus$",fobus,https://blog.avast.com/2015/01/15/fobus-the-sneaky-little-thief-that-could/
"^disorderstatus$",disorderstatus,
"^nionspy$",nionspy,https://www.blackhat.com/docs/eu-15/materials/eu-15-Balduzzi-Cybercrmine-In-The-Deep-Web.pdf
"^stealrat$",stealrat,
"^(worm\.)?phorpiex|trik$",phorpiex,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Phorpiex.M,https://johannesbader.ch/2016/02/phorpiex/
"^(adware\.)?domaiq$",domaiq,adware,https://deletemalware.blogspot.com/2013/06/how-to-remove-domaiq-removal.html https://www.symantec.com/security-center/writeup/2013-060202-4950-99
"^harnig$",harnig,malpedia
"^bulta$",bulta,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_bulta.av
"^(trojan\.|android\.)?fakeav$",malware-generic,https://www.symantec.com/security-center/writeup/2007-101013-3606-99
"^(downloader\.)talalpek$",gootkit,https://blog.trendmicro.com/trendlabs-security-intelligence/avalanche-thwarting-cybercriminal-hazards-with-law-enforcement-collaboration/,maps to xswkit
"^crypdef$",crypdef,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/CRYPDEF
"^harnig$",harnig,malpedia
"^(trojan\.)?autoit$",autoit,https://www.f-secure.com/v-descs/trojan_w32_autoit.shtml
"^pws.pony$",pony,malpedia
"^bebloh$",urlzone,malpedia
"^bulta$",bulta,maybe zeus? https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_zbot.yuyaev,https://malwaredb.nessus.org/malware/4242ddb71fb36f2d760edc9d72c68562
"^((ransom\.)genasom|stampado)$",stampado,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_stampado.a,https://malwarefixes.com/threats/ransomwin32genasom-jc/
"^(b67-ss-trusteer|fake-trusteer-app|(avalanche-|avalanchebotnet-)trusteer)$",fake-trusteer-app,http://blog.shadowserver.org/2016/12/01/avalanche/,cymru
"^tsifiri$",tsifiri,malpedia
"^android\.marcher$",marcher,malpedia
"^(android\.)?smsspy(\.be24)?$",smsspy,malpedia
"^banwarum$",banwarum,https://www.f-secure.com/v-descs/banwarum_a.shtml
"^fakealert$",fakealert,https://www.welivesecurity.com/deutsch/2017/10/12/html-fakealert-malware-welle-europa/
"^yash( |-)rat$",yash-rat,http://www.thecre.com/fnews/wp-content/uploads/2013/05/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf
"^proxyback$",proxyback,https://researchcenter.paloaltonetworks.com/2015/12/proxyback-malware-turns-user-systems-into-proxies-without-consent/
"^ssl-vmzeus$",zeus,shadowserver
"^fakerea(n|m)$",fakerean,probably a typo,malpedia
"^(iot)?satori$",satori,malpedia
"^(android\.)?fakebank$",fakebank,android,https://www.symantec.com/blogs/threat-intelligence/fakebank-intercepts-calls-banks,https://www.cyber.nj.gov/threat-profiles/android-malware-variants/fakebank
"^(avalanche-|avalanchebotnet-|b6[67]-ss-)?smartapp$",smartapp,adware,https://malwaretips.com/blogs/remove-smartapp/,cymru
"^blackbeard$",blackbeard,https://blog.emsisoft.com/en/3613/blackbeard-and-pigeon/
"^(lebreat|reatle|nujama)$",reatle,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Nujama.A,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Reatle.A@mm
"^siggen6$",siggen6,malpedia
"^redyms$",redyms,malpedia
"^dresscode$",dresscode,android,https://blog.checkpoint.com/2016/08/31/dresscode-android-malware-discovered-on-google-play/
"^kryptovor$",kryptovor,https://www.fireeye.com/blog/threat-research/2015/04/analysis_of_kriptovo.html
"^volatile_cedar$",volatile_cedar,https://blog.checkpoint.com/2015/03/31/volatilecedar/
"^x-?agent|chopstick|splm$",xagent,https://en.wikipedia.org/wiki/X-Agent,malpedia
"^(ransom\.)?cerber$",cerber,malpedia
"^((android\.)?smsbot|crosate)$",smsbot,https://news.drweb.com/show/review/?lng=en&i=9463 https://fortiguard.com/encyclopedia/virus/5536402/android-crosate-a-tr
"^coinminer$",coinminer,malpedia
"^keybase$",keybase,keylogger,https://voidsec.com/keybase-en/
"^android[\.-]pwstealer$",android-pwstealer,not the delf* family (pwstealer on windows platform)
"^lurk(banker)?$",lurk,https://securelist.com/lurk-banker-trojan-exclusively-for-russia/75040/ https://www.secureworks.com/research/malware-analysis-of-the-lurk-downloader
"^trafog$",trafog,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?ThreatID=-2147275144
"^dirtjumper$",dirtjumper,https://krebsonsecurity.com/tag/dirt-jumper/
"^hesperbot$",hesperbot,malpedia
"^banatrix$",banatrix,malpedia
"^kovter$",kovter,malpedia
"^quervar$",quervar,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/115/the-significance-of-quervar
"^b67-ss-gozi2$",gozi,
"^adware.eorezo$",adware-eorezo,adware,shadowserver,https://blog.malwarebytes.com/detections/adware-eorezo/,https://www.symantec.com/security-center/writeup/2012-061213-2441-99
"^android.banker$",android-banker,shadowserver,android
"^android.cliaid$",android-cliaid,shadowserver,android
"^bagle$",bagle,shadowserver,malpedia
"^boaxxe$",boaxxe,shadowserver,malpedia
"^(rakhni|crypaura)$",rakhni,shadowserver,malpedia,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_crypaura.a,https://support.kaspersky.com/10556
"^fobber$",fobber,shadowserver,malpedia
"^gspy$",gspy,shadowserver,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Gspy-A/detailed-analysis.aspx
"^hancitor$",hancitor,shadowserver,malpedia
"^htbot$",htbot,shadowserver,malpedia
"^shelltea$",shelltea,shadowserver,https://www.root9b.com/newsroom/shelltea-poslurp-malware/
"^silon$",silon,shadowserver,malpedia
"^tesch$",tesch,shadowserver,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Win32/Tesch
"^umbraloader$",umbraloader,shadowserver,https://zerosecurity.org/2012/04/a-look-into-http-botnets-umbra-loader,https://blog.threattrack.com/umbra-loader-botnet-behind-fake-123greeting-com-spam-campaign/
"^(shadowpad|xshellghost)$",shadowpad,shadowserver,malpedia
"^suppobox$",suppobox,malpedia,cert-bund
"^powersniff$",powersniff,malpedia
"^holycaptcha$",holycaptcha,shadowserver,only 1 mentioning here: https://www.abuseipdb.com/check/185.234.218.74?page=1
"^plasma-tomas$",plasma-tomas,cert.pl,https://zaufanatrzeciastrona.pl/post/tag/thomas/
"^spambot1$",malware-generic,shadowserver
"^multiple-malware unknown-requests$",malware-generic,cert.pl
"^adware[\.-]medialabs$",adware-medialabs,a toolbar?,drone,adware
"^((c_)?trickbot(-fallback)?(-c2)?|trickster|thetrick|trickloader)$",trickbot,malpedia
"^(koceg|(worm_)?mandaph|socks)$",socks,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FMandaph.A&ThreatID=-2147358413 https://www.symantec.com/security-center/writeup/2008-042816-0445-99 https://www.symantec.com/security-center/writeup/2008-042816-0445-99 https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/socks https://www.solvusoft.com/en/malware/worms/socks/
"^(android\.)?occamy$",occamy,android and/or win
"^(pua\.)?sprotector$",sprotector,https://blog.malwarebytes.com/detections/trojan-sprotector/
"^(android\.)uupay$",uupay,https://www.symantec.com/security-center/writeup/2014-061714-1550-99 https://www.heise.de/security/meldung/Vorinstallierte-Spionagesoftware-auf-China-Smartphones-2221792.html pre-installed malware on some android devices from china
"^(loader|cryptojacker)$",malware-generic,SecurityScorecard
"^minr$",minr,https://blog.sucuri.net/2018/02/wikipedia-page-review-revealed-minr-malware.html
"^(android\.)?fakedoc$",fakedoc,android
"^(dybalom|fignotok)$",fignotok,https://www.solvusoft.com/en/malware/trojans/pws-dybalom-gen-a/ https://www.enigmasoftware.com/pwstealfignotoka-removal/
"^(menupass( team)?|apt[- ]?10|stone[ -]?panda|cvnx|hogfish|happyyongzi|potassium|duststorm|red[ -]?apollo|cloud[ -]?hopper)$",stone-panda,apt,malpedia,https://attack.mitre.org/groups/G0045/ https://unit42.paloaltonetworks.com/menupass-playbook-and-iocs/ https://github.com/MISP/misp-galaxy/blob/master/clusters/threat-actor.json
"^(pua\.android\.)?ammob$",ammob,pua,android,securityscorecard.com,adware
"^(android\.)?coolwall$",coolwall,android,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Andr~CoolWall-A.aspx https://www.solvusoft.com/en/malware/potentially-unwanted-application/android-coolwall-d/
"^((android\.)?qysly|ztorg)$",ztorg,malpedia,android,https://www.kaspersky.com/blog/ztorg-botnet/16914/
"^cobalt[ _-]?(group|gang|spider)?$",cobalt,malpedia,https://attack.mitre.org/groups/G0080/
"^(equation[ _-]?group|tilded[ _-]?team|lamberts|eqgrp|longhorn)$",equation_group,malpedia,https://attack.mitre.org/groups/G0020/
"^helminth$",helminth,malpedia https://attack.mitre.org/software/S0170/
"^(apt-generic|unknown-apt)$",apt-generic,
"^(win\.|linux\.)?ngioweb$",ngioweb,malpedia,https://brica.de/alerts/alert/public/1264585/an-analysis-of-linuxngioweb-botnet/ https://blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/
"^(android\.)?rotexy$",rotexy,https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/
"^(android\.)?nitmo$",nitmo,android,https://fortiguard.com/encyclopedia/virus/6042527/android-nitmo-a-tr-spy
"^fallout(\.exploitkit)?$",fallout,exploit-kit,relaed to gandcrab/grandcrab ttps://www.borncity.com/blog/2018/09/10/neues-exploit-kit-fallout-fr-grandcrab-malware/ https://blog.malwarebytes.com/threat-analysis/2019/01/improved-fallout-ek-comes-back-after-short-hiatus/
"^(travle|pylot)$",travle,https://securelist.com/travle-aka-pylot-backdoor-hits-russian-speaking-targets/83455/ travle gives (with malware) much more hits than pylot by factor 100
"^(android\.)?hqwar$",hqwar,android https://threats.kaspersky.com/en/threat/Trojan-Dropper.AndroidOS.Hqwar/ https://www.fortiguard.com/encyclopedia/virus/7197703
"^(android\.micropsia|vamp)$",vamp,android variant of micropsia: https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/
"^(android\.)?erop$",erop,android https://fortiguard.com/encyclopedia/virus/6994311/android-erop-hh-tr http://amd.arguslab.org/families/Erop.html
"^(android\.)?infosteal(er)?$",infosteal,https://www.virustotal.com/gui/file/62aaff01aef5b67637676d79e8ec40294b15d6887d9bce01b11c6ba687419302/detection https://apkscan.nviso.be/report/show/0996e0700d4ad8ecc11f054453db03aa
"^(android\.)?(premiumtext|rufraud)$",rufraud,https://www.theverge.com/2011/12/14/2635274/google-malware-apps-android-market-rufraud https://www.symantec.com/security-center/writeup/2011-121306-2304-99
"^wrokni$",wrokni,securityscorecard https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Wrokni.B&ThreatID=2147735052
"^(android\.)?faketelegram$",faketelegram,securityscorecard anroid https://success.alienvault.com/s/question/0D50Z000099ZOHCSA4/alien-labs-threat-intelligence-update-for-usm-anywhere-april-21-april-27-2019
"^(android\.)?teleplus$",teleplus,SecurityScorecard
"^nametrick$",nametrick,SecurityScorecard https://www.threatminer.org/av.php?q=Nametrick.Gen!c
"^(powerstats|valyria)$",powerstats,apt,SecurityScorecard,malpedia
"^cryptoloot$",cryptoloot,SecurityScorecard
"^(android\.)?hiddad$",hiddad,android,SecurityScorecard,https://blog.avira.com/top-rated-android-malware/ https://fortiguard.com/encyclopedia/virus/8034587
"^webprefix$",webprefix,SecurityScorecard https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_dldr.smus1 https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_webpre.smum https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FWebprefix&ThreatID=-2147363402
"^(infostealer\.)?banbrox$",banbrox,SecurityScorecard
"^(android\.)?milipnot$",milipnot,SecurityScorecard https://www.symantec.com/security-center/writeup/2014-070414-0941-99 https://pr.norton.com/online-threats/android.milipnot-2014-070414-0941-99-writeup.html
"^android\.locker$",malware-generic,SecurityScorecard,no information found on this / too generic
"^fake_cs_updater$",malware-generic,SecurityScorecard,no information found on this / too generic
"^(android\.bankspy|(android\.bank(bot|er)\.)?anubis|bankbot)$",anubis,for bankbot<->anubis see also malpedia,SecurityScorecard,android, https://securityboulevard.com/2018/09/android-malware-intercepts-sms-2fa-we-have-the-logs/ https://www.virustotal.com/gui/file/6e67e665d4d9f8bac672b4f8ffda95ae908052f9535ad422ebd2cc66297f69df/detection
"^(android\.)?gopl$",gopl,clicker,SecurityScorecard,android
"^(android\.)?asacub$",asacub,SecurityScorecard,android,malpedia
"^mysafeproxymonitor$",mysafeproxymonitor,
"^madominer$",madominer,https://www.alienvault.com/blogs/labs-research/madominer-part-1-install
"^(phishing\.cobalt(gang)?|cobalt-phishing)$",cobalt-phishing,client accessed a phishing site of cobalt?
"^((pua\.)?ghokswa|(ghokswa|gotoe)[ _-]browser)$",ghokswa,pua,https://www.symantec.com/security-center/writeup/2016-113011-1458-99
"^presenoker$",presenoker,https://fortiguard.com/encyclopedia/virus/7856797 SecurityScorecard
"^teleru$",teleru,android?,adware SecurityScorecard http://www.marc-blanchard.com/BotInvaders/
"^(ransomware\.)?shade$",troldesh,SecurityScorecard malpedia
"^qsnatch$",qsnatch,SecurityScorecard,https://www.kyberturvallisuuskeskus.fi/en/news/qsnatch-malware-designed-qnap-nas-devices
"^extenbro$",extenbro,adware,https://blog.malwarebytes.com/trojans/2019/07/extenbro-a-new-dns-changer-trojan-protecting-adware/
"^sgminer$",sgminer,modified versions of the original software? SecurityScorecard https://github.com/zcoinofficial/sgminer https://bitcointalk.org/index.php?topic=975296.0
"^mitrok$",mitrok,SecurityScorecard
"^xmrminer$",xmrminer,SecurityScorecard
"^(android\.)?boogr$",boogr,https://fortiguard.com/encyclopedia/virus/8076779 https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Andr~Boogr-A/detailed-analysis.aspx http://www.mobishield.net/security/en/virus.php?vn=Android.Trojan.Boogr
"^(android\.)?milkydoor$",milkydoor,https://blog.trendmicro.com/trendlabs-security-intelligence/dresscode-android-malware-finds-successor-milkydoor/ https://www.cyber.nj.gov/threat-profiles/android-malware-variants/milkydoor
"^lucky[_.-]?elephant$",lucky-elephant,apt,https://de.netscout.com/blog/asert/lucky-elephant-campaign-masquerading
"^(android\.)?geost$",geost,android,https://threatpost.com/virus-bulletin-geost-android-botnet/148864/
"^racc?oon$",raccoon,malpedia
"^qrypter(\.rat)?$",qrypter,https://securityaffairs.co/wordpress/83042/malware/decrypting-qrypter-payload.html
"^(android\.)?iop$",iop,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Android%20Iop.aspx
"^(android\.)?fungram$",fungram,android,adware,SecurityScorecard
"^android\.lockdroid$",android.lockdroid,https://www.securityweek.com/lockdroid-ransomware-can-lock-smartphones-erase-data
"^android\.voxv$",android.voxv,https://www.f-secure.com/v-descs/trojan_android_voxv_b.shtml
"^((win.)?disttrack|(apt33\.)?shamoon)$",disttrack,malpedia
"^(phishing[ ._-]?cobalt[ ._-]?dickens|cobalt[ ._-]?dickens[ ._-]?phishing)$",cobalt-dickens-phishing,client accessed a phishing site of cobalt dickens?,SecurityScorecard,Cobalt Dickens -> MISP Threat Actors
"^((win\.)?tibs|zhelatin)$",win.tibs,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/archive/malware/troj_tibs.ii
"^(trojan\.win32\.razy\.gen|win\.razy)$",win.razy,https://threatpost.com/razy-browser-extensions-theft/141181/ https://www.kaspersky.com/blog/razy-trojan-cryptocurrency-stealer/25454/
"^(elf\.)?xbash$",elf.xbash,malpedia
"^(js\.)?nemucod$",js.nemucod,https://www.mcafee.com/blogs/other-blogs/mcafee-labs/javascript-php-joint-exercise-delivers-nemucod-ransomware/
"^b80(-(dga|p2p-(super)?node|c2-core|c2-dga|c2-proxy|c2-spam))$",necurs,microsoft
"^(linux\.)?iot_?reaper$",iot_reaper,malpedia
"^(adware\.android\.admob|android.adware-admob)$",android.adware-admob,adware
"^android\.sssaaa$",android.sssaaa,
"^android\.yunclound$",android.yunclound,
"^android\.bakdoor(\.|-)prizmes$",android.bakdoor-prizmes,
"^((win\.)?revil|sodinokibi|sodin)$",win.revil,malpedia
"^(trojan\.)?doorway$",doorway,
"^android\.faketoken$",android.faketoken,
"^android\.fusob$",android.fusob,
"^android\.provac$",android.provac,
"^android\.samsapo$",android.samsapo,
"^cryptominer\.rocke$",cryptominer.rocke,https://redcanary.com/blog/rocke-cryptominer/
"^generic\.malware$",malware-generic,
"^((osx\.)?bundlore|surfbuyer)$",osx.bundlore,malpedia
"^(win\.)?flystudio$",win.flystudio,malpedia
"^(apk\.)?podec$",apk.podec,malpedia
"^(js\.)?powmet$",js.powmet,malpedia
"^(apk\.)?triada$",apk.triada,malpedia
"^(android\.)?skyfin$",skyfin,https://cyber.nj.gov/threat-profiles/android-malware-variants/skyfin
"^(js\.)?valak$",valak,malpedia
"^adsock$",adsock,not only adware,proxy
"^alimenmain$",alimenmain,not only adware,file infector,https://www.fortiguard.com/encyclopedia/virus/7824661 https://www.virusradar.com/en/Win32_Adware.AlimenMain.A/description
"^allsharezdownloader$",allsharezdownloader,https://www.elevenpaths.com/wp-content/uploads/2020/01/cybersecurity-report-19h2-EN.pdf
"^amcleaner$",amcleaner,adware,PUA,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=trojan:macos/amcleaner&ThreatID=2147734671
"^amonetize$",amonetize,adware,https://blog.malwarebytes.com/detections/adware-amonetize/
"^apptrack$",apptrack,pua,not only adware,infostealer,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Android%20Apptrack.aspx
"^arrkiisdk$",arrkiisdk,not only adware, also RAT,https://www.bitsight.com/blog/fraudulent-android-advertising-sdk-installed-in-over-15-million-devices,https://www.bitsight.com/blog/identifying-unique-risks-of-work-from-home-remote-office-networks
"^bhproxies$",bhproxies,https://www.elevenpaths.com/wp-content/uploads/2020/01/cybersecurity-report-19h2-EN.pdf
"^cheica$",cheica,android,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Andr~Axent-AX.aspx
"^contentexplorer$",contentexplorer,adware,https://fortiguard.com/encyclopedia/virus/7704383
"^cooee$",cooee,not only adware,downloader,rat,https://www.bitsight.com/blog/pre-installed-android-threats-data-insights
"^coudw$",coudw,https://www.f-secure.com/v-descs/trojan_android_coudw.shtml
"^dealply$",dealply,adware,https://blog.malwarebytes.com/detections/adware-dealply/
"^deathring$",deathring,https://blog.lookout.com/deathring
"^downguide$",downguide,adware,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.downguide.ga
"^droidrooter$",droidrooter,android,exploit,https://www.f-secure.com/v-descs/exploit_android_droidrooter.shtml
"^elex$",elex,adware,https://blog.malwarebytes.com/detections/adware-elex/
"^emergencyminer$",emergencyminer,unknown miner
"^eorezo$",eorezo,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/EoRezo
"^ezyoutubevideodownloader$",ezyoutubevideodownloader,adware,https://forums.spybot.info/showthread.php?71995-Manual-Removal-Guide-for-EZYouTubeVideoDownloader
"^flocker$",flocker,ransomware,https://blog.trendmicro.com/trendlabs-security-intelligence/flocker-ransomware-crosses-smart-tv/
"^getnow$",getnow,adware,https://malwaretips.com/blogs/pup-optional-getnow-a-removal/
"^ginkgosdk$",ginkgosdk,https://www.elevenpaths.com/wp-content/uploads/2020/01/cybersecurity-report-19h2-EN.pdf
"^gyplyra$",gyplyra,miner,
"^loadmoney$",loadmoney,adware,https://blog.malwarebytes.com/detections/adware-loadmoney/
"^lulusoftware$",lulusoftware,adware,https://fortiguard.com/encyclopedia/virus/7807394
"^netutils$",netutils,adware,https://blog.malwarebytes.com/detections/adware-netutils/
"^nsabuffminer$",nsabuffminer,miner
"^pcspeedup$",pcspeedup,adware,https://malwaretips.com/blogs/pup-optional-pcspeedup-a-removal/
"^pennybee$",pennybee,adware,https://blog.malwarebytes.com/detections/adware-pennybee/
"^polacinio$",polacinio,not only adware,spyware,trojan,
"^popdeals$",popdeals,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/PopDeals.aspx
"^preamo$",preamo,not only adware,PUA,clickfraud,android,https://cyware.com/news/preamo-adware-affects-90-million-android-devices-in-new-ad-fraud-campaign-f02c14ab
"^prizerat$",prizerat,RAT,https://www.osi.es/es/servicio-antibotnet/info/prizerat
"^pushiran$",pushiran,android,botnet,https://www.osi.es/es/servicio-antibotnet/info/pushiran,https://blog.certfa.com/posts/pushiran-dl-malware-family/
"^redirector\.?paco$",redirectorpaco,https://www.theregister.com/2016/05/17/redirectorpaco/?ma=1505520015001
"^regiskazi$",regiskazi,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3AWin32%2FRegiskazi.A
"^rootstv$",rootstv,https://www.elevenpaths.com/wp-content/uploads/2020/01/cybersecurity-report-19h2-EN.pdf
"^simplelocker$",simplelocker,ransomware,https://www.enigmasoftware.com/simplelockerransomware-removal/
"^snsminer$",snsminer,miner
"^socstealer$",socstealer,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/SocStealer.D!ibt&threatId=-2147223243
"^sokuxuan$",sokuxuan,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Sokuxuan&ThreatID=243611
"^speesipro$",speesipro,
"^tibiapasswordsteal$",tibiapasswordsteal,stolen information?
"^vittalia$",vittalia,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Vittalia.aspx
"^ztorgpok$",ztorgpok,not only adware,downloader
"^zurgop$",zurgop,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Zurgop.A!MTB&ThreatID=2147751321
"^adposhel$",adposhel,adware,https://blog.malwarebytes.com/detections/adware-adposhel/
"^bandoo$",bandoo,not only adware,pua,rootkit capabilities,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Bandoo https://malwaretips.com/blogs/pup-optional-bandoo-a-virus/
"^cloudguard$",cloudguard,not only adware,changes DNS servers,https://forums.malwarebytes.com/topic/166590-removal-instructions-for-cloudguard/
"^coinge$",coinge,android,miner,https://threats.kaspersky.com/en/threat/Trojan.AndroidOS.Coinge/
"^drosel$",drosel,android,
"^(emoti|emold|bezopi)$",emoti,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/emoti
"^fkcodec$",fkcodec,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~FkCodec-A/detailed-analysis.aspx
"^freecoins$",freecoins,adware,https://www.enigmasoftware.com/pupfreecoins-removal/
"^ibryte$",ibryte,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/iBryte!ml&ThreatID=264621
"^(installbrain|mevade|sefnit)$",sefnit,not only adware,PUA,downloader,https://blog.trendmicro.com/trendlabs-security-intelligence/when-adware-go-bad-the-installbrain-and-sefnit-connection/ https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/136/adware-gone-bad-the-adware-and-mevadesefnit-connection
"^iropsspy$",iropsspy,IrOpsSpy trojan
"^komodia$",komodia,not only adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Komodia https://en.wikipedia.org/wiki/Superfish
"^lolza$",lolza,android,not only adware, trojan,lolza
"^mediadrug$",mediadrug,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/MediaDrug/detailed-analysis.aspx
"^opfake$",opfake,android,https://www.f-secure.com/v-descs/trojan_android_opfake.shtml
"^pcshare$",pcshare,apt,RAT,https://www.bluvector.io/threat-report-pcshare-fake-narrator/
"^pullupdate$",pullupdate,adware,https://blog.malwarebytes.com/detections/adware-pullupdate/
"^renocidey$",renocidey,http://disinstallaspywarevirus.blogspot.com/2014/02/disinstallare-renocidey.html
"^smartapps$",smartapps,adware,https://fortiguard.com/encyclopedia/virus/6539760
"^sprovider$",sprovider,android,trojan,https://news.drweb.com/show/?i=10345&lng=en
"^strongvault$",strongvault,adware,https://malwaretips.com/blogs/strongvault-virus/
"^toptools$",toptools,not only adware,downloader,https://fortiguard.com/encyclopedia/virus/6862338/riskware-toptools
"^ubot$",ubot,https://www.webroot.com/blog/2012/01/26/a-peek-inside-the-ubot-malware-bot/
"^wtsadforcer$",wtsadforcer,adware
"^medusa(http)?$",medusa,malpedia
"^addlyrics$",addlyrics,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/AddLyrics.aspx https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/AddLyrics
"^adoupminer$",adoupminer,fake Adobe Updater?
"^airpush$",airpush,android,not only adware,https://www.f-secure.com/v-descs/trojan_android_airpush.shtml abuses gunpoder? https://unit42.paloaltonetworks.com/new-android-malware-family-evades-antivirus-detection-by-using-popular-ad-libraries/
"^allinone$",allinone,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/AllInOne.aspx
"^alman(ahe)?$",alman,https://threats.kaspersky.com/en/threat/Virus.Win32.Alman/ https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Almanahe.B
"^alnaddy$",alnaddy,adware,https://www.sophos.com/de-de/threat-center/threat-analyses/adware-and-puas/Alnaddy/detailed-analysis.aspx
"^armour$",armour,adware,http://www.expertsupportnow.com/1564/how-to-remove-windows-armour-master-spyware-malware/ ?
"^banbra$",banbra,https://threats.kaspersky.com/de/threat/Trojan-Banker.Win32.Banbra/
"^(beci|vefo)$",beci,not only adware,trojan,downloader,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_dload.beci
"^bettersurf$",bettersurf,adware,https://malwaretips.com/blogs/bettersurf-virus-removal/
"^bitcro$",bitcro,adware,https://malwaretips.com/blogs/remove-search-bitcro-com/
"^bluelabs$",bluelabs,adware,https://www.enigmasoftware.com/deskbartoolbar-removal/
"^braintest$",braintest,android,not only adware,downloader,evades detection,aims for persistency,rootkit,https://blog.checkpoint.com/2015/09/21/braintest-a-new-level-of-sophistication-in-mobile-malware/
"^(brontok|rontokbro)$",brontok,Rontokbro
"^capper$",capper,https://threats.kaspersky.com/en/threat/Trojan-Banker.Win32.Capper/
"^cashreminder$",cashreminder,adware,https://help.bytefence.org/remove-cashreminder
"^changehead$",changehead,
"^cryoloader$",cryoloader,downloader,
"^dealrunner$",dealrunner,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/DealRunner/detailed-analysis.aspx
"^dowgin$",dowgin,not only adware,spyware,https://www.f-secure.com/sw-desc/adware_android_dowgin.shtml
"^ewind$",ewind,not only adware,spyware including SMS,RAT,trojan,https://unit42.paloaltonetworks.com/unit42-ewind-adware-applications-clothing/
"^fastdiscountz$",fastdiscountz,adware
"^febipos$",febipos,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper%3AWin32%2FFebipos.A
"^fighterpos$",fighterpos,https://blog.trendmicro.com/trendlabs-security-intelligence/fighterpos-gets-worm-routine/
"^foreign$",foreign,ransomware,by bitsight
"^fsocietyminer$",fsocietyminer,miner
"^gamevance$",gamevance,
"^geekiu$",geekiu,not only adware,spyware,https://www.f-secure.com/sw-desc/adware_w32_gamevance.shtml
"^gidby$",gidby,android,not only adware
"^gigaclicks$",gigaclicks,pua,not only adware,https://malwaretips.com/blogs/pup-optional-gigaclicks-a-removal/
"^hahomedia$",hahomedia,adware,https://malwaretips.com/blogs/hahomedia-removal/
"^helpexpress$",helpexpress,not only adware,downloader,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/HelpExpress.aspx
"^hormesu$",hormesu,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Hormesu.A
"^idkeystor$",idkeystor,infostealer
"^installiq$",installiq,not only adware,spyware,PUA,downloader,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/InstallIQ.aspx https://malwaretips.com/blogs/remove-win32-installiq-a-virus/ https://security.stackexchange.com/questions/8602/how-serious-is-installiq
"^levida$",levida,android,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Andr~Levida-A/detailed-analysis.aspx https://fortiguard.com/encyclopedia/virus/6871422
"^mmarketpay$",mmarketpay,android,https://www.zdnet.com/article/new-android-malware-infects-100000-chinese-smartphones/
"^mocean$",mocean,adware,https://fortiguard.com/encyclopedia/virus/7342074 https://uk.pcmag.com/opinion/61961/androids-biggest-threat-adware
"^monerominerdownloader$",monerominerdownloader,downloader
"^(navegaki|kazy)$",navegaki,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Navegaki.aspx
"^nextsinc$",nextsinc,not only adware,
"^nightwoodsminer$",nightwoodsminer,miner
"^noticemob$",noticemob,android,https://www.fortiguard.com/encyclopedia/mobile/5692377
"^novelminer$",novelminer,miner
"^offerswizard$",offerswizard,adware,https://malwaretips.com/blogs/ads-by-offerswizard-virus/
"^pcoptimizerpro$",pcoptimizerpro,adware,https://blog.malwarebytes.com/detections/pup-optional-pcoptimizerpro/
"^pricegong$",pricegong,adware,https://malwaretips.com/blogs/pricegong-removal/
"^(reyng|mobclick|appoffer)$",appoffer,not only adware,android,https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Andr~Reyng-A.aspx https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Android%20AppOffer.aspx
"^ruautoklick$",ruautoklick,adware
"^sandrorat$",sandrorat,RAT,android,
"^simpo$",simpo,android,clickfraud,https://www.sophos.com/de-de/threat-center/threat-analyses/viruses-and-spyware/Andr~Simpo-A/detailed-analysis.aspx
"^stormwatch$",stormwatch,adware,https://malwaretips.com/blogs/stormwatch-removal/
"^topshape$",topshape,adware,https://malwaretips.com/blogs/remove-topshape/
"^vbates$",vbates,adware,https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/VBates/detailed-analysis.aspx
"^visualbee$",visualbee,adware,https://malwaretips.com/blogs/pup-optional-visualbee-removal/
"^vkontaktedj$",vkontaktedj,adware,https://www.sophos.com/de-de/threat-center/threat-analyses/adware-and-puas/VKontakteDJ.aspx
"^vkshare$",vkshare,android
"^vopackage$",vopackage,adware,https://blog.malwarebytes.com/detections/pup-optional-vopackage/
"^wincrackloader$",wincrackloader,not only adware,downloader
"^wintoflashsuggestor$",wintoflashsuggestor,adware,http://windowsbulletin.com/malware/adware/wintoflashsuggestor
"^xpkit$",xpkit,not only adware,downloader,spyware
"^zadmo$",zadmo,android,not only adware,downloader
"^zombieboy$",zombieboy,miner,https://securityintelligence.com/news/new-crypto-mining-malware-zombieboy-exploits-multiple-cves-for-maximum-impact/
"^bru-idownloader$",bru-idownloader,downloader
"^gploader$",gploader,not only adware,clickfraud,downloader,on android,https://vms.drweb.com/virus/?i=8058235&lng=en https://www.secure-one.de/cms/doctor-web-virenanalyse-fuer-den-monat-april-2016/
"^shieldsoft$",shieldsoft,adware,http://www.shieldsoft.net/ ?
"^spcoptimizer$",spcoptimizer,PUA,https://www.enigmasoftware.com/spcoptimizer-removal/
"^tvydownloader$",tvydownloader,downloader
"^weatherbuddy$",weatherbuddy,adware,https://malwaretips.com/blogs/ads-by-weather-buddy-removal/
"^zacinlo$",zacinlo,https://www.difesaesicurezza.com/en/cyber-en/here-it-is-zacinlo-a-malware-that-is-operating-in-stealth-since-6-years/
"^arcadetwist$",arcadetwist,adware,https://www.bleepingcomputer.com/virus-removal/remove-powered-by-arcadetwist-ads
"^mediaupdater$",mediaupdater,adware,https://malwaretips.com/blogs/remove-media-updater-ads/
"^zemot$",zemot,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Zemot
"^adylkuzz$",adylkuzz,miner,https://www.bleepingcomputer.com/news/security/adylkuzz-cryptocurrency-miner-may-have-saved-you-from-the-wannacry-ransomware/
"^afkbloader$",afkbloader,
"^ambler$",ambler,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/116/ambler-variants-steal-banking-information
"^artifactdeckminer$",artifactdeckminer,
"^criorrcsminer$",criorrcsminer,
"^dmisk$",dmisk,not only adware,spyware,banking,clickfraud,on android,https://news.softpedia.com/news/ads-on-news-sites-pushed-malware-infected-android-upgrade-package-503694.shtml
"^enginebox$",enginebox,banking,https://isc.sans.edu/forums/diary/EngineBox+Malware+Supports+10+Brazilian+Banks/22736/
"^fakesysdef$",fakesysdef,https://en.wikipedia.org/wiki/Fakesysdef
"^(hideandseek|hns)$",hideandseek,linux,malpedia
"^inmobi$",inmobi,not only adware,PUA,spyware,https://techbizweb.com/remove-ads-by-inmobi-from-android-and-windows-how-to-technology-and-pc-security-forum/
"^installcore$",installcore,not only adware,https://en.wikipedia.org/wiki/InstallCore
"^kemoge$",kemoge,on android,spyware,not only adware
"^miruotaa$",miruotaa,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Miruotaa.A&ThreatID=-2147280667
"^mobilespy$",mobilespy,on android,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=MonitoringTool%3AAndroidOS%2FMobileSpy
"^mupad$",mupad,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Mupad.A
"^nightclick$",nightclick,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/NightClick
"^rtmbank$",rtmbank,not (only) adware
"^smssend$",smssend,https://www.f-secure.com/v-descs/trojan_android_smssend.shtml
"^ternanu$",ternanu,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/worm_ternanu.c
"^wapomi$",wapomi,https://www.virusbulletin.com/virusbulletin/2014/06/wapomi/
"^winoptimizer$",winoptimizer,PUP,https://blog.malwarebytes.com/detections/pup-optional-winoptimizer/
"^yelloader$",yelloader,not only adware,https://blog.malwarebytes.com/detections/adware-yelloader/
"^(trojan\.)?click3$",click3,SecurityScorecard,https://news.drweb.com/show/?i=12955&lng=en https://www.it-daily.net/it-sicherheit/cyber-defence/20186-windows-clicker-und-neuer-mining-trojaner-fuer-linux
"^minerd$",minerd,monero miner
"^oxypumper$",oxypumper,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/OxyPumper&ThreatID=250532
"^bubble[ _-]?dock$",bubbledock,adware,https://nicolascoolman.eu/en/2017/09/08/adware-bubbledock/ https://www.sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/Bubble%20Dock/detailed-analysis.aspx
"^jpiproxy$",jpiproxy,trojan
"^superoptimizer$",superoptimizer,adware
"^mewishid$",mewishid,adware,https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Mewishid&ThreatID=250449 https://www.fortiguard.com/encyclopedia/virus/7137151
"^b98-(beacon|download|execcmd|exfil|register|bdns)$",trickbot,names used by microsoft
"^(linux\.backdoor\.|elf\.)?setag$",elf.setag,https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Backdoor.Linux.SETAG.RPA/
"^(android\.|apk\.)?hummer$",apk.hummer,https://www.techrepublic.com/article/1-2-million-infected-android-malware-hummer-could-be-biggest-trojan-ever/ https://www.tripwire.com/state-of-security/latest-security-news/hummer-malware-the-1-mobile-trojan-in-the-world/
"^sunburst$",sunburst,
"^dltminer$",dltminer,https://blog.reasonsecurity.com/2021/03/17/exchange-server-vuln-exploiter-collection-of-thoughts-on-dltminer/
"^(flubot|cabassous|fakechat)$",flubot,https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Botnetze/Steckbriefe-aktueller-Botnetze/Steckbriefe/Flubot.html https://securityblog.switch.ch/2021/06/19/android-flubot-enters-switzerland/
"^babydraco$",babydraco,https://krebsonsecurity.com/2021/03/no-i-did-not-hack-your-ms-exchange-server/
"^(android\.|apk\.)?darksilent$",apk.darksilent,https://www.shadowserver.org/what-we-do/network-reporting/sinkhole-http-events-report/