XProtect-Malware-Families

Mapping XProtect's obfuscated malware family names to common industry names.

This is a work-in-progress that is primarily intended to map the obfuscated (alphanumeric) names used by Apple to more common names used by commercial vendors and found in public malware repos like VirusTotal.

Unless indicated otherwise, hashes provided in the listings are representative examples, not an exhaustive listing of all known matches.

Search XProtect/Malware names on the Command Line

To be able to search for XProtect rules that match industry names on the command line, save the xprotect_families.txt file somewhere on disk, and add the following to your .bashrc or .zshrc config file, adjusting the path at the end of the grep command to your chosen location:

xprule () {
	grep --color=auto --exclude-dir={.bzr,CVS,.git,.hg,.svn,.idea,.tox} -i $1 /usr/local/bin/xprotect_families.txt
}