STAGE 3: CLASSIFY

Malware Family Taxonomy & Capability Classifier

Deep behavioral family taxonomy classification across Ransomware, Trojan, Stealer, C2 Beacon, Worm, and Backdoor with capability profile mapping and phylogenetic ancestry lineage.

🔒

PRIMARY TAXONOMY VERDICT• ID: SAMPLE-001

Ransomware Family (WannaCry.exe)

Alias / Variant: WanaCrypt0r 2.0 / tasksche.exe • Architecture: x86 (32-bit)

Classification Confidence

99.4%

MALICIOUS

Multi-Class Family Probability Distribution

RansomwareTOP MATCH

99.4%

Rationale: Mass file encryption + vssadmin shadow wipe + .WNCRY extension

Worm

91.2%

Rationale: Autonomous SMB MS17-010 spreading module

Trojan

45%

Rationale: Dropped secondary stage tasksche.exe

Stealer

8.5%

Rationale: No credential harvester detected

C2 Beacon

18%

Rationale: HTTP sinkhole probing activity

Backdoor

12%

Rationale: No persistent interactive shell

Taxonomy Classification Schema (6 Core Families)

🔒Ransomware

1 Loaded Sample

Mass-cryptographic extortion threats targeting user documents, volume shadow copies, and enterprise file shares.

WannaCry 2.0LockBit 3.0BlackCat (ALPHV)

🎭Trojan

1 Loaded Sample

Disguised malicious payloads packaged within seemingly legitimate utilities, installers, or document lures.

SillyPuttyEmotetQakbot

🗝️Stealer

2 Loaded Sample

High-speed harvesters targeting browser passwords, crypto wallets, session cookies, Discord/Telegram tokens, and VPN profiles.

RedLine StealerSikoMode (Nim)Racoon Stealer v2

📡C2 Beacon

1 Loaded Sample

Interactive command & control implant operating stealthily via reflective injection, malleable HTTPS, and named pipes.

Cobalt Strike BeaconSliverMythic Agent

🐛Worm

1 Loaded Sample

Self-propagating standalone malware utilizing network vulnerabilities or removable drives to replicate autonomously.

WannaCry SMB WormConfickerStuxnet

🚪Backdoor

1 Loaded Sample

Persistent remote access implant maintaining covert interactive shell control and unauthenticated access for threat actors.

SillyPutty BackdoorPoisonIvyPlugX