malware_families_behaviour.json

{
  "1": "Primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking",
  "2": "Lollipop Virus",
  "3": "Kelihos Botnet in ver3",
  "4": "VUNDO is a family of Trojans, adware, and spyware first spotted in 2004. It usually arrives as a bundle of components, downloaded from malicious websites.",
  "5": "Simda Botnet",
  "7": "Kelihos Botnet in ver1",
  "8": "This threat has been 'obfuscated', which means it has tried to hide its purpose so your security software doesn't detect it. The malware that lies underneath this obfuscation can have almost any purpose.",
  "9": "Stegoloader(Hide Botnet malwares in png images)",
  "10": "Installs multiple files in the LocalAppData folder, each of which controls different functions including disabling bootup recovery options, deleting the ransomware installation file, encrypting data, and gaining administrator privileges.",
  "11": "9002 RAT is a Remote Access Tool typically observed to be used by an APT to control a victim's machine",
  "15": "BazarBackdoor is a small backdoor, probably by a TrickBot 'spin-off' like anchor. Its called team9 backdoor (and the corresponding loader: team9 restart loader).",
  "18": "Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named 'Beacon' on the victim machine.",
  "19": "Conti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems.",
  "21": "The Dyre Banking Trojan, discovered in June 2014, targets online banking websites for credential theft and fraud. It uses a man-in-the-browser approach, encryption, and spam emails for distribution.",
  "22": "Spammed via email",
  "23": "It was designed to attack web servers, Android devices and content management systems (CMS) servers.",
  "24": "The malware is able to control banking transactions conducted using Internet Explorer, and harvest email credentials, which are in turn used to spread the malware further.",
  "25": "A Trojan that spreads using Microsoft's LNK vulnerability",
  "28": "According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.",
  "30": "GandCrab was a Ransomware-as-a-Service (RaaS) emerged in January 28, 2018, managed by a criminal organization known to be confident and vocal, while running a rapidly evolving ransomware campaign.",
  "35": "Hakbit ransomware is written in .NET. It uploads (some) files to be encrypted to a ftp-server.",
  "37": "HotCroissant is a remote access trojan (RAT) attributed by U.S. government entities to malicious North Korean government cyber activity, tracked collectively as HIDDEN COBRA. HotCroissant shares numerous code similarities with Rifdoor.",
  "39": "Infy malware",
  "41": "The framework is written in Python and can generate JScript and VBScript payloads which can be written to disk or mapped directly into memory. Its capabilities include remote desktop access, command execution, lateral movement via SMB, file transfer, credential theft using Mimikatz, port scanning, and system information collection. It can also collect specific system information and targeted files based on their name or extension.",
  "42": "Korlia malware",
  "43": "Kwampirs is a family of malware which uses SMB to spread. It typically will not execute or deploy in environments in which there is no publicly available admin$ share. It is a fully featured backdoor which can download additional modules. Typical C2 traffic is over HTTP and includes 'q=[ENCRYPTED DATA]' in the URI",
  "50": "While MNKit has been associated with multiple different groups the reuse of domain names, IPv4 addresses, phishing themes, XOR schemes, and email accounts are strong evidence for linkage between these new attacks and the previously documented ones.",
  "51": "According to PCrisk, ModernLoader, also known as Avatar Bot and AvatarLoader, is a malicious program that has minimalistic loader and RAT (Remote Access Trojan) functionalities.",
  "53": "Necurs BotNet",
  "54": "it is a malware that takes control of infected PCs and allows its operators to perform various actions.",
  "55": "The worm is bound to Androm and is downloaded to the user's computer, and can be spread through HTTP, FTP, MSN, email, USB flash drive and other means, once the user is infected with this worm, it will immediately steal the user's password and privacy information, including the user's e-banking, social networking sites, email password, FTP password and MSN friend information. At the same time, the virus monitors the files downloaded by the user and collects the user's Internet habits. Infected users form a large botnet that is used to attack a certain target.",
  "56": "Ohagi malware",
  "57": "The baseconfig (c2, crypto material, botnet name, version) is embedded in the malware itself. It then obtains a dynamic config from the c2, with further information about how to grab the webinjects and additional modules, such as vnc, backsocks and grabber.",
  "58": "At its core, PowerStager is a Python script that uses C source code to generate a Windows executable file, then leverages multiple layers of obfuscation to launch the PowerShell script, with the ultimate goal of executing the shellcode payload.",
  "59": "Use a simple but tricky way to abuse legitimate AutoIt software to execute the payload of Predator the Thief",
  "61": "QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.",
  "62": "QtBot Used to Distribute Trickbot and Locky",
  "63": "Ramdo is a trojan that does click-fraud. It might disable some features of your security software.",
  "64": "RansomExx is a ransomware family that targeted multiple companies starting in mid-2020. It shares commonalities with Defray777.",
  "65": "RawPOS is a point-of-sale (POS) malware family that searches for cardholder data on victims.",
  "67": "ELF version of win.revil targeting VMware ESXi hypervisors.",
  "68": "Rovnix is a bootkit and consists of a driver loader (in the VBR) and the drivers (32bit, 64bit) themselves. It is part of the Carberp source code leak (https://github.com/nyx0/Rovnix). Rovnix has been used to protect Gozi ISFB, ReactorBot and Rerdom (at least).",
  "70": "Sierra",
  "72": "Stantinko group is known for targeting Windows operating systems with ongoing campaigns dating back to 2012. The group’s malware mainly consists of coin-miners and adware botnets",
  "74": "Linux rootkit",
  "76": "Upatre is primarly a downloader. It has been discovered in 2013 and since that time it has been widely updated. Upatre is responsible for delivering further malware to the victims, in specific upatre was a prolific delivery mechanism for Gameover P2P in 2013-2014 and then for Dyre in 2015.",
  "77": "Winmm.dll, also known as the Windows Multimedia API, is a dynamic link library file that is an integral part of the Windows operating system. It contains functions and resources that allow applications to interact with multimedia devices and services.",
  "78": "North Korea-Aligned TA406 Scams, Spies, and Steals",
  "79": "According to CrowdStrike, The two primary goals of the Zeus trojan horse virus are stealing people's financial information and adding machines to a botnet. Unlike many types of malware, most Zeus variants try to avoid doing long-term damage to the devices they infect. Their aim is to avoid detection from antivirus software.",
  "80": "This family describes the (initially small) loader, which downloads Zeus OpenSSL.",
"86":"common behaviour: trojan",
"87":"common behaviour: trojan",
"88":"common behaviour: trojan",
"89":"common behaviour: trojan",
"90":"common behaviour: worm",
"92":"common behaviour: backdoor",
"94":"common behaviour: worm",
"95":"common behaviour: trojan",
"98":"common behaviour: ransomware",
"99":"common behaviour: trojan",
"100":"common behaviour:  trojan",
"102":"common behaviour:  trojan",
"103":"common behaviour:  worm",
"105":"common behaviour:  trojan",
"107":"common behaviour:  worm",
"108":"common behaviour:  trojan",
"109":"common behaviour:  backdoor",
"110":"common behaviour:  trojan",
"111":"common behaviour:  worm",
"114":"common behaviour:  trojan",
"115":"common behaviour:  backdoor",
"116":"common behaviour:  worm",
"117":"common behaviour:  trojan",
"118":"common behaviour:  trojan",
"119":"common behaviour:  worm",
"123":"common behaviour:  trojan, cryptominer",
"124":"common behaviour:  backdoor",
"125":"common behaviour:  worm, dropper, trojan",
"126":"common behaviour:  worm",
"127":"common behaviour:  trojan",
"128":"common behaviour:  trojan",
"131":"common behaviour:  trojan",
"132":"common behaviour:  trojan, downloader",
"136":"common behaviour:  backdoor",
"137":"common behaviour:  trojan"
}