Skip to content

Instantly share code, notes, and snippets.

@Blevene
Last active November 30, 2020 17:49
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save Blevene/7b5620dafe370915e074b7b31619babd to your computer and use it in GitHub Desktop.
Save Blevene/7b5620dafe370915e074b7b31619babd to your computer and use it in GitHub Desktop.
Crimeware in the Modern Era Appendix
distinct_samples month keyword
133308 201812 steal
992409 201812 ransom
155525 201812 bank
641780 201812 mine
709085 201811 mine
898598 201811 ransom
257001 201811 bank
168621 201811 steal
1093310 201810 mine
247866 201810 steal
592425 201810 ransom
366397 201810 bank
346087 201809 bank
593410 201809 ransom
1041880 201809 mine
229592 201809 steal
282320 201808 bank
1024006 201808 mine
564403 201808 ransom
202539 201808 steal
314291 201807 bank
691021 201807 mine
245744 201807 steal
873963 201807 ransom
389928 201806 ransom
328989 201806 bank
460998 201806 mine
260487 201806 steal
353238 201805 steal
494563 201805 ransom
281464 201805 mine
448683 201805 bank
702092 201804 mine
514317 201804 bank
538792 201804 ransom
486050 201804 steal
369491 201803 bank
322789 201803 steal
619473 201803 ransom
1262692 201803 mine
1909609 201802 mine
698949 201802 ransom
481560 201802 bank
310958 201802 steal
502871 201801 bank
348199 201801 steal
1040395 201801 ransom
2404363 201801 mine
2189477 201712 ransom
366072 201712 bank
286287 201712 steal
119470 201712 mine
226738 201711 steal
282621 201711 bank
89112 201711 mine
1087268 201711 ransom
59866 201710 mine
278726 201710 steal
2486859 201710 bank
845517 201710 ransom
208451 201709 steal
766912 201709 ransom
44357 201709 mine
2484379 201709 bank
1155428 201708 ransom
1072636 201708 bank
160252 201708 steal
23790 201708 mine
195039 201707 steal
1052420 201707 ransom
1160206 201707 bank
23007 201707 mine
138136 201706 steal
893357 201706 bank
855280 201706 ransom
16269 201706 mine
352013 201705 steal
753124 201705 ransom
19903 201705 mine
481369 201705 bank
220354 201704 bank
622386 201704 ransom
16713 201704 mine
176240 201704 steal
866782 201703 ransom
276385 201703 bank
17661 201703 mine
188929 201703 steal
13734 201702 mine
66006 201702 bank
94552 201702 steal
738306 201702 ransom
54249 201701 bank
99674 201701 steal
23611 201701 mine
889662 201701 ransom
14118 201612 mine
750441 201612 ransom
80112 201612 steal
64151 201612 bank
104882 201611 steal
17795 201611 mine
547007 201611 ransom
143872 201611 bank
11649 201610 mine
455400 201610 ransom
81956 201610 steal
41409 201610 bank
91609 201609 steal
43461 201609 bank
667964 201609 ransom
12049 201609 mine
11907 201608 mine
62923 201608 steal
477144 201608 ransom
33087 201608 bank
37364 201607 steal
32961 201607 bank
13443 201607 mine
510748 201607 ransom
37945 201606 bank
15111 201606 mine
91393 201606 steal
537918 201606 ransom
281922 201605 steal
92740 201605 bank
538179 201605 ransom
12817 201605 mine
40512 201604 bank
11412 201604 mine
397464 201604 ransom
93450 201604 steal
15080 201603 mine
427171 201603 ransom
41939 201603 steal
39372 201603 bank
49037 201602 steal
8423 201602 mine
228780 201602 ransom
39580 201602 bank
88502 201601 ransom
6894 201601 mine
68787 201601 steal
35009 201601 bank
105628 201512 ransom
11058 201512 mine
68254 201512 steal
50745 201512 bank
13722 201511 mine
67580 201511 steal
138426 201511 ransom
31378 201511 bank
22558 201510 bank
73986 201510 steal
324088 201510 ransom
15397 201510 mine
28176 201509 bank
74496 201509 steal
11115 201509 mine
154823 201509 ransom
11068 201508 mine
35163 201508 bank
113269 201508 ransom
86573 201508 steal
154868 201507 ransom
9462 201507 mine
50813 201507 bank
80433 201507 steal
17785 201506 mine
41489 201506 bank
274678 201506 ransom
87303 201506 steal
74261 201505 bank
34278 201505 mine
524270 201505 ransom
128910 201505 steal
67649 201504 bank
133092 201504 ransom
11446 201504 mine
148994 201504 steal
119058 201503 steal
324871 201503 ransom
17561 201503 mine
55973 201503 bank
142324 201502 steal
50871 201502 bank
19206 201502 mine
276937 201502 ransom
95137 201501 bank
59418 201501 mine
252236 201501 steal
203978 201501 ransom
53756 201412 mine
83847 201412 ransom
85732 201412 bank
330578 201412 steal
54338 201411 bank
219528 201411 steal
115706 201411 ransom
44109 201411 mine
109485 201410 bank
49194 201410 mine
98046 201410 ransom
257272 201410 steal
224817 201409 steal
116288 201409 bank
75987 201409 ransom
50120 201409 mine
66637 201408 mine
139192 201408 bank
154871 201408 steal
58314 201408 ransom
92685 201407 steal
36406 201407 ransom
46498 201407 bank
41131 201407 mine
74350 201406 bank
101552 201406 steal
32784 201406 mine
44146 201406 ransom
126668 201405 steal
23404 201405 mine
60364 201405 bank
51137 201405 ransom
45049 201404 ransom
199477 201404 steal
82351 201404 bank
37804 201404 mine
45146 201403 bank
44010 201403 mine
120619 201403 steal
60438 201403 ransom
33707 201402 mine
91661 201402 steal
73100 201402 ransom
52781 201402 bank
94180 201401 bank
34533 201401 mine
127504 201401 ransom
136445 201401 steal
115469 201312 ransom
66190 201312 bank
15481 201312 mine
118029 201312 steal
10390 201311 mine
158455 201311 ransom
97802 201311 steal
36149 201311 bank
74270 201310 steal
92046 201310 ransom
35863 201310 bank
8747 201310 mine
52470 201309 bank
126055 201309 ransom
188861 201309 steal
17639 201309 mine
217462 201308 bank
31472 201308 mine
1008787 201308 steal
302154 201308 ransom
16690 201307 mine
231900 201307 steal
92326 201307 bank
144494 201307 ransom
60497 201306 bank
133469 201306 steal
11356 201306 mine
129470 201306 ransom
18975 201305 mine
46482 201305 bank
145783 201305 steal
125996 201305 ransom
57784 201304 bank
117934 201304 ransom
238317 201304 steal
24491 201304 mine
5792 201303 mine
106091 201303 ransom
50498 201303 bank
216959 201303 steal
267303 201302 steal
49805 201302 bank
5824 201302 mine
95788 201302 ransom
263797 201301 steal
6962 201301 mine
92916 201301 ransom
47244 201301 bank
@Blevene
Copy link
Author

Blevene commented Aug 23, 2019

Stats (rounded to nearest 10,000):

Keyword Average Median
bank 720000 230000
ransom 1290000 870000
steal 550000 490000
mine 570000 60000

@Blevene
Copy link
Author

Blevene commented Aug 23, 2019

Month by Month Average Comparison
(Where ct samples is count of distinct samples and cmp avg is comparison for that months average for a given keyword against the overall average for a given keyword.)

  keyword Values            
  bank   mine   ransom   steal  
year-month ct samples cmp avg ct samples cmp avg ct samples cmp avg ct samples cmp avg
201301 47244 18.11% 6962 2.67% 92916 35.63% 263797 101.14%
201302 49805 19.10% 5824 2.23% 95788 36.73% 267303 102.49%
201303 50498 19.36% 5792 2.22% 106091 40.68% 216959 83.19%
201304 57784 22.16% 24491 9.39% 117934 45.22% 238317 91.37%
201305 46482 17.82% 18975 7.28% 125996 48.31% 145783 55.90%
201306 60497 23.20% 11356 4.35% 129470 49.64% 133469 51.17%
201307 92326 35.40% 16690 6.40% 144494 55.40% 231900 88.91%
201308 217462 83.38% 31472 12.07% 302154 115.85% 1008787 386.78%
201309 52470 20.12% 17639 6.76% 126055 48.33% 188861 72.41%
201310 35863 13.75% 8747 3.35% 92046 35.29% 74270 28.48%
201311 36149 13.86% 10390 3.98% 158455 60.75% 97802 37.50%
201312 66190 25.38% 15481 5.94% 115469 44.27% 118029 45.25%
201401 94180 36.11% 34533 13.24% 127504 48.89% 136445 52.32%
201402 52781 20.24% 33707 12.92% 73100 28.03% 91661 35.14%
201403 45146 17.31% 44010 16.87% 60438 23.17% 120619 46.25%
201404 82351 31.57% 37804 14.49% 45049 17.27% 199477 76.48%
201405 60364 23.14% 23404 8.97% 51137 19.61% 126668 48.57%
201406 74350 28.51% 32784 12.57% 44146 16.93% 101552 38.94%
201407 46498 17.83% 41131 15.77% 36406 13.96% 92685 35.54%
201408 139192 53.37% 66637 25.55% 58314 22.36% 154871 59.38%
201409 116288 44.59% 50120 19.22% 75987 29.13% 224817 86.20%
201410 109485 41.98% 49194 18.86% 98046 37.59% 257272 98.64%
201411 54338 20.83% 44109 16.91% 115706 44.36% 219528 84.17%
201412 85732 32.87% 53756 20.61% 83847 32.15% 330578 126.75%
201501 95137 36.48% 59418 22.78% 203978 78.21% 252236 96.71%
201502 50871 19.50% 19206 7.36% 276937 106.18% 142324 54.57%
201503 55973 21.46% 17561 6.73% 324871 124.56% 119058 45.65%
201504 67649 25.94% 11446 4.39% 133092 51.03% 148994 57.13%
201505 74261 28.47% 34278 13.14% 524270 201.01% 128910 49.43%
201506 41489 15.91% 17785 6.82% 274678 105.32% 87303 33.47%
201507 50813 19.48% 9462 3.63% 154868 59.38% 80433 30.84%
201508 35163 13.48% 11068 4.24% 113269 43.43% 86573 33.19%
201509 28176 10.80% 11115 4.26% 154823 59.36% 74496 28.56%
201510 22558 8.65% 15397 5.90% 324088 124.26% 73986 28.37%
201511 31378 12.03% 13722 5.26% 138426 53.07% 67580 25.91%
201512 50745 19.46% 11058 4.24% 105628 40.50% 68254 26.17%
201601 35009 13.42% 6894 2.64% 88502 33.93% 68787 26.37%
201602 39580 15.18% 8423 3.23% 228780 87.72% 49037 18.80%
201603 39372 15.10% 15080 5.78% 427171 163.78% 41939 16.08%
201604 40512 15.53% 11412 4.38% 397464 152.39% 93450 35.83%
201605 92740 35.56% 12817 4.91% 538179 206.35% 281922 108.09%
201606 37945 14.55% 15111 5.79% 537918 206.25% 91393 35.04%
201607 32961 12.64% 13443 5.15% 510748 195.83% 37364 14.33%
201608 33087 12.69% 11907 4.57% 477144 182.94% 62923 24.13%
201609 43461 16.66% 12049 4.62% 667964 256.11% 91609 35.12%
201610 41409 15.88% 11649 4.47% 455400 174.61% 81956 31.42%
201611 143872 55.16% 17795 6.82% 547007 209.73% 104882 40.21%
201612 64151 24.60% 14118 5.41% 750441 287.73% 80112 30.72%
201701 54249 20.80% 23611 9.05% 889662 341.11% 99674 38.22%
201702 66006 25.31% 13734 5.27% 738306 283.08% 94552 36.25%
201703 276385 105.97% 17661 6.77% 866782 332.34% 188929 72.44%
201704 220354 84.49% 16713 6.41% 622386 238.63% 176240 67.57%
201705 481369 184.56% 19903 7.63% 753124 288.76% 352013 134.97%
201706 893357 342.53% 16269 6.24% 855280 327.93% 138136 52.96%
201707 1160206 444.84% 23007 8.82% 1052420 403.51% 195039 74.78%
201708 1072636 411.27% 23790 9.12% 1155428 443.01% 160252 61.44%
201709 2484379 952.55% 44357 17.01% 766912 294.05% 208451 79.92%
201710 2486859 953.50% 59866 22.95% 845517 324.18% 278726 106.87%
201711 282621 108.36% 89112 34.17% 1087268 416.88% 226738 86.93%
201712 366072 140.36% 119470 45.81% 2189477 839.48% 286287 109.77%
201801 502871 192.81% 2404363 921.87% 1040395 398.90% 348199 133.50%
201802 481560 184.64% 1909609 732.17% 698949 267.99% 310958 119.23%
201803 369491 141.67% 1262692 484.14% 619473 237.52% 322789 123.76%
201804 514317 197.20% 702092 269.19% 538792 206.58% 486050 186.36%
201805 448683 172.03% 281464 107.92% 494563 189.62% 353238 135.44%
201806 328989 126.14% 460998 176.75% 389928 149.50% 260487 99.87%
201807 314291 120.50% 691021 264.95% 873963 335.09% 245744 94.22%
201808 282320 108.25% 1024006 392.62% 564403 216.40% 202539 77.66%
201809 346087 132.70% 1041880 399.47% 593410 227.52% 229592 88.03%
201810 366397 140.48% 1093310 419.19% 592425 227.15% 247866 95.04%
201811 257001 98.54% 709085 271.87% 898598 344.54% 168621 64.65%

@Blevene
Copy link
Author

Blevene commented Aug 23, 2019

Pivot Table of Raw Data:

distinct_samples keyword      
year-month bank mine ransom steal
201301 47244 6962 92916 263797
201302 49805 5824 95788 267303
201303 50498 5792 106091 216959
201304 57784 24491 117934 238317
201305 46482 18975 125996 145783
201306 60497 11356 129470 133469
201307 92326 16690 144494 231900
201308 217462 31472 302154 1008787
201309 52470 17639 126055 188861
201310 35863 8747 92046 74270
201311 36149 10390 158455 97802
201312 66190 15481 115469 118029
201401 94180 34533 127504 136445
201402 52781 33707 73100 91661
201403 45146 44010 60438 120619
201404 82351 37804 45049 199477
201405 60364 23404 51137 126668
201406 74350 32784 44146 101552
201407 46498 41131 36406 92685
201408 139192 66637 58314 154871
201409 116288 50120 75987 224817
201410 109485 49194 98046 257272
201411 54338 44109 115706 219528
201412 85732 53756 83847 330578
201501 95137 59418 203978 252236
201502 50871 19206 276937 142324
201503 55973 17561 324871 119058
201504 67649 11446 133092 148994
201505 74261 34278 524270 128910
201506 41489 17785 274678 87303
201507 50813 9462 154868 80433
201508 35163 11068 113269 86573
201509 28176 11115 154823 74496
201510 22558 15397 324088 73986
201511 31378 13722 138426 67580
201512 50745 11058 105628 68254
201601 35009 6894 88502 68787
201602 39580 8423 228780 49037
201603 39372 15080 427171 41939
201604 40512 11412 397464 93450
201605 92740 12817 538179 281922
201606 37945 15111 537918 91393
201607 32961 13443 510748 37364
201608 33087 11907 477144 62923
201609 43461 12049 667964 91609
201610 41409 11649 455400 81956
201611 143872 17795 547007 104882
201612 64151 14118 750441 80112
201701 54249 23611 889662 99674
201702 66006 13734 738306 94552
201703 276385 17661 866782 188929
201704 220354 16713 622386 176240
201705 481369 19903 753124 352013
201706 893357 16269 855280 138136
201707 1160206 23007 1052420 195039
201708 1072636 23790 1155428 160252
201709 2484379 44357 766912 208451
201710 2486859 59866 845517 278726
201711 282621 89112 1087268 226738
201712 366072 119470 2189477 286287
201801 502871 2404363 1040395 348199
201802 481560 1909609 698949 310958
201803 369491 1262692 619473 322789
201804 514317 702092 538792 486050
201805 448683 281464 494563 353238
201806 328989 460998 389928 260487
201807 314291 691021 873963 245744
201808 282320 1024006 564403 202539
201809 346087 1041880 593410 229592
201810 366397 1093310 592425 247866
201811 257001 709085 898598 168621
201812 155525 641780 992409 133308

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment