It's consensus but it takes account how popular the name is elsewhere and tries to pick a more hipster name. If 5 AVs say this is the family for this malware a

It's consensus but it takes account how popular the name is elsewhere and tries to pick a more hipster name. If 5 AVs say this is the family for this malware and you don't see that family much elsewhere, then that would be picked as a family. That way you get rid of all the "Agent" type families etc unless there is nothing better. Would have been cooler if the content was also taken into account. Regarding packers I agree, but it is kind of the same situation with every other packer, including Themida and VMProtect. So some AVs decided to call it by the name of the packer since they probably see a lot of malware packed with that packer and not much else.