If you take a look at McAfee's recent malware page, you'll see that the names in the "Malware name" column aren't very human-readable: Downloader.a!cnz
, W32/Autorun.worm.bgh
, FakeAlert-SecurityTool.fx
, etc.
These names have always puzzled me a little. There seems to be a lot of information encoded in these names, but I can't readily make sense of it, and I can't find any kind of guide for reading them.
- Are there well-defined standards (or at least common practices) when it comes to naming malware, or is it up to the whims (or proprietary standards) of each vendor?
- Is there a well-understood vocabulary (e.g. does "
Autorun
" have a standard specific meaning, like "relies on Windows autorun functionality"), and do the symbols (!
,.
) have a fixed particular meaning? - Do the TLD-like suffixes like
.ml
indicate suspected country of origin, or am I reading that wrong?
I'm aware that different anti-virus vendors may have different naming styles. I'm primarily interested in McAfee, but a good answer might point to multiple references for how each vendor assigns malware names or simply provide a high-level overview of how malware naming works.