---
id: "malpedia_family_id"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["software"]
langs: ["common"]
quality: 75
url: "https://registry.apicrafter.io/datatype/malpedia_family_id"
---

# Malpedia malware family ID (`malpedia_family_id`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Identifier of a malware family in Malpedia, the malware corpus and reference library run by Fraunhofer FKIE: a platform prefix, a period and the family name in lowercase, with underscores (and rarely hyphens) between words, for example win.agent_tesla. The prefixes in use are aix, apk, asp, elf, fas, ios, jar, js, jsp, osx, php, pl, ps1, py, sh, symbian, vbs and win. The family page is https://malpedia.caad.fkie.fraunhofer.de/details/<id>, and Wikidata property P9096 stores that path (details/<id>).

- Personal data (PII): no
- Categories: Software development (software)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^(?:aix|apk|asp|elf|fas|ios|jar|js|jsp|osx|php|pl|ps1|py|sh|symbian|vbs|win)\.[a-z0-9][a-z0-9_-]*$
```

## Examples

- `win.agent_tesla` — Agent Tesla (Windows)
- `elf.mirai` — Mirai (ELF)
- `apk.anatsa` — Anatsa (Android APK)
- `Win.Agent_Tesla` (invalid example) — Uppercase letters
- `agent_tesla` (invalid example) — Platform prefix is missing

## Sources

- other: <https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla>
- doc: <https://malpedia.caad.fkie.fraunhofer.de/api/list/families>

## Quality

Score 75/100. Missing: mapping (Wikidata, Schema.org, ...), translation, detector coverage.

JSON: <https://registry.apicrafter.io/api/v1/datatypes/malpedia_family_id.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/software/malpedia_family_id.yaml>