1<!doctype html> 2<html lang="en"><head> 3<meta name="google-site-verification" content="aC9-pY_O-oBAL78wxRXWcIdsysGGgv2M9_WaHkFIkTQ" /> 4<meta charset="utf-8"> 5<meta name="viewport" content="width=device-width,initial-scale=1"> 6<title>Malware Families Catalog</title> 7<meta name="description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset."> 8<link rel="canonical" href="https://malware-families-catalog.systemhelpdesk.com/"> 9<meta property="og:type" content="website"> 10<meta property="og:title" content="Malware Families Catalog"> 11<meta property="og:description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset."> 12<meta property="og:url" content="https://malware-families-catalog.systemhelpdesk.com/"> 13<meta property="og:site_name" content="Malware Families Catalog"> 14<meta name="twitter:card" content="summary_large_image"> 15<meta name="twitter:title" content="Malware Families Catalog"> 16<meta name="twitter:description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset."> 17<link rel="alternate" type="application/rss+xml" title="Malware Families Updates" href="https://malware-families-catalog.systemhelpdesk.com/rss.xml">
18<script type="application/ld+json">{"@context": "https://schema.org", "@type": "Dataset", "name": "Malware Families Catalog", "description": "Catalog of 2,899 real-world malware families from EMBER 2018 dataset.", "url": "https://malware-families-catalog.systemhelpdesk.com/", "license": "https://www.apache.org/licenses/LICENSE-2.0", "creator": {"@type": "Organization", "name": "SystemHelpdesk"}, "isBasedOn": {"@type": "Dataset", "name": "EMBER 2018", "description": "EMBER 2018 is a labeled benchmark dataset of 1.1M PE file features released by Elastic for static malware classification research.", "creator": {"@type": "Organization", "name": "Elastic", "url": "https://www.elastic.co/"}, "license": "https://github.com/elastic/ember/blob/master/LICENSE.txt", "url": "https://github.com/elastic/ember"}, "keywords": ["malware", "cybersecurity", "threat-intelligence", "incident-response", "soc", "ember", "classification", "security"], "dateModified": "2026-09-09", "sameAs": ["https://huggingface.co/datasets/Jordan123234/malware-families-catalog", "https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog", "https://github.com/jordanricky1604-ship-it/malware-families-catalog"], "distribution": [{"@type": "DataDownload", "encodingFormat": "application/x-parquet", "contentUrl": "https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.parquet"}, {"@type": "DataDownload", "encodingFormat": "application/x-jsonlines", "contentUrl": "https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.jsonl"}]}</script>
18 19<style>:root{--bg-color:#0d1117;--card-bg:#161b22;--text-main:#c9d1d9;--text-muted:#9198a1;--accent:#79c0ff;--accent-hover:#a5d6ff;--border:#30363d;--table-header:#21262d;--warning-bg:rgba(212,160,23,0.15);--warning-border:#d4a017;--code-bg:rgba(110,118,129,0.4);}:root.light-mode{--bg-color:#ffffff;--card-bg:#f6f8fa;--text-main:#24292f;--text-muted:#57606a;--accent:#0969da;--accent-hover:#0550ae;--border:#d0d7de;--table-header:#f6f8fa;--warning-bg:rgba(212,160,23,0.15);--warning-border:#d4a017;--code-bg:rgba(175,184,193,0.2);}.theme-toggle{background:none;border:1px solid var(--border);color:var(--text-main);padding:0.2em 0.6em;border-radius:4px;cursor:pointer;font-size:0.9em;float:right;}.theme-toggle:hover{background:var(--code-bg);}*{box-sizing:border-box;}body{font-family:'Inter',system-ui,sans-serif;background-color:var(--bg-color);color:var(--text-main);max-width:960px;margin:0 auto;padding:2em 1.5em;line-height:1.6;}h1,h2,h3,h4{color:var(--text-main);font-weight:600;}h1{font-size:2.2em;margin-bottom:0.2em;}h2{font-size:1.5em;border-bottom:1px solid var(--border);padding-bottom:0.4em;margin-top:1.8em;}h3{font-size:1.2em;margin-top:1.5em;color:var(--accent);}a{color:var(--accent);text-decoration:underline;text-underline-offset:2px;transition:color 0.2s ease;}a:hover{color:var(--accent-hover);}section{background:var(--card-bg);border:1px solid var(--border);border-radius:8px;padding:1.5em;margin-top:1.5em;box-shadow:0 4px 6px rgba(0,0,0,0.1);}section h2{margin-top:0;border-bottom-color:rgba(255,255,255,0.1);}.meta{color:var(--text-muted);font-size:0.95em;margin:0.5em 0 1.2em;background:var(--card-bg);padding:0.8em 1em;border-radius:6px;border:1px solid var(--border);}.badges{display:flex;flex-wrap:wrap;gap:0.8em;margin-bottom:1.5em;}.badges strong{color:var(--text-muted);}.badge{background:rgba(88,166,255,0.1);color:var(--accent);border:1px solid rgba(88,166,255,0.3);padding:0.2em 0.8em;border-radius:20px;font-size:0.85em;font-weight:500;}.cta{background:var(--warning-bg);border-left:4px solid var(--warning-border);padding:1.2em;margin:2em 0;border-radius:0 6px 6px 0;color:#f0c674;}details{margin:0.8em 0;padding:1em;border-radius:6px;background:rgba(22,27,34,0.5);border:1px solid var(--border);transition:all 0.2s;}details[open]{background:rgba(22,27,34,0.8);border-color:rgba(88,166,255,0.3);}summary{cursor:pointer;font-weight:500;outline:none;}summary strong{color:var(--text-main);}details p{margin-top:0.8em;margin-bottom:0;padding-left:1.2em;border-left:2px solid var(--border);}nav.bc{font-size:0.9em;color:var(--text-muted);margin-bottom:1.5em;}nav.bc a{color:var(--text-muted);}nav.bc a:hover{color:var(--accent);}code{background:var(--code-bg);padding:0.2em 0.4em;border-radius:4px;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;font-size:0.9em;word-break:break-all;color:var(--text-main);}.table-container{overflow-x:auto;margin:1em 0;}table{border-collapse:collapse;width:100%;margin:0.5em 0;background:var(--card-bg);border-radius:6px;overflow:hidden;}th,td{border:1px solid var(--border);padding:0.6em 1em;text-align:left;vertical-align:top;}th{background:var(--table-header);color:var(--text-main);font-weight:600;}tr:nth-child(even){background-color:rgba(255,255,255,0.02);}tr:hover{background-color:rgba(255,255,255,0.04);}.search-container{margin:1.5em 0;position:relative;}#searchInput{width:100%;padding:1em 1em 1em 2.5em;font-size:1.1em;background:var(--card-bg);border:1px solid var(--border);border-radius:8px;color:var(--text-main);outline:none;transition:border-color 0.2s,box-shadow 0.2s;font-family:inherit;}#searchInput:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(88,166,255,0.2);}.search-icon{position:absolute;left:1em;top:50%;transform:translateY(-50%);color:var(--text-muted);}.col-list{columns:2;list-style:none;padding:0;gap:2em;}.col-list li{margin-bottom:0.5em;break-inside:avoid;}footer{margin-top:3em;padding-top:1em;border-top:1px solid var(--border);font-size:0.85em;color:var(--text-muted);text-align:center;}.dashboard-grid{display:grid;grid-template-columns:1fr 1fr;gap:1.5em;margin:1.5em 0;}@media (max-width:768px){.dashboard-grid{grid-template-columns:1fr;}}.chart-card{background:var(--card-bg);border:1px solid var(--border);border-radius:8px;padding:1.5em;box-shadow:0 4px 6px rgba(0,0,0,0.1);display:flex;flex-direction:column;align-items:center;}.chart-card h3{margin-top:0;margin-bottom:1em;width:100%;text-align:center;}.chart-container{position:relative;width:100%;max-width:400px;}.bar-chart-row{display:flex;align-items:center;margin-bottom:0.5em;width:100%;}.bar-chart-label{flex:0 0 120px;font-size:0.85em;color:var(--text-muted);text-align:right;padding-right:1em;}.bar-chart-bar-container{flex:1;background:var(--code-bg);height:12px;border-radius:6px;overflow:hidden;position:relative;}.bar-chart-bar{background:var(--accent);height:100%;border-radius:6px;}.bar-chart-value{flex:0 0 40px;font-size:0.85em;color:var(--text-main);text-align:left;padding-left:0.5em;}.matrix-container{overflow-x:auto;margin:2em 0;}.matrix-grid{display:grid;grid-template-columns:repeat(14,minmax(140px,1fr));gap:4px;}.matrix-tactic{background:var(--table-header);padding:8px;font-size:0.85em;font-weight:bold;text-align:center;border-bottom:2px solid var(--border);}.matrix-col{display:flex;flex-direction:column;gap:4px;}.matrix-cell{padding:6px;font-size:0.75em;text-align:center;border:1px solid var(--border);cursor:pointer;border-radius:3px;transition:transform 0.1s;}.matrix-cell:hover{transform:scale(1.05);z-index:10;box-shadow:0 4px 8px rgba(0,0,0,0.3);border-color:var(--accent);}.modal{display:none;position:fixed;z-index:100;left:0;top:0;width:100%;height:100%;background-color:rgba(0,0,0,0.7);}.modal-content{background-color:var(--card-bg);margin:10% auto;padding:20px;border:1px solid var(--border);width:80%;max-width:600px;border-radius:8px;max-height:80vh;overflow-y:auto;}.close{color:var(--text-muted);float:right;font-size:28px;font-weight:bold;cursor:pointer;}.close:hover{color:var(--text-main);}.badge-ransomware{background:rgba(255,69,58,0.1);color:#ff453a;border-color:rgba(255,69,58,0.3);}.badge-infostealer{background:rgba(255,159,10,0.1);color:#ff9f0a;border-color:rgba(255,159,10,0.3);}.badge-backdoor,.badge-trojan{background:rgba(255,214,10,0.1);color:#ffd60a;border-color:rgba(255,214,10,0.3);}
19.badge-adware,.badge-pup{background:rgba(142,142,147,0.1);color:#8e8e93;border-color:rgba(142,142,147,0.3);}.home-user-alert{background:rgba(48,209,88,0.1);border-left:4px solid #30d158;padding:1em 1.2em;margin:1em 0 1.5em;border-radius:0 6px 6px 0;color:var(--text-main);font-size:0.95em;}.home-user-alert strong{color:#30d158;display:block;margin-bottom:0.3em;font-size:1.05em;}.toc{background:var(--card-bg);border:1px solid var(--border);padding:1.5em;border-radius:8px;margin:1.5em 0;}.toc h3{margin-top:0;margin-bottom:0.8em;font-size:1.1em;}.toc ul{margin:0;padding-left:1.5em;}.toc li{margin-bottom:0.5em;}.read-time{display:inline-block;background:rgba(88,166,255,0.1);color:var(--accent);padding:0.2em 0.8em;border-radius:20px;font-size:0.85em;font-weight:500;margin-left:10px;}.author-bio{display:flex;align-items:center;background:var(--card-bg);border:1px solid var(--border);padding:1.5em;border-radius:8px;margin:2em 0;gap:1.5em;}.author-bio img{width:60px;height:60px;border-radius:50%;object-fit:cover;}.author-bio-text p{margin:0;font-size:0.95em;color:var(--text-muted);}.author-bio-text strong{color:var(--text-main);display:block;margin-bottom:0.3em;}.emergency-cta-box{background:linear-gradient(135deg,rgba(212,160,23,0.15),rgba(212,160,23,0.05));border:1px solid var(--warning-border);border-left:4px solid var(--warning-border);padding:1.5em;margin:2em 0;border-radius:6px;display:flex;justify-content:space-between;align-items:center;gap:1em;}.emergency-cta-text h3{margin:0 0 0.3em 0;color:#f0c674;}.emergency-cta-text p{margin:0;font-size:0.95em;}.emergency-btn{background:var(--warning-border);color:#000;text-decoration:none;padding:0.8em 1.5em;border-radius:4px;font-weight:600;white-space:nowrap;transition:filter 0.2s;}.emergency-btn:hover{filter:brightness(1.1);color:#000;}.related-guides{margin-top:3em;border-top:1px solid var(--border);padding-top:1.5em;}.related-guides-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:1em;margin-top:1em;}.related-guide-card{background:var(--card-bg);border:1px solid var(--border);padding:1em;border-radius:6px;text-decoration:none;color:var(--text-main);transition:border-color 0.2s,transform 0.2s;}.related-guide-card:hover{border-color:var(--accent);transform:translateY(-2px);}.related-guide-card h4{margin:0 0 0.5em 0;color:var(--accent);font-size:1.05em;}.related-guide-card p{margin:0;font-size:0.85em;color:var(--text-muted);}@media (max-width:600px){.emergency-cta-box{flex-direction:column;align-items:flex-start;}}</style>
20<script src="https://cdn.jsdelivr.net/npm/chart.js" defer></script>
vendor: 1 bytes, line 20
20
21<script> 22 if (localStorage.getItem('theme') === 'light') { document.documentElement.classList.add('light-mode'); } 23 function toggleTheme() { 24 document.documentElement.classList.toggle('light-mode'); 25 localStorage.setItem('theme', document.documentElement.classList.contains('light-mode') ? 'light' : 'dark'); 26 } 27</script>
27 28</head><body> 29<nav class="bc" style="text-align:right; margin-bottom: 2em;"> 30 <a href="search.html"><strong>🔍 Search</strong></a> | <a href="matrix.html">MITRE Heatmap</a> | <a href="about.html">About</a> | <a href="api.html">API</a> | <a href="rss.xml">RSS Updates</a> | <button class="theme-toggle" onclick="toggleTheme()" title="Toggle Light/Dark Mode">âï¸/ð</button> 31</nav> 32<main id="main-content"> 33<h1>Malware Families Catalog</h1> 34<p>Catalog of 2,899 real-world malware families from EMBER 2018 dataset.</p> 35<p><strong>Interactive Notebooks:</strong> <a href="https://colab.research.google.com/drive/1QVLZW6Im9rfZxdOUL06e59W1eqBfnD9i?usp=sharing" target="_blank">Threat Intel Colab 1</a> · <a href="https://colab.research.google.com/drive/1H9d4kMG73Ls8lO5FBALisMyz9PVCB9UJ?usp=sharing" target="_blank">Threat Intel Colab 2</a></p> 36<p style="margin-top: -5px;"><strong>Community:</strong> <a href="https://www.reddit.com/r/cybersecurity/s/XvaDpjjuub" target="_blank">Join the discussion on r/cybersecurity</a></p> 37 38<div style="margin:20px 0; max-width: 600px;"> 39 <input type="search" id="famSearch" placeholder="Search 3,000+ malware families..." style="width:100%; padding:10px; font-size:16px; border:1px solid var(--border); border-radius:4px;"> 40 <div id="searchResults" style="margin-top:10px; display:none; border:1px solid var(--border); background:var(--card-bg); max-height:200px; overflow-y:auto; padding:10px;"></div> 41</div>
42<script> 43document.getElementById('famSearch').addEventListener('input', function(e) { 44 const q = e.target.value.toLowerCase(); 45 const res = document.getElementById('searchResults'); 46 if(q.length < 2) { res.style.display = 'none'; return; } 47 if(!window.famData) { 48 fetch('api/families.json').then(r => r.json()).then(d => { window.famData = d.families; filter(q); }); 49 } else { filter(q); } 50}); 51function filter(q) { 52 const res = document.getElementById('searchResults'); 53 const matches = window.famData.filter(f => f.family.toLowerCase().includes(q)).slice(0, 20); 54 if(matches.length > 0) { 55 res.innerHTML = '<ul style="margin:0;padding-left:20px">' + matches.map(f => `<li><a href="families/${f.family}">${f.family}</a> <span style="color:var(--text-muted)">(${f.category})</span></li>`).join('') + '</ul>'; 56 res.style.display = 'block'; 57 } else { 58 res.innerHTML = 'No matches found.'; 59 res.style.display = 'block'; 60 } 61} 62</script>
62 63 64<p class="mirrors"><strong>Mirrors:</strong> <a href="https://huggingface.co/datasets/Jordan123234/malware-families-catalog">Hugging Face</a> · <a href="https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog">Kaggle</a> · <a href="https://doi.org/10.5281/zenodo.20515698">Zenodo</a> · <a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog">GitHub</a></p> 65<section><h2>Quick stats</h2><ul><li><strong>Total families:</strong> 2,903</li><li><strong>Categorized:</strong> 2,903</li><li><strong>Categories represented:</strong> 33</li><li><strong>Source:</strong> EMBER 2018 (Elastic)</li><li><strong>License:</strong> Apache-2.0</li></ul></section> 66 67 68<section id="c-suite-dashboard" style="background:var(--card-bg); padding:20px; border-radius:8px; border:1px solid var(--border); margin-bottom:2em;"> 69 <h2><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align:middle;margin-right:8px;"><rect x="3" y="3" width="18" height="18" rx="2" ry="2"></rect><line x1="3" y1="9" x2="21" y2="9"></line><line x1="9" y1="21" x2="9" y2="9"></line></svg>Executive Threat Dashboard</h2> 70 <div class="dashboard-grid"> 71 <div class="chart-card"> 72 <h3>Targeted Industries</h3> 73 <div class="chart-container"><canvas id="industryChart"></canvas></div> 74 </div> 75 <div class="chart-card"> 76 <h3>Threat Actor Motivations</h3> 77 <div class="chart-container"><canvas id="motivationChart"></canvas></div> 78 </div> 79 </div> 80</section> 81 82<div class="dashboard-grid"> 83 84 <div class="chart-card"> 85 <h3>Top 10 Categories</h3> 86 <div class="chart-container"><canvas id="categoryChart"></canvas></div> 87 </div> 88 <div class="chart-card"> 89 <h3>Top 10 Families by Sample Count</h3> 90 <div class="chart-container"><canvas id="sampleChart"></canvas></div> 91 </div> 92</div> 93 94<section><h2>Top 50 families by sample count</h2><ul style="columns:2;list-style:none;padding:0"><li><a href="families/xtrat">Xtrat</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/zbot">Zbot</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/ramnit">Ramnit</a> <span style="color:var(--text-muted)">(worm_banker)</span></li><li><a href="families/sality">Sality</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/installmonster">Installmonster</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/zusy">Zusy</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/emotet">Emotet</a> <span style="color:var(--text-muted)">(loader)</span></li><li><a href="families/vtflooder">Vtflooder</a> <span style="color:var(--text-muted)">(pua_tool)</span></li><li><a href="families/fareit">Fareit</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/adposhel">Adposhel</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/high">High</a> <span style="color:var(--text-muted)">(generic_detection)</span></li><li><a href="families/ursnif">Ursnif</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/sivis">Sivis</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/startsurf">Startsurf</a> <span style="color:var(--text-muted)">(browser_hijacker)</span></li><li><a href="families/wapomi">Wapomi</a> <span style="color:var(--text-muted)">(worm_banker)</span></li><li><a href="families/lethic">Lethic</a> <span style="color:var(--text-muted)">(spam_bot)</span></li><li><a href="families/wannacry">Wannacry</a> <span style="color:var(--text-muted)">(ransomware_worm)</span></li><li><a href="families/dlguide">Dlguide</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/flystudio">Flystudio</a> <span style="color:var(--text-muted)">(packer)</span></li><li><a href="families/upatre">Upatre</a> <span style="color:var(--text-muted)">(downloader)</span></li><li><a href="families/dealply">Dealply</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/bladabindi">Bladabindi</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/lockbit">Lockbit</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/razy">Razy</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/filetour">Filetour</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/virlock">Virlock</a> <span style="color:var(--text-muted)">(ransomware_file_infector)</span></li><li><a href="families/prepscram">Prepscram</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/gandcrab">Gandcrab</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/vittalia">Vittalia</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/gamarue">Gamarue</a> <span style="color:var(--text-muted)">(loader)</span></li><li><a href="families/kovter">Kovter</a> <span style="color:var(--text-muted)">(click_fraud)</span></li><li><a href="families/nanocore">Nanocore</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/chapak">Chapak</a> <span style="color:var(--text-muted)">(downloader)</span></li><li><a href="families/installcore">Installcore</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/sdbot">Sdbot</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/autoit">Autoit</a> <span style="color:var(--text-muted)">(packer)</span></li><li><a href="families/cerber">Cerber</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/qbot">Qbot</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/tiggre">Tiggre</a> <span style="color:var(--text-muted)">(cryptominer)</span></li><li><a href="families/delf">Delf</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/qhost">Qhost</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/dotdo">Dotdo</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/gamehack">Gamehack</a> <span style="color:var(--text-muted)">(pua_tool)</span></li><li><a href="families/gepys">Gepys</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/virut">Virut</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/tinba">Tinba</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/azorult">Azorult</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/vobfus">Vobfus</a> <span style="color:var(--text-muted)">(worm)</span></li><li><a href="families/triusor">Triusor</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/agen">Agen</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li></ul></section> 95<section><h2>Troubleshooting & Protection Guides</h2> 96<p>Expert, plain-English guides on responding to active threats and securing your business:</p> 97<ul> 98 <li><a href="defensive/ransomware-protection.html">Ransomware Protection & Recovery</a></li> 99 <li><a href="defensive/infostealer-protection.html">InfoStealer Protection & Remediation</a></li> 100 <li><a href="defensive/suspect-infection-what-to-do.html">What To Do If You Suspect an Infection</a></li> 101 <li><strong><a href="defensive/">View all Protection Guides →</a></strong></li> 102</ul> 103</section> 104<section><h2>North American Compliance & Frameworks</h2> 105<p>Malware families cataloged in this repository are mapped against the <strong>National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)</strong> and actively referenced in <strong>
105Cybersecurity and Infrastructure Security Agency (CISA)</strong> advisories to support US federal guidelines and North American enterprise incident response.</p> 106</section> 107<section><h2>Browse all families</h2><p><a href="families/">Full index of 2903 categorized families</a></p></section> 108<section><h2>Download</h2><ul><li><a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.parquet">Parquet</a></li><li><a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.jsonl">JSONL</a></li><li><a href="api/families.json">JSON API index</a></li></ul></section> 109<div class="cta"><strong>If you suspect malware on your system</strong>, do not attempt manual removal. Contact SystemHelpdesk MSP at 888-351-4380 for professional incident response.</div> 110</main> 111<footer><p style="font-size:.85em;color:var(--text-muted)">Last updated 2026-09-09. Apache-2.0 licensed. Data derived from <a href="https://github.com/elastic/ember">EMBER 2018</a>. | <a href="https://malware-families-catalog.systemhelpdesk.com/">Malware Families Catalogue</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/defensive/">Defensive Guides</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/vendors/">Vendors Directory</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/resources.html">Support Resources</a></p></footer> 112
113<script> 114document.addEventListener("DOMContentLoaded", function() { 115 const catCtx = document.getElementById('categoryChart').getContext('2d'); 116 new Chart(catCtx, { 117 type: 'doughnut', 118 data: { 119 labels: ["ransomware", "advanced_threat", "trojan", "trojan_generic", "backdoor", "pua", "adware", "rat", "banking_trojan", "infostealer"], 120 datasets: [{ 121 data: [1624, 515, 492, 60, 40, 24, 24, 19, 17, 11], 122 backgroundColor: [ 123 '#58a6ff', '#3fb950', '#d29922', '#f85149', '#a371f7', 124 '#2f81f7', '#2ea043', '#bb8009', '#da3633', '#8957e5' 125 ], 126 borderWidth: 0 127 }] 128 }, 129 options: { 130 responsive: true, 131 plugins: { 132 legend: { position: 'right', labels: { color: '#c9d1d9' } } 133 } 134 } 135 }); 136 137 const famCtx = document.getElementById('sampleChart').getContext('2d'); 138 new Chart(famCtx, { 139 type: 'bar', 140 data: { 141 labels: ["Xtrat", "Zbot", "Ramnit", "Sality", "Installmonster", "Zusy", "Emotet", "Vtflooder", "Fareit", "Adposhel"], 142 datasets: [{ 143 label: 'Samples', 144 data: [35969, 24075, 20595, 18572, 16691, 14120, 12943, 12150, 10955, 8951], 145 backgroundColor: '#58a6ff' 146 }] 147 }, 148 options: { 149 responsive: true, 150 scales: { 151 y: { 152 beginAtZero: true, 153 grid: { color: '#30363d' }, 154 ticks: { color: '#8b949e' } 155 }, 156 x: { 157 grid: { display: false }, 158 ticks: { color: '#8b949e' } 159 } 160 }, 161 plugins: { 162 legend: { display: false } 163 } 164 } 165 }); 166 167 const indCtx = document.getElementById('industryChart').getContext('2d'); 168 new Chart(indCtx, { 169 type: 'bar', 170 data: { 171 labels: ["Enterprise", "Healthcare", "Critical Infrastructure", "Global / Opportunistic", "Consumers"], 172 datasets: [{ 173 label: 'Families Targeting', 174 data: [1626, 1626, 1625, 1256, 16], 175 backgroundColor: '#a371f7' 176 }] 177 }, 178 options: { 179 responsive: true, 180 indexAxis: 'y', 181 scales: { 182 x: { beginAtZero: true, grid: { color: '#30363d' }, ticks: { color: '#8b949e' } }, 183 y: { grid: { display: false }, ticks: { color: '#8b949e' } } 184 }, 185 plugins: { legend: { display: false } } 186 } 187 }); 188 189 const motCtx = document.getElementById('motivationChart').getContext('2d'); 190 new Chart(motCtx, { 191 type: 'doughnut', 192 data: { 193 labels: ["Financial Extortion", "Opportunistic", "Espionage"], 194 datasets: [{ 195 data: [1633, 1267, 3], 196 backgroundColor: ['#da3633', '#2ea043', '#d29922', '#58a6ff', '#8957e5'], 197 borderWidth: 0 198 }] 199 }, 200 options: { 201 responsive: true, 202 plugins: { legend: { position: 'right', labels: { color: '#c9d1d9' } } } 203 } 204 }); 205}); 206</script>
206 207 208</body></html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.