Metacrafter Registry

Datatypes

Microsoft malware name

ID microsoft_malware_name

DatatypeNot PIIcategoricalDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Name that Microsoft Defender and other Microsoft anti-malware products give to a detected threat, following the CARO scheme in the form Type:Platform/Family.Variant!Suffix. Type says what the threat does (Trojan, Backdoor, Ransom, HackTool, PUA and others), Platform names the operating system, script language, macro type or file format it targets (Win32, AndroidOS, MSIL, O97M), Family groups related samples, the Variant letters are assigned in sequence (.A, .B, ... .AF), and a suffix after ! is an internal Microsoft indicator. VirusTotal shows it as the result of the Microsoft engine.

Parent datatype
Antivirus detection name malware_detection_name
Categories
Software development
Countries
Global (not tied to a country)
Languages
Common to most languages
Quality
68/100 · missing: second example, mapping (Wikidata, Schema.org, ...), translation, detector coverage
Metacrafter rules
no detection rule yet
Supported by tools
no tool record lists this type yet

Regular expression

^[A-Za-z]+:[A-Za-z0-9_]+/[A-Za-z0-9_-]+(?:\.[A-Za-z0-9]+)*(?:![A-Za-z0-9]+)?$

Python re syntax.

Examples

ValueDescription
Trojan:Win32/Wacatac.B!mlMicrosoft detection of a .NET trojan sample in VirusTotal
Gen:Variant.Marsilia.217465 invalidBitDefender name, which has no platform part after a slash
MSIL/Agent.YUF Trojan invalidESET-NOD32 name, with the type after the name

Sources

Use this record