PageSourceSearch

https://jordanricky1604-ship-it.github.io/malware-families-catalog/

html jordanricky1604-ship-it.github.io collected 2026-10-03 09:24:43 UTC 26,809 bytes, 208 lines download raw bytes

1<!doctype html>
2<html lang="en"><head>
3<meta name="google-site-verification" content="aC9-pY_O-oBAL78wxRXWcIdsysGGgv2M9_WaHkFIkTQ" />
4<meta charset="utf-8">
5<meta name="viewport" content="width=device-width,initial-scale=1">
6<title>Malware Families Catalog</title>
7<meta name="description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset.">
8<link rel="canonical" href="https://malware-families-catalog.systemhelpdesk.com/">
9<meta property="og:type" content="website">
10<meta property="og:title" content="Malware Families Catalog">
11<meta property="og:description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset.">
12<meta property="og:url" content="https://malware-families-catalog.systemhelpdesk.com/">
13<meta property="og:site_name" content="Malware Families Catalog">
14<meta name="twitter:card" content="summary_large_image">
15<meta name="twitter:title" content="Malware Families Catalog">
16<meta name="twitter:description" content="Catalog of 2,899 real-world malware families from EMBER 2018 dataset.">
17<link rel="alternate" type="application/rss+xml" title="Malware Families Updates" href="https://malware-families-catalog.systemhelpdesk.com/rss.xml">
18<script type="application/ld+json">{"@context": "https://schema.org", "@type": "Dataset", "name": "Malware Families Catalog", "description": "Catalog of 2,899 real-world malware families from EMBER 2018 dataset.", "url": "https://malware-families-catalog.systemhelpdesk.com/", "license": "https://www.apache.org/licenses/LICENSE-2.0", "creator": {"@type": "Organization", "name": "SystemHelpdesk"}, "isBasedOn": {"@type": "Dataset", "name": "EMBER 2018", "description": "EMBER 2018 is a labeled benchmark dataset of 1.1M PE file features released by Elastic for static malware classification research.", "creator": {"@type": "Organization", "name": "Elastic", "url": "https://www.elastic.co/"}, "license": "https://github.com/elastic/ember/blob/master/LICENSE.txt", "url": "https://github.com/elastic/ember"}, "keywords": ["malware", "cybersecurity", "threat-intelligence", "incident-response", "soc", "ember", "classification", "security"], "dateModified": "2026-09-09", "sameAs": ["https://huggingface.co/datasets/Jordan123234/malware-families-catalog", "https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog", "https://github.com/jordanricky1604-ship-it/malware-families-catalog"], "distribution": [{"@type": "DataDownload", "encodingFormat": "application/x-parquet", "contentUrl": "https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.parquet"}, {"@type": "DataDownload", "encodingFormat": "application/x-jsonlines", "contentUrl": "https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.jsonl"}]}</script>
18
19<style>:root{--bg-color:#0d1117;--card-bg:#161b22;--text-main:#c9d1d9;--text-muted:#9198a1;--accent:#79c0ff;--accent-hover:#a5d6ff;--border:#30363d;--table-header:#21262d;--warning-bg:rgba(212,160,23,0.15);--warning-border:#d4a017;--code-bg:rgba(110,118,129,0.4);}:root.light-mode{--bg-color:#ffffff;--card-bg:#f6f8fa;--text-main:#24292f;--text-muted:#57606a;--accent:#0969da;--accent-hover:#0550ae;--border:#d0d7de;--table-header:#f6f8fa;--warning-bg:rgba(212,160,23,0.15);--warning-border:#d4a017;--code-bg:rgba(175,184,193,0.2);}.theme-toggle{background:none;border:1px solid var(--border);color:var(--text-main);padding:0.2em 0.6em;border-radius:4px;cursor:pointer;font-size:0.9em;float:right;}.theme-toggle:hover{background:var(--code-bg);}*{box-sizing:border-box;}body{font-family:'Inter',system-ui,sans-serif;background-color:var(--bg-color);color:var(--text-main);max-width:960px;margin:0 auto;padding:2em 1.5em;line-height:1.6;}h1,h2,h3,h4{color:var(--text-main);font-weight:600;}h1{font-size:2.2em;margin-bottom:0.2em;}h2{font-size:1.5em;border-bottom:1px solid var(--border);padding-bottom:0.4em;margin-top:1.8em;}h3{font-size:1.2em;margin-top:1.5em;color:var(--accent);}a{color:var(--accent);text-decoration:underline;text-underline-offset:2px;transition:color 0.2s ease;}a:hover{color:var(--accent-hover);}section{background:var(--card-bg);border:1px solid var(--border);border-radius:8px;padding:1.5em;margin-top:1.5em;box-shadow:0 4px 6px rgba(0,0,0,0.1);}section h2{margin-top:0;border-bottom-color:rgba(255,255,255,0.1);}.meta{color:var(--text-muted);font-size:0.95em;margin:0.5em 0 1.2em;background:var(--card-bg);padding:0.8em 1em;border-radius:6px;border:1px solid var(--border);}.badges{display:flex;flex-wrap:wrap;gap:0.8em;margin-bottom:1.5em;}.badges strong{color:var(--text-muted);}.badge{background:rgba(88,166,255,0.1);color:var(--accent);border:1px solid rgba(88,166,255,0.3);padding:0.2em 0.8em;border-radius:20px;font-size:0.85em;font-weight:500;}.cta{background:var(--warning-bg);border-left:4px solid var(--warning-border);padding:1.2em;margin:2em 0;border-radius:0 6px 6px 0;color:#f0c674;}details{margin:0.8em 0;padding:1em;border-radius:6px;background:rgba(22,27,34,0.5);border:1px solid var(--border);transition:all 0.2s;}details[open]{background:rgba(22,27,34,0.8);border-color:rgba(88,166,255,0.3);}summary{cursor:pointer;font-weight:500;outline:none;}summary strong{color:var(--text-main);}details p{margin-top:0.8em;margin-bottom:0;padding-left:1.2em;border-left:2px solid var(--border);}nav.bc{font-size:0.9em;color:var(--text-muted);margin-bottom:1.5em;}nav.bc a{color:var(--text-muted);}nav.bc a:hover{color:var(--accent);}code{background:var(--code-bg);padding:0.2em 0.4em;border-radius:4px;font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;font-size:0.9em;word-break:break-all;color:var(--text-main);}.table-container{overflow-x:auto;margin:1em 0;}table{border-collapse:collapse;width:100%;margin:0.5em 0;background:var(--card-bg);border-radius:6px;overflow:hidden;}th,td{border:1px solid var(--border);padding:0.6em 1em;text-align:left;vertical-align:top;}th{background:var(--table-header);color:var(--text-main);font-weight:600;}tr:nth-child(even){background-color:rgba(255,255,255,0.02);}tr:hover{background-color:rgba(255,255,255,0.04);}.search-container{margin:1.5em 0;position:relative;}#searchInput{width:100%;padding:1em 1em 1em 2.5em;font-size:1.1em;background:var(--card-bg);border:1px solid var(--border);border-radius:8px;color:var(--text-main);outline:none;transition:border-color 0.2s,box-shadow 0.2s;font-family:inherit;}#searchInput:focus{border-color:var(--accent);box-shadow:0 0 0 3px rgba(88,166,255,0.2);}.search-icon{position:absolute;left:1em;top:50%;transform:translateY(-50%);color:var(--text-muted);}.col-list{columns:2;list-style:none;padding:0;gap:2em;}.col-list li{margin-bottom:0.5em;break-inside:avoid;}footer{margin-top:3em;padding-top:1em;border-top:1px solid var(--border);font-size:0.85em;color:var(--text-muted);text-align:center;}.dashboard-grid{display:grid;grid-template-columns:1fr 1fr;gap:1.5em;margin:1.5em 0;}@media (max-width:768px){.dashboard-grid{grid-template-columns:1fr;}}.chart-card{background:var(--card-bg);border:1px solid var(--border);border-radius:8px;padding:1.5em;box-shadow:0 4px 6px rgba(0,0,0,0.1);display:flex;flex-direction:column;align-items:center;}.chart-card h3{margin-top:0;margin-bottom:1em;width:100%;text-align:center;}.chart-container{position:relative;width:100%;max-width:400px;}.bar-chart-row{display:flex;align-items:center;margin-bottom:0.5em;width:100%;}.bar-chart-label{flex:0 0 120px;font-size:0.85em;color:var(--text-muted);text-align:right;padding-right:1em;}.bar-chart-bar-container{flex:1;background:var(--code-bg);height:12px;border-radius:6px;overflow:hidden;position:relative;}.bar-chart-bar{background:var(--accent);height:100%;border-radius:6px;}.bar-chart-value{flex:0 0 40px;font-size:0.85em;color:var(--text-main);text-align:left;padding-left:0.5em;}.matrix-container{overflow-x:auto;margin:2em 0;}.matrix-grid{display:grid;grid-template-columns:repeat(14,minmax(140px,1fr));gap:4px;}.matrix-tactic{background:var(--table-header);padding:8px;font-size:0.85em;font-weight:bold;text-align:center;border-bottom:2px solid var(--border);}.matrix-col{display:flex;flex-direction:column;gap:4px;}.matrix-cell{padding:6px;font-size:0.75em;text-align:center;border:1px solid var(--border);cursor:pointer;border-radius:3px;transition:transform 0.1s;}.matrix-cell:hover{transform:scale(1.05);z-index:10;box-shadow:0 4px 8px rgba(0,0,0,0.3);border-color:var(--accent);}.modal{display:none;position:fixed;z-index:100;left:0;top:0;width:100%;height:100%;background-color:rgba(0,0,0,0.7);}.modal-content{background-color:var(--card-bg);margin:10% auto;padding:20px;border:1px solid var(--border);width:80%;max-width:600px;border-radius:8px;max-height:80vh;overflow-y:auto;}.close{color:var(--text-muted);float:right;font-size:28px;font-weight:bold;cursor:pointer;}.close:hover{color:var(--text-main);}.badge-ransomware{background:rgba(255,69,58,0.1);color:#ff453a;border-color:rgba(255,69,58,0.3);}.badge-infostealer{background:rgba(255,159,10,0.1);color:#ff9f0a;border-color:rgba(255,159,10,0.3);}.badge-backdoor,.badge-trojan{background:rgba(255,214,10,0.1);color:#ffd60a;border-color:rgba(255,214,10,0.3);}
19.badge-adware,.badge-pup{background:rgba(142,142,147,0.1);color:#8e8e93;border-color:rgba(142,142,147,0.3);}.home-user-alert{background:rgba(48,209,88,0.1);border-left:4px solid #30d158;padding:1em 1.2em;margin:1em 0 1.5em;border-radius:0 6px 6px 0;color:var(--text-main);font-size:0.95em;}.home-user-alert strong{color:#30d158;display:block;margin-bottom:0.3em;font-size:1.05em;}.toc{background:var(--card-bg);border:1px solid var(--border);padding:1.5em;border-radius:8px;margin:1.5em 0;}.toc h3{margin-top:0;margin-bottom:0.8em;font-size:1.1em;}.toc ul{margin:0;padding-left:1.5em;}.toc li{margin-bottom:0.5em;}.read-time{display:inline-block;background:rgba(88,166,255,0.1);color:var(--accent);padding:0.2em 0.8em;border-radius:20px;font-size:0.85em;font-weight:500;margin-left:10px;}.author-bio{display:flex;align-items:center;background:var(--card-bg);border:1px solid var(--border);padding:1.5em;border-radius:8px;margin:2em 0;gap:1.5em;}.author-bio img{width:60px;height:60px;border-radius:50%;object-fit:cover;}.author-bio-text p{margin:0;font-size:0.95em;color:var(--text-muted);}.author-bio-text strong{color:var(--text-main);display:block;margin-bottom:0.3em;}.emergency-cta-box{background:linear-gradient(135deg,rgba(212,160,23,0.15),rgba(212,160,23,0.05));border:1px solid var(--warning-border);border-left:4px solid var(--warning-border);padding:1.5em;margin:2em 0;border-radius:6px;display:flex;justify-content:space-between;align-items:center;gap:1em;}.emergency-cta-text h3{margin:0 0 0.3em 0;color:#f0c674;}.emergency-cta-text p{margin:0;font-size:0.95em;}.emergency-btn{background:var(--warning-border);color:#000;text-decoration:none;padding:0.8em 1.5em;border-radius:4px;font-weight:600;white-space:nowrap;transition:filter 0.2s;}.emergency-btn:hover{filter:brightness(1.1);color:#000;}.related-guides{margin-top:3em;border-top:1px solid var(--border);padding-top:1.5em;}.related-guides-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(250px,1fr));gap:1em;margin-top:1em;}.related-guide-card{background:var(--card-bg);border:1px solid var(--border);padding:1em;border-radius:6px;text-decoration:none;color:var(--text-main);transition:border-color 0.2s,transform 0.2s;}.related-guide-card:hover{border-color:var(--accent);transform:translateY(-2px);}.related-guide-card h4{margin:0 0 0.5em 0;color:var(--accent);font-size:1.05em;}.related-guide-card p{margin:0;font-size:0.85em;color:var(--text-muted);}@media (max-width:600px){.emergency-cta-box{flex-direction:column;align-items:flex-start;}}</style>
20<script src="https://cdn.jsdelivr.net/npm/chart.js" defer></script>
vendor: 1 bytes, line 20
20
21<script>
22  if (localStorage.getItem('theme') === 'light') { document.documentElement.classList.add('light-mode'); }
23  function toggleTheme() {
24      document.documentElement.classList.toggle('light-mode');
25      localStorage.setItem('theme', document.documentElement.classList.contains('light-mode') ? 'light' : 'dark');
26  }
27</script>
27
28</head><body>
29<nav class="bc" style="text-align:right; margin-bottom: 2em;">
30  <a href="search.html"><strong>&#128269; Search</strong></a> | <a href="matrix.html">MITRE Heatmap</a> | <a href="about.html">About</a> | <a href="api.html">API</a> | <a href="rss.xml">RSS Updates</a> | <button class="theme-toggle" onclick="toggleTheme()" title="Toggle Light/Dark Mode">☀️/🌙</button>
31</nav>
32<main id="main-content">
33<h1>Malware Families Catalog</h1>
34<p>Catalog of 2,899 real-world malware families from EMBER 2018 dataset.</p>
35<p><strong>Interactive Notebooks:</strong> <a href="https://colab.research.google.com/drive/1QVLZW6Im9rfZxdOUL06e59W1eqBfnD9i?usp=sharing" target="_blank">Threat Intel Colab 1</a> &middot; <a href="https://colab.research.google.com/drive/1H9d4kMG73Ls8lO5FBALisMyz9PVCB9UJ?usp=sharing" target="_blank">Threat Intel Colab 2</a></p>
36<p style="margin-top: -5px;"><strong>Community:</strong> <a href="https://www.reddit.com/r/cybersecurity/s/XvaDpjjuub" target="_blank">Join the discussion on r/cybersecurity</a></p>
37
38<div style="margin:20px 0; max-width: 600px;">
39  <input type="search" id="famSearch" placeholder="Search 3,000+ malware families..." style="width:100%; padding:10px; font-size:16px; border:1px solid var(--border); border-radius:4px;">
40  <div id="searchResults" style="margin-top:10px; display:none; border:1px solid var(--border); background:var(--card-bg); max-height:200px; overflow-y:auto; padding:10px;"></div>
41</div>
42<script>
43document.getElementById('famSearch').addEventListener('input', function(e) {
44  const q = e.target.value.toLowerCase();
45  const res = document.getElementById('searchResults');
46  if(q.length < 2) { res.style.display = 'none'; return; }
47  if(!window.famData) {
48    fetch('api/families.json').then(r => r.json()).then(d => { window.famData = d.families; filter(q); });
49  } else { filter(q); }
50});
51function filter(q) {
52  const res = document.getElementById('searchResults');
53  const matches = window.famData.filter(f => f.family.toLowerCase().includes(q)).slice(0, 20);
54  if(matches.length > 0) {
55    res.innerHTML = '<ul style="margin:0;padding-left:20px">' + matches.map(f => `<li><a href="families/${f.family}">${f.family}</a> <span style="color:var(--text-muted)">(${f.category})</span></li>`).join('') + '</ul>';
56    res.style.display = 'block';
57  } else {
58    res.innerHTML = 'No matches found.';
59    res.style.display = 'block';
60  }
61}
62</script>
62
63
64<p class="mirrors"><strong>Mirrors:</strong> <a href="https://huggingface.co/datasets/Jordan123234/malware-families-catalog">Hugging Face</a> &middot; <a href="https://www.kaggle.com/datasets/rickyjordan/malware-families-catalog">Kaggle</a> &middot; <a href="https://doi.org/10.5281/zenodo.20515698">Zenodo</a> &middot; <a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog">GitHub</a></p>
65<section><h2>Quick stats</h2><ul><li><strong>Total families:</strong> 2,903</li><li><strong>Categorized:</strong> 2,903</li><li><strong>Categories represented:</strong> 33</li><li><strong>Source:</strong> EMBER 2018 (Elastic)</li><li><strong>License:</strong> Apache-2.0</li></ul></section>
66
67
68<section id="c-suite-dashboard" style="background:var(--card-bg); padding:20px; border-radius:8px; border:1px solid var(--border); margin-bottom:2em;">
69  <h2><svg width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="vertical-align:middle;margin-right:8px;"><rect x="3" y="3" width="18" height="18" rx="2" ry="2"></rect><line x1="3" y1="9" x2="21" y2="9"></line><line x1="9" y1="21" x2="9" y2="9"></line></svg>Executive Threat Dashboard</h2>
70  <div class="dashboard-grid">
71    <div class="chart-card">
72      <h3>Targeted Industries</h3>
73      <div class="chart-container"><canvas id="industryChart"></canvas></div>
74    </div>
75    <div class="chart-card">
76      <h3>Threat Actor Motivations</h3>
77      <div class="chart-container"><canvas id="motivationChart"></canvas></div>
78    </div>
79  </div>
80</section>
81
82<div class="dashboard-grid">
83
84  <div class="chart-card">
85    <h3>Top 10 Categories</h3>
86    <div class="chart-container"><canvas id="categoryChart"></canvas></div>
87  </div>
88  <div class="chart-card">
89    <h3>Top 10 Families by Sample Count</h3>
90    <div class="chart-container"><canvas id="sampleChart"></canvas></div>
91  </div>
92</div>
93
94<section><h2>Top 50 families by sample count</h2><ul style="columns:2;list-style:none;padding:0"><li><a href="families/xtrat">Xtrat</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/zbot">Zbot</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/ramnit">Ramnit</a> <span style="color:var(--text-muted)">(worm_banker)</span></li><li><a href="families/sality">Sality</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/installmonster">Installmonster</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/zusy">Zusy</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/emotet">Emotet</a> <span style="color:var(--text-muted)">(loader)</span></li><li><a href="families/vtflooder">Vtflooder</a> <span style="color:var(--text-muted)">(pua_tool)</span></li><li><a href="families/fareit">Fareit</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/adposhel">Adposhel</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/high">High</a> <span style="color:var(--text-muted)">(generic_detection)</span></li><li><a href="families/ursnif">Ursnif</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/sivis">Sivis</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/startsurf">Startsurf</a> <span style="color:var(--text-muted)">(browser_hijacker)</span></li><li><a href="families/wapomi">Wapomi</a> <span style="color:var(--text-muted)">(worm_banker)</span></li><li><a href="families/lethic">Lethic</a> <span style="color:var(--text-muted)">(spam_bot)</span></li><li><a href="families/wannacry">Wannacry</a> <span style="color:var(--text-muted)">(ransomware_worm)</span></li><li><a href="families/dlguide">Dlguide</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/flystudio">Flystudio</a> <span style="color:var(--text-muted)">(packer)</span></li><li><a href="families/upatre">Upatre</a> <span style="color:var(--text-muted)">(downloader)</span></li><li><a href="families/dealply">Dealply</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/bladabindi">Bladabindi</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/lockbit">Lockbit</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/razy">Razy</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/filetour">Filetour</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/virlock">Virlock</a> <span style="color:var(--text-muted)">(ransomware_file_infector)</span></li><li><a href="families/prepscram">Prepscram</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/gandcrab">Gandcrab</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/vittalia">Vittalia</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/gamarue">Gamarue</a> <span style="color:var(--text-muted)">(loader)</span></li><li><a href="families/kovter">Kovter</a> <span style="color:var(--text-muted)">(click_fraud)</span></li><li><a href="families/nanocore">Nanocore</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/chapak">Chapak</a> <span style="color:var(--text-muted)">(downloader)</span></li><li><a href="families/installcore">Installcore</a> <span style="color:var(--text-muted)">(pua)</span></li><li><a href="families/sdbot">Sdbot</a> <span style="color:var(--text-muted)">(rat)</span></li><li><a href="families/autoit">Autoit</a> <span style="color:var(--text-muted)">(packer)</span></li><li><a href="families/cerber">Cerber</a> <span style="color:var(--text-muted)">(ransomware)</span></li><li><a href="families/qbot">Qbot</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/tiggre">Tiggre</a> <span style="color:var(--text-muted)">(cryptominer)</span></li><li><a href="families/delf">Delf</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/qhost">Qhost</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/dotdo">Dotdo</a> <span style="color:var(--text-muted)">(adware)</span></li><li><a href="families/gamehack">Gamehack</a> <span style="color:var(--text-muted)">(pua_tool)</span></li><li><a href="families/gepys">Gepys</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/virut">Virut</a> <span style="color:var(--text-muted)">(file_infector)</span></li><li><a href="families/tinba">Tinba</a> <span style="color:var(--text-muted)">(banking_trojan)</span></li><li><a href="families/azorult">Azorult</a> <span style="color:var(--text-muted)">(infostealer)</span></li><li><a href="families/vobfus">Vobfus</a> <span style="color:var(--text-muted)">(worm)</span></li><li><a href="families/triusor">Triusor</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li><li><a href="families/agen">Agen</a> <span style="color:var(--text-muted)">(trojan_generic)</span></li></ul></section>
95<section><h2>Troubleshooting & Protection Guides</h2>
96<p>Expert, plain-English guides on responding to active threats and securing your business:</p>
97<ul>
98  <li><a href="defensive/ransomware-protection.html">Ransomware Protection & Recovery</a></li>
99  <li><a href="defensive/infostealer-protection.html">InfoStealer Protection & Remediation</a></li>
100  <li><a href="defensive/suspect-infection-what-to-do.html">What To Do If You Suspect an Infection</a></li>
101  <li><strong><a href="defensive/">View all Protection Guides &rarr;</a></strong></li>
102</ul>
103</section>
104<section><h2>North American Compliance & Frameworks</h2>
105<p>Malware families cataloged in this repository are mapped against the <strong>National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF)</strong> and actively referenced in <strong>
105Cybersecurity and Infrastructure Security Agency (CISA)</strong> advisories to support US federal guidelines and North American enterprise incident response.</p>
106</section>
107<section><h2>Browse all families</h2><p><a href="families/">Full index of 2903 categorized families</a></p></section>
108<section><h2>Download</h2><ul><li><a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.parquet">Parquet</a></li><li><a href="https://github.com/jordanricky1604-ship-it/malware-families-catalog/raw/main/data/malware_families.jsonl">JSONL</a></li><li><a href="api/families.json">JSON API index</a></li></ul></section>
109<div class="cta"><strong>If you suspect malware on your system</strong>, do not attempt manual removal. Contact SystemHelpdesk MSP at 888-351-4380 for professional incident response.</div>
110</main>
111<footer><p style="font-size:.85em;color:var(--text-muted)">Last updated 2026-09-09. Apache-2.0 licensed. Data derived from <a href="https://github.com/elastic/ember">EMBER 2018</a>. | <a href="https://malware-families-catalog.systemhelpdesk.com/">Malware Families Catalogue</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/defensive/">Defensive Guides</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/vendors/">Vendors Directory</a> | <a href="https://malware-families-catalog.systemhelpdesk.com/resources.html">Support Resources</a></p></footer>
112
113<script>
114document.addEventListener("DOMContentLoaded", function() {
115  const catCtx = document.getElementById('categoryChart').getContext('2d');
116  new Chart(catCtx, {
117    type: 'doughnut',
118    data: {
119      labels: ["ransomware", "advanced_threat", "trojan", "trojan_generic", "backdoor", "pua", "adware", "rat", "banking_trojan", "infostealer"],
120      datasets: [{
121        data: [1624, 515, 492, 60, 40, 24, 24, 19, 17, 11],
122        backgroundColor: [
123          '#58a6ff', '#3fb950', '#d29922', '#f85149', '#a371f7',
124          '#2f81f7', '#2ea043', '#bb8009', '#da3633', '#8957e5'
125        ],
126        borderWidth: 0
127      }]
128    },
129    options: {
130      responsive: true,
131      plugins: {
132        legend: { position: 'right', labels: { color: '#c9d1d9' } }
133      }
134    }
135  });
136
137  const famCtx = document.getElementById('sampleChart').getContext('2d');
138  new Chart(famCtx, {
139    type: 'bar',
140    data: {
141      labels: ["Xtrat", "Zbot", "Ramnit", "Sality", "Installmonster", "Zusy", "Emotet", "Vtflooder", "Fareit", "Adposhel"],
142      datasets: [{
143        label: 'Samples',
144        data: [35969, 24075, 20595, 18572, 16691, 14120, 12943, 12150, 10955, 8951],
145        backgroundColor: '#58a6ff'
146      }]
147    },
148    options: {
149      responsive: true,
150      scales: {
151        y: {
152          beginAtZero: true,
153          grid: { color: '#30363d' },
154          ticks: { color: '#8b949e' }
155        },
156        x: {
157          grid: { display: false },
158          ticks: { color: '#8b949e' }
159        }
160      },
161      plugins: {
162        legend: { display: false }
163      }
164    }
165  });
166
167  const indCtx = document.getElementById('industryChart').getContext('2d');
168  new Chart(indCtx, {
169    type: 'bar',
170    data: {
171      labels: ["Enterprise", "Healthcare", "Critical Infrastructure", "Global / Opportunistic", "Consumers"],
172      datasets: [{
173        label: 'Families Targeting',
174        data: [1626, 1626, 1625, 1256, 16],
175        backgroundColor: '#a371f7'
176      }]
177    },
178    options: {
179      responsive: true,
180      indexAxis: 'y',
181      scales: {
182        x: { beginAtZero: true, grid: { color: '#30363d' }, ticks: { color: '#8b949e' } },
183        y: { grid: { display: false }, ticks: { color: '#8b949e' } }
184      },
185      plugins: { legend: { display: false } }
186    }
187  });
188
189  const motCtx = document.getElementById('motivationChart').getContext('2d');
190  new Chart(motCtx, {
191    type: 'doughnut',
192    data: {
193      labels: ["Financial Extortion", "Opportunistic", "Espionage"],
194      datasets: [{
195        data: [1633, 1267, 3],
196        backgroundColor: ['#da3633', '#2ea043', '#d29922', '#58a6ff', '#8957e5'],
197        borderWidth: 0
198      }]
199    },
200    options: {
201      responsive: true,
202      plugins: { legend: { position: 'right', labels: { color: '#c9d1d9' } } }
203    }
204  });
205});
206</script>
206
207
208</body></html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.