If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable:
These names have always puzzled me a little. There seems to be a lot of information encoded in these names, but I can't readily make sense of it, and I can't find any kind of guide for reading them.
- Are there well-defined standards (or at least common practices) when it comes to naming malware, or is it up to the whims (or proprietary standards) of each vendor?
- Is there a well-understood vocabulary (e.g. does "
Autorun" have a standard specific meaning, like "relies on Windows autorun functionality"), and do the symbols (
.) have a fixed particular meaning?
- Do the TLD-like suffixes like
.mlindicate suspected country of origin, or am I reading that wrong?
I'm aware that different anti-virus vendors may have different naming styles. I'm primarily interested in McAfee, but a good answer might point to multiple references for how each vendor assigns malware names or simply provide a high-level overview of how malware naming works.