| | | EDR-Freeze | [] | win.edr_freeze | [] | 2026-06-10 | | | |
| | | defendnot | [] | win.defendnot | [] | 2026-06-10 | | | |
| | | StilachiRAT | [] | win.stilachi_rat | [] | 2026-06-10 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-05-13 | | | |
| | | LegionRelay | [] | ps1.legion_relay | ['GreyVibe'] | 2026-06-09 | | | |
| | | PhantomRelay | [] | ps1.phantom_relay | ['GreyVibe'] | 2026-06-09 | | | |
| | | Banana RAT | [] | ps1.banana_rat | ['SHADOW-WATER-063'] | 2026-06-09 | | | |
| | | Godzilla Webshell | [] | jsp.godzilla_webshell | [] | 2026-06-09 | | | |
| | | 404 Keylogger | ['404KeyLogger', 'Snake Keylogger'] | win.404keylogger | [] | 2026-06-09 | | | |
| | | Agent Tesla | ['AgenTesla', 'AgentTesla', 'Negasteal'] | win.agent_tesla | ['SWEED'] | 2026-06-09 | | | |
| | | RedLine Stealer | ['RECORDSTEALER'] | win.redline_stealer | [] | 2026-06-09 | | | |
| | | Formbook | ['win.xloader'] | win.formbook | ['SWEED', 'Cobalt'] | 2026-06-09 | | | |
| | | PixyNetLoader | [] | win.pixynet_loader | ['APT28'] | 2026-06-10 | | | |
| | | LOTUSLITE | [] | win.lotuslite | ['MUSTANG PANDA'] | 2026-06-09 | | | |
| | | BirdCall | [] | win.birdcall | ['APT37'] | 2026-06-09 | | | |
| | | DPAPILoader | [] | win.dpapi_loader | ['Lazarus Group'] | 2026-06-09 | | | |
| | | RemotePE | [] | win.remotepe | ['Lazarus Group'] | 2026-06-09 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-05-19 | | | |
| | | SILENTLOOP | [] | ps1.silentloop | [] | 2026-06-09 | | | |
| | | AGINGFLY | [] | win.agingfly | [] | 2026-06-09 | | | |
| | | Overlord RAT | [] | win.overlord | [] | 2026-06-09 | | | |
| | | Havoc | ['Havokiz'] | win.havoc | [] | 2026-06-09 | | | |
| | | xmrig | [] | win.xmrig | [] | 2026-06-09 | | | |
| | | Chisel | [] | win.chisel | [] | 2026-06-09 | | | |
| | | Shai-Hulud | [] | js.shai_hulud | [] | 2026-06-09 | | | |
| | | RecJS | [] | js.recjs | [] | 2026-06-09 | | | |
| | | C0XMO | [] | elf.c0xmo | [] | 2026-06-08 | | | |
| | | Bashlite | ['gayfgt', 'Gafgyt', 'qbot', 'torlus', 'lizkebab'] | elf.bashlite | [] | 2026-06-08 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2026-05-27 | | | |
| | | StoatWaffle | [] | js.stoatwaffle | [] | 2026-03-27 | | | |
| | | COMPOOD | [] | elf.compood | [] | 2026-06-08 | | | |
| | | Proslikefan | [] | js.proslikefan | [] | 2026-06-03 | | | |
| | | Azorult | ['PuffStealer', 'Rultazo'] | win.azorult | ['The Gorgon Group'] | 2026-06-02 | | | |
| | | IcedID | ['BokBot', 'IceID'] | win.icedid | ['GOLD CABIN', 'Lunar Spider'] | 2026-06-02 | | | |
| | | Gozi | ['CRM', 'Gozi CRM', 'Papras', 'Snifula', 'Ursnif'] | win.gozi | [] | 2026-06-02 | | | |
| | | ISFB | ['Gozi ISFB', 'IAP', 'Pandemyia'] | win.isfb | ['GOLD CABIN'] | 2026-06-02 | | | |
| | | LOLSnif | [] | win.lolsnif | [] | 2026-06-02 | | | |
| | | SUNBURST | ['Solorigate'] | win.sunburst | ['APT 29', 'UNC2452'] | 2026-06-02 | | | |
| | | TEARDROP | [] | win.teardrop | ['UNC2452'] | 2026-06-02 | | | |
| | | Calfbot | [] | sh.calfbot | ['[Unnamed group]'] | 2026-06-02 | | | |
| | | Metaencryptor | [] | win.metaencryptor | [] | 2026-06-02 | | | |
| | | GRUNT | ['Covenant'] | win.grunt | [] | 2026-06-02 | | | |
| | | MiniFast | [] | win.minifast | ['UNC1549'] | 2026-06-02 | | | |
| | | ThemeForestRAT | ['TALLSHIP'] | win.theme_forest_rat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | POOLRAT | ['SIMPLESEA', 'SIMPLETEA'] | osx.poolrat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | SimpleTea | ['PondRAT', 'SimplexTea'] | elf.simpletea | ['Lazarus Group'] | 2026-06-02 | | | |
| | | JADESNOW | ['ChainedDown'] | js.jadesnow | ['WageMole'] | 2026-06-02 | | | |
| | | PylangGhost | ['ICEBITE.PYTHON', 'WeaselStore'] | py.pylangghost | ['WageMole'] | 2026-06-02 | | | |
| | | JFMBackdoor | [] | win.jfmbackdoor | ['Calypso'] | 2026-06-01 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2026-06-01 | | | |
| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2026-05-27 | | | |
| | | ValleyRAT | ['Winos'] | win.valley_rat | [] | 2026-05-27 | | | |
| | | Mirax | ['Astrinox', 'Mirax Bot', 'MiraxRAT'] | apk.mirax | [] | 2026-05-27 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2026-05-27 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2026-05-19 | | | |
| | | RemoteX | [] | win.remotex | [] | 2026-05-22 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | ['CoralRaider'] | 2026-05-21 | | | |
| | | LockBit | [] | elf.lockbit | [] | 2026-05-21 | | | |
| | | LockBit | ['ABCD Ransomware'] | win.lockbit | [] | 2026-05-21 | | | |
| | | PhantomCore | [] | win.phantomcore | [] | 2026-05-21 | | | |
| | | Payload | [] | win.payload | [] | 2026-05-21 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT17', 'APT23', 'APT41', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA', 'Webworm'] | 2026-05-21 | | | |
| | | Gentlemen | [] | win.gentlemen | ['The Gentlemen'] | 2026-05-21 | | | |
| | | TONESHELL | [] | win.toneshell | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-05-21 | | | |
| | | FINALDRAFT | [] | win.finaldraft | [] | 2026-05-21 | | | |
| | | VShell | [] | win.vshell | [] | 2026-05-21 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2026-05-21 | | | |
| | | Slopoly | [] | ps1.slopoly | ['Hive0163'] | 2026-05-20 | | | |
| | | Lorem Ipsum | [] | win.lorem_ipsum | [] | 2026-05-20 | | | |
| | | TCLBANKER | [] | win.tclbanker | [] | 2026-05-20 | | | |
| | | DragonBreath | [] | win.dragonbreath | [] | 2026-05-20 | | | |
| | | PicassoLoader | [] | win.picasso_loader | ['Ghostwriter'] | 2026-05-19 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2026-05-19 | | | |
| | | Payload | [] | elf.payload | [] | 2026-05-19 | | | |
| | | Lalia Ransomware | [] | win.lalia_ransomware | [] | 2026-05-19 | | | |
| | | HijackLoader | ['DOILoader', 'GHOSTPULSE', 'IDAT Loader', 'SHADOWLADDER'] | win.hijackloader | [] | 2026-05-19 | | | |
| | | Black Basta | ['no_name_software'] | win.blackbasta | ['GOLD REBELLION', 'STAC5143', 'Storm-0506', 'Storm-0826', 'TA2101', 'UNC3973', 'UNC4393'] | 2026-05-19 | | | |
| | | BanPolMex RAT | [] | win.banpolmex | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Bart | [] | win.bart | [] | 2022-02-14 | | | |
| | | BatchWiper | [] | win.batchwiper | [] | 2021-10-05 | | | |
| | | Batel | [] | win.batel | [] | 2020-04-21 | | | |
| | | BazarBackdoor | ['BEERBOT', 'KEGTAP', 'Team9Backdoor', 'bazaloader', 'bazarloader'] | win.bazarbackdoor | ['UNC1878'] | 2023-10-16 | | | |
| | | BBSRAT | [] | win.bbsrat | [] | 2023-06-23 | | | |
| | | BEARDSHELL | [] | win.beardshell | ['APT28'] | 2026-03-11 | | | |
| | | win.beast | ['blacklockbit'] | win.beast | [] | 2025-04-28 | | | |
| | | BEATDROP | [] | win.beatdrop | ['APT29'] | 2024-02-02 | | | |
| | | Bedep | [] | win.bedep | [] | 2026-05-05 | | | |
| | | Bee | [] | win.bee | [] | 2021-01-29 | | | |
| | | BeepService | [] | win.beepservice | [] | 2020-05-27 | | | |
| | | BernhardPOS | [] | win.bernhardpos | [] | 2022-09-19 | | | |
| | | Bert | [] | win.bert | [] | 2025-09-23 | | | |
| | | BetaBot | ['Neurevt'] | win.betabot | [] | 2026-04-22 | | | |
| | | BHunt | [] | win.bhunt | [] | 2022-02-26 | | | |
| | | BH_A006 | [] | win.bh_a006 | [] | 2024-11-25 | | | |
| | | BiBi | ['BiBi-Windows'] | win.bibi | ['Void Manticore'] | 2024-12-16 | | | |
| | | BI_D Ransomware | [] | win.bid_ransomware | [] | 2019-08-12 | | | |
| | | BillGates | [] | win.billgates | [] | 2023-08-31 | | | |
| | | Biscuit | ['zxdosml'] | win.biscuit | ['Comment Crew'] | 2018-02-10 | | | |
| | | BISTROMATH | [] | win.bistromath | ['Lazarus Group', 'Silent Chollima'] | 2023-09-22 | | | |