6

While analyzing a binary online through the virustotal service , I found out that different AVs named the binaries differently.For instance, for that same binary Norman named it Obfuscated_A, Symantec named it WS.Reputation.1 and another AV named it Malware-Cryptor.General.2 .Is there any specific naming convention adopted by the AVs?

8

Different AV vendors use different naming conventions. Many of them describe these conventions on their websites. For example:

AV vendors will sometimes try to use the same names as other AV vendors for well-known malware families, but this is not guaranteed and is becoming less and less common. For example, Microsoft, Sophos, CA, and McAfee all refer to the well-known Conficker family as "Conficker", but Symantec refers to it as "Downadup".

Even when AV vendors agree on a family name, they will hardly ever be in-sync on variant names. So for example, a file detected by Microsoft as Conficker.B might be detected by CA as Conficker.C.

This is why whenever you want to refer to a specific malware variant, it's always best to give the detection name and the AV engine name. Or better yet, just give the file hash and let people look it up on a site like VirusTotal.

  • To add to this slightly, many AV companies directly avoid using common names/strings found in the binary as the direct name of the malware (they often use embedded strings as a starting point though), as they believe it gives the malware authors "celebrity" and they don't want to promote their work. – fileoffset Jan 13 '14 at 4:10
2

Something to take into consideration is generic detection names. Generic detections are designed to catch as many malware samples as possible while avoiding false positives. They can be made to trigger packers or obfuscation, unorthodox behaviors etc. While this improves coverage the end result is that you can have multiple, unrelated malware samples detected under the same name. This makes it harder to identify which specific malware you are facing. Microsoft usually does a good job of detecting samples with their specific name so I usually look at their detection name first.

In the example you give all the names are generic : Obfuscated_A probably triggers on obfuscated code, WS.Reputation.1 is most likely based on file reputation and Malware-Cryptor.General.2 probably detects a packer.

2

I want to add that the malware gets named after what is detected within. For example MyDoom

Schmugar chose the name after noticing the text "mydom" within a line of the program's code. He noted: "It was evident early on that this would be very big. I thought having 'doom' in the name would be appropriate." (Source: Wikipedia)

And Flamer had a lot of functions named "Flame" in it's program code. While I was working at an anti-virus company I always had a great fun with the naming practice. The reason for the names is to make sure you are talking about the same malware (md5 hashes talk really difficult). Also to decorate the families (malware that is 'just' a bit different but mainly the same). This is why you get Conficker.A and Conficker.B (like @JasonGeffer said) . The reason Microsoft's B is Sophos A is because Microsoft found a different sample of the family first in its honeypots :)

other websites that might interest you: http://www.caro.org/ and http://www.eicar.com

  • 2
    it's actually rare that we pick something from the contents, because it's rare to find anything good. Usually we just pick words out of the air - that we haven't used already, of course. – peter ferrie Jan 8 '14 at 19:33
  • @peterferrie Funny to see that even Anti-Virus companies differ. But then again, Conficker was called Kido when I first heard of it. After I learned the entire planet it Conficker someone named it DownAUp. – Stolas Jan 9 '14 at 9:02
  • 1
    @Stolas: I guess AV researchers got burned by picking something. Company lore has it that at one point someone picked a word that meant something really rude in a foreign language. Everybody outside our company attributed it to a particular researcher. Until that researcher noticed the name first and informed the other (unwitting) researchers what it meant in a certain group of languages. So the more abstract, the better. – 0xC0000022L Jan 10 '14 at 0:14
1

Generally Antivirus companies follow the naming convention proposed by CARO (Computer Antivirus Research Organization).

A malware usually gets a name based on the strings found in it. In some cases based on Mutex/ file name/server name/registry keys and very rarely based on its action.

In some AV companies they give certain names to track the detections made by generic/ heuristic detection methods (eg:Obfuscated_A, WS.Reputation.1)

  • CARO -> Computer Antivirus Research Organization? – Stolas Jan 9 '14 at 9:00
  • @Stolas yes you are right :) – Palaniyappan Bala Jan 9 '14 at 9:13
  • @PalaniyappanBala: actually that's untrue. All efforts to unify the naming schemes have been busted. Those specifications of course exist, but there are too many exceptions to claim that they "follow" it. This is as much for practical reasons as for competitive ones. Disclosure: I work for an AV company myself. – 0xC0000022L Jan 9 '14 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.