New malware classification system

Kaspersky Lab is currently switching to a new malware classification system

Glossary: Malware

Malware (short for malicious software) refers to any program that is deliberately created to perform an unauthorized, often harmful, action.


The new system will make it easier to navigate the virus descriptions.

Naming of malicious programs

Each malicious program is given a name which has several parts.

Any program which is given a name containing the term VirWare, TrojWare, MalWare, RiskWare, AdWare or PornWare will be a malicious program.

The name of each malicious program can be broken down in the following way:

Verdict: verdict clarification

Verdict clarification includes the following categories:


Verdict: this is an umbrella description which covers the main characteristics of a virus sample: VirWare, TrojWare, MalWare, RiskWare, AdWare, PornWare, SPAM, or Attack.

Behaviour: this defines the malicious program’s payload. Backdoor, Virus etc. are all examples of Behaviour. A less threatening behaviour will be subsumed by the most threatening behaviour. For example, if a program has a backdoor function, but also infects files, the behaviour will be classified as Virus. If in addition to these behaviours, the malicious program spreads via network connections, the behaviour will be classified as Worm.

Sub-behaviour: this category is only used if the malicious program has a sub-behavior. It defines the main behaviour further. For instance, a malicious program classified as Trojan-Spy has the sub-behaviour Spy and so on. The sub-behaviour term is separated from the behavior term by a dash.

In the case of worms, the sub-behaviour term will be a prefix to the main behaviour term: P2P-Worm, Net-Worm etc.

OS gives the operating system in which the malicious program functions eg. Win32, BAT, IRC etc.

Name: the name which the Virus Lab has given to the malicious program.

Modification: shows the different versions of a malicious program grouped under one name.

An example of a name under the new classification system would be Trojan-Dropper.Win32.Agent.a – a Trojan which drops another malicious program, operates in Win32. The Virus Lab has named this program Agent, and this particular program is modification a, the first in a series.

Names of malicious programs always include the Behaviour, OS, Name and Modification terms.

New malware classification system

Your email address will not be published. Required fields are marked *



Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Andariel evolves to target South Korea with ransomware

In April 2021, we observed a suspicious Word document with a Korean file name and decoy. It revealed a novel infection scheme and an unfamiliar payload. After a deep analysis, we came to a conclusion: the Andariel group was behind these attacks.

Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

Subscribe to our weekly e-mails

The hottest research right in your inbox