WinMET (Windows Malware Execution Traces) Dataset

WinMET dataset contains the execution traces generated with CAPE sandbox after analyzing several malware samples. The execution traces are valid JSON files that contain the spawned processes, the sequence of WinAPI and system calls invoked by each process, their parameters, their return values, and OS accesed resources, amongst many others.

Please use this DOI reference that always points to the latest WinMET version: https://doi.org/10.5281/zenodo.12647555

How to use the dataset

All 7z files are password protected. The password is: infected.

• Total execution traces: 31844 (.json files), split into 5 volumes.
• Compressed size per volume: ~2.5 GB.
• Uncompressed size per volume: ~154 GB.
• Total compressed size: ~13 GB.
• Total uncompressed size: ~750 GB.

WinMET Volumes:

• WinMET_volume_1.7z - MD5: bf51181eafc8452090bb6ce9f47b6714
  • Total files: 6369
  • First file: 0000025c5ee1d6707e6dddfe2816f92d9d8d8bb7c84371c44529e8083109b0e5.json
  • Last file: 31c2e51efcbff0aa489aa6af1a48cf78f6a9febfb449a19d029f8cc8ebb4495f.json
• WinMET_volume_2.7z - MD5: aee86b4591a46c69b0d027de80ff1011
  • Total files: 6369
  • First file: 31c4300fdba21e03ce5ad8ef340832493bcbf702a2ee897cf3a85fdd38dbf10c.json
  • Last file: 65a8b01babb2fcf3ed26a2236a606d7bc7d1f087749a455554b8ef7eddba56fc.json
• WinMET_volume_3.7z - MD5 996723774909bc2e6745382697317460
  • Total files: 6369
  • First file: 65a92f49f687b2f421397bbd3a6426b0b4914b896659c2d07a287e112a25939d.json
  • Last file: 996d4e0a67dcad433fa2049dca1defdd984d776fbb5bc5990c0114932be25066.json
• WinMET_volume_4.7z - MD5 4f5acbabeb9d24c96dadef71f56bd916
  • Total files: 6369
  • First file: 996fdb5a25f89426e241f02094474706fafd567fcc5980a07ac7a38efa8625ea.json
  • Last file: cdb5eed6579773d8fbdb13deb766664ba1c8cc01794790855e61e1564daf62f5.json
• WinMET_volume_5.7z - MD5 b3d15c97990dd0dfb0d94e369f486025
  • Total files: 6368
  • First file: cdb7a65d6efc528d6084879e2a24cafb6869c84c45f076208ac437b3bdbdae94.json
  • Last file: ffff75b38c340f90d5fd3fbda5257f11caea5c8160daf26c9a29c04bb333a1c2.json

Additional files:

• cape_report_to_label_mapping.jsoncontains the mappings of each report with its corresponding label as assigned by the CAPE sandbox labeling algorithm, sorted in descendant order (given the number of reports belonging to each label/family).
• avclass_report_to_label_mapping.json contains the mappings of each report with its corresponding label as assigned by AVClass, sorted in descendant order (given the number of reports belonging to each label/family).
• reports_consensus_label.json contains both labels (CAPE and AVClass) for each execution trace.

Citation

If you use this dataset, cite it as follows:

Raducu, R., Villagrasa-Labrador, A., Rodríguez, R. J., & Álvarez, P. (2025). WinMET Dataset [Data set]. Zenodo. https://doi.org/10.5281/zenodo.12647555

BibTex:

@misc{WinMET_dataset,
  author       = {Raducu, Razvan and Villagrasa‑Labrador, Alain and Rodríguez, Ricardo J. and Álvarez, Pedro},
  title        = {{WinMET Dataset: Windows Malware Execution Traces}},
  howpublished = {Zenodo, dataset},
  year         = {2025},
  doi          = {10.5281/zenodo.12647555},
  url          = {https://doi.org/10.5281/zenodo.12647555}
}

This dataset was generated using the MALVADA framework, which you can read more about in our publication https://doi.org/10.1016/j.softx.2025.102082. The article also provides insights about the contents of this dataset.

Razvan Raducu, Alain Villagrasa-Labrador, Ricardo J. Rodríguez, Pedro Álvarez, MALVADA: A framework for generating datasets of malware execution traces, SoftwareX, Volume 30, 2025, 102082, ISSN 2352-7110, https://doi.org/10.1016/j.softx.2025.102082. (https://www.sciencedirect.com/science/article/pii/S2352711025000494)

The following statistic (and many more) can be obtained by analyzing the WinMET dataset with the MALVADA framework.

• Top 20 CAPE consensus labels (there are many more)*:
  • Dacic (3127 execution traces)
  • Padodor (1504 execution traces)
  • Redline (1455 execution traces)
  • Crifi (1101 execution traces)
  • Cosmu (836 execution traces)
  • Agenttesla (806 execution traces)
  • Amadey (601 execution traces)
  • Loki (551 execution traces)
  • Berbew (532 execution traces)
  • Qukart (496 execution traces)
  • Tedy (410 execution traces)
  • Mint (389 execution traces)
  • Metastealer (376 execution traces)
  • Smokeloader (349 execution traces)
  • Taskun (335 execution traces)
  • Virlock (313 execution traces)
  • Formbook (301 execution traces)
  • Strab (273 execution traces)
  • Agensla (235 execution traces)
  • Autorun (229 execution traces)
• Top 20 AVClass consensus labels (there are many more)*:
  • Redline (4438 execution traces)
  • Vbclone (4023 execution traces)
  • Berbew (2794 execution traces)
  • Agenttesla (1201 execution traces)
  • Cosmu (899 execution traces)
  • Taskun (856 execution traces)
  • Disabler (799 execution traces)
  • Amadey (763 execution traces)
  • Gamarue (546 execution traces)
  • Noon (530 execution traces)
  • Strab (468 execution traces)
  • Snojan (433 execution traces)
  • Stop (399 execution traces)
  • Snakelogger (365 execution traces)
  • Virlock (326 execution traces)
  • Qbot (315 execution traces)
  • Equationdrug (270 execution traces)
  • Mokes (262 execution traces)
  • Blihan (261 execution traces)
  • Dofoil (254 execution traces)
• There are 7256 execution traces with no CAPE label.
• There are 1846 execution traces with no AVClass label.
• There are 1241 execution traces with no label.

* The execution traces with no label are assigned the "(n/a)" family. We ommited it here.

Changelog

• 2025.07.25:
  • Dataset now contains ~32K execution traces.
  • Split new dataset into 5 volumes.
  • Updated TOP20 consensus labels.
  • Added reports_consensus_label.json.
  • Fixed Reline <-> Redline AVClass mappings https://github.com/malicialab/avclass/pull/48.
• Version 2.0: Added cape and avclass label mappings.