There are a lot of different malware names used in the IT security community for the same kind of malware. This repository holds regular expression to match those and derive a commonly used malware family name.
This mapping is used in reporting (as generic name) and for statistics purpose.
Currently it is comma-separated. The meaning of the columns is:
- regular expression, starting with
^and ending with$. It can/should be applied case-insensitive. The field is encapsulated in double quotes ("). - malware family name
- optional comment (origin of the rule, where the malware names occur etc)
> ./scripts/tools.py lookup b66-ir
Found match 'b66-ir' -> 'andromeda'.To check the validity of the file, you can run ./scripts/test.py. It checks if
- all lines do match the format,
- there are not family matching to other family names and
- that each family names is matched to itself.