KAMAS is a knowledge-assisted visualization system for behavior-based malware analysis. It supports malware analysts with visual analytics and knowledge externalization methods for the analysis process. In this screen KAMAS is used to explore 794 rules extracted from a cluster of 16 malware sample (3x Graybird (Trojan), 1x IRCBot (Bot), 12x Koobface (Worm)).