| Threat Alias | Number of Incidents |
| Hacktool.Rootkit [Symantec] | 19,865 |
| Rootkit.Win32.Agent.ex [Kaspersky Lab] | 19,865 |
| TrojanSpy:Win32/Ursnif [Microsoft] | 19,729 |
| Generic Rootkit.d [McAfee] | 19,591 |
| TROJ_ROOTKIT.FX [Trend Micro] | 18,906 |
| Rootkit.Agent.EX [PC Tools] | 18,085 |
| Rootkit.Win32.Agent.ex [Ikarus] | 15,892 |
| Win-Trojan/Agent.8192.BP [AhnLab] | 6,576 |
| Rootkit.Agent.CZBC [PC Tools] | 822 |
| Infostealer [Symantec] | 4 |
| Trojan-PSW.Win32.Papras.hv [Kaspersky Lab] | 4 |
| Trojan-PWS.Win32.Papras [Ikarus] | 4 |
| Trojan-PSW.Papras!sd6 [PC Tools] | 2 |
| TrojanSpy:Win32/Ursnif.V [Microsoft] | 2 |
| Infostealer.Snifula.C [Symantec] | 1 |
| Spy-Agent.bg [McAfee] | 1 |
| TROJ_AGENT.ANZC [Trend Micro] | 1 |
| Trojan-PSW.Win32.Papras.ga [Kaspersky Lab] | 1 |
