| | | Horse Shell | [] | elf.horseshell | [] | 2026-10-15 | | | |
| | | ROMCOM RAT | ['PEAPOD', 'SingleCamper', 'SnipBot'] | win.romcom_rat | [] | 2026-10-15 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-10-15 | | | |
| | | RedLine Stealer | ['RECORDSTEALER'] | win.redline_stealer | [] | 2026-10-15 | | | |
| | | Meduza Stealer | [] | win.meduza | [] | 2026-10-15 | | | |
| | | BlackCat | ['ALPHV', 'Noberus'] | elf.blackcat | ['Vanilla Tempest'] | 2026-10-15 | | | |
| | | BlackCat | ['ALPHV', 'Noberus'] | win.blackcat | ['Alpha Spider', 'RansomHub', 'Vanilla Tempest'] | 2026-10-15 | | | |
| | | MimiKatz | [] | win.mimikatz | ['APT10', 'APT32', 'Anunak', 'GALLIUM'] | 2026-10-15 | | | |
| | | Mamba | ['HDDCryptor', 'DiskCryptor'] | win.mamba | [] | 2026-10-15 | | | |
| | | LaZagne | [] | py.lazagne | [] | 2026-10-15 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2026-10-15 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT17', 'APT23', 'APT41', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA', 'Webworm'] | 2026-10-15 | | | |
| | | Dridex | [] | win.dridex | ['Evil Corp', 'INDRIK SPIDER', 'TA505'] | 2026-10-15 | | | |
| | | WARDENStealer | [] | win.warden_stealer | [] | 2026-10-15 | | | |
| | | Runster | ['Google Drive Caching'] | js.runster | [] | 2026-10-15 | | | |
| | | ExplosiveRAT | [] | win.explosive_rat | [] | 2026-10-15 | | | |
| | | Lorem Ipsum | ['AxolotlLoader', 'OAKGLINT'] | win.lorem_ipsum | [] | 2026-10-07 | | | |
| | | CLOUDHAZE | ['zenith'] | win.cloudhaze | [] | 2026-10-15 | | | |
| | | PHANTOMPULSE | [] | win.phantompulse | [] | 2026-10-12 | | | |
| | | PHANTOMPULL | [] | win.phantompull | [] | 2026-10-12 | | | |
| | | QakBot | ['Oakboat', 'Pinkslipbot', 'Qbot', 'Quakbot'] | win.qakbot | ['GOLD CABIN'] | 2026-10-12 | | | |
| | | Hancitor | ['Chanitor'] | win.hancitor | [] | 2026-10-12 | | | |
| | | KimJongRat | [] | win.kimjongrat | [] | 2026-10-12 | | | |
| | | Quasar RAT | ['CinaRAT', 'QuasarRAT', 'Yggdrasil'] | win.quasar_rat | ['APT33', 'Dropping Elephant', 'Stone Panda', 'The Gorgon Group'] | 2026-10-12 | | | |
| | | TinyNuke | ['NukeBot', 'Nuclear Bot', 'MicroBankingTrojan', 'Xbot'] | win.tinynuke | [] | 2026-10-12 | | | |
| | | BabyShark | ['LATEOP'] | win.babyshark | ['Kimsuky'] | 2026-10-12 | | | |
| | | 8.t Dropper | ['8t_dropper', 'RoyalRoad'] | win.8t_dropper | ['Hellsing', 'Ice Fog', 'Pirate Panda', 'RANCOR', 'TA428', 'Tick', 'Tonto Team', 'Karma Panda'] | 2026-10-12 | | | |
| | | SparroWocky | [] | win.sparrowocky | [] | 2026-10-12 | | | |
| | | NeedyMantis | [] | win.needymantis | [] | 2026-10-12 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-10-12 | | | |
| | | Coruna | [] | ios.coruna | [] | 2026-10-12 | | | |
| | | OtterCandy | ['HardHatRAT', 'UNSEENMINK'] | js.ottercandy | ['WageMole'] | 2026-07-17 | | | |
| | | reGeorg | [] | win.regeorg | [] | 2026-10-09 | | | |
| | | YESROBOT | [] | win.yesrobot | ['Callisto'] | 2026-10-09 | | | |
| | | Evilginx | [] | elf.evilginx | [] | 2026-10-09 | | | |
| | | NOROBOT | ['BAITSWITCH'] | win.norobot | ['Callisto'] | 2026-10-09 | | | |
| | | Deputy | [] | win.deputy | [] | 2026-10-09 | | | |
| | | Sheriff | [] | win.sheriff | [] | 2026-10-09 | | | |
| | | KV | [] | sh.kv | ['Volt Typhoon'] | 2026-10-09 | | | |
| | | SNAPPYBEE | ['Deed RAT', 'POISONPLUG.DEED'] | win.snappybee | ['Earth Estries'] | 2026-10-09 | | | |
| | | Winnti | ['BleDoor', 'JUMPALL', 'RbDoor', 'Pasteboy'] | win.winnti | ['APT17'] | 2026-10-09 | | | |
| | | Winnti | [] | osx.winnti | ['APT17'] | 2026-10-09 | | | |
| | | Winnti | [] | elf.winnti | ['Winnti Umbrella'] | 2026-10-09 | | | |
| | | Brute Ratel C4 | ['BOLDBADGER', 'BruteRatel'] | win.brute_ratel_c4 | [] | 2026-10-09 | | | |
| | | Linodas | ['XDealer', 'DinodasRAT'] | elf.linodas | [] | 2026-10-09 | | | |
| | | DinodasRAT | ['XDealer'] | win.dinodas_rat | [] | 2026-10-09 | | | |
| | | JuicyPotato | [] | win.juicy_potato | [] | 2026-10-09 | | | |
| | | HyperBro | [] | win.hyperbro | ['EMISSARY PANDA'] | 2026-10-09 | | | |
| | | VShell | [] | win.vshell | [] | 2026-10-09 | | | |
| | | Reshell | [] | win.reshell | ['GALLIUM'] | 2026-10-09 | | | |
| | | 2CLoader | [] | win.2cloader | [] | 2026-10-09 | | | |
| | | KEYPLUG | ['ELFSHELF'] | elf.keyplug | ['APT41'] | 2026-10-08 | | | |
| | | GOREVERSE | [] | elf.goreverse | ['UNC5174'] | 2026-10-08 | | | |
| | | SNOWLIGHT | [] | elf.snowlight | ['UNC5174'] | 2026-10-08 | | | |
| | | VersaMem | [] | jar.versamem | ['Volt Typhoon'] | 2026-10-08 | | | |
| | | BloodAlchemy | [] | win.bloodalchemy | [] | 2026-10-08 | | | |
| | | Remus | [] | win.remus | [] | 2026-10-08 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2026-10-08 | | | |
| | | XenoRAT | [] | win.xenorat | [] | 2026-10-08 | | | |
| | | xmrig | [] | win.xmrig | [] | 2026-10-08 | | | |
| | | WarLock | [] | win.warlock | [] | 2026-10-08 | | | |
| | | Akira | ['REDBIKE'] | elf.akira | ['Storm-1567'] | 2026-10-08 | | | |
| | | Akira | ['REDBIKE'] | win.akira | ['Storm-1567'] | 2026-10-08 | | | |
| | | Global | ['GLOBAL GROUP'] | win.global | [] | 2026-10-07 | | | |
| | | CountLoader | [] | win.count_loader | [] | 2026-10-07 | | | |
| | | FLEXRAT | [] | win.flexrat | [] | 2026-10-07 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-09-24 | | | |
| | | Ancient | ['ANCT'] | elf.ancient | [] | 2026-10-06 | | | |
| | | Persirai | [] | elf.persirai | [] | 2017-05-09 | | | |
| | | Nosedive | [] | elf.nosedive | ['Flax Typhoon'] | 2024-09-23 | | | |
| | | Mirai | ['Katana'] | elf.mirai | [] | 2026-09-22 | | | |
| | | Hide and Seek | ['HNS'] | elf.hideandseek | [] | 2023-08-28 | | | |
| | | GobRAT | [] | elf.gobrat | [] | 2023-05-30 | | | |
| | | Bashlite | ['gayfgt', 'Gafgyt', 'qbot', 'torlus', 'lizkebab'] | elf.bashlite | [] | 2026-06-08 | | | |
| | | Azorult | ['PuffStealer', 'Rultazo'] | win.azorult | ['The Gorgon Group'] | 2026-06-02 | | | |
| | | Azov Wiper | [] | win.azov_wiper | [] | 2023-01-25 | | | |
| | | Babar | ['SNOWBALL'] | win.babar | ['SNOWGLOBE'] | 2020-06-08 | | | |
| | | Babuk | ['Babyk', 'Vasa Locker'] | win.babuk | [] | 2026-09-22 | | | |
| | | BabyLon RAT | [] | win.babylon_rat | [] | 2026-09-14 | | | |
| | | Bachosens | [] | win.bachosens | [] | 2023-03-16 | | | |
| | | BACKBEND | [] | win.backbend | ['APT 30'] | 2019-04-17 | | | |
| | | BackConfig | [] | win.backconfig | ['VICEROY TIGER'] | 2022-07-29 | | | |
| | | backspace | ['Lecna', 'ZRLnk'] | win.backspace | ['APT 30'] | 2022-08-25 | | | |
| | | BackSwap | [] | win.backswap | [] | 2022-04-25 | | | |
| | | BADAUDIO | [] | win.badaudio | ['APT24'] | 2026-03-02 | | | |
| | | BADCALL | [] | win.badcall | ['Lazarus Group'] | 2024-11-29 | | | |
| | | BadEncript | [] | win.badencript | [] | 2017-04-29 | | | |
| | | badflick | [] | win.badflick | ['Leviathan'] | 2019-03-25 | | | |
| | | BADHATCH | [] | win.badhatch | ['FIN8'] | 2023-08-31 | | | |
| | | BadNews | [] | win.badnews | ['QUILTED TIGER'] | 2024-09-23 | | | |
| | | Bagle | [] | win.bagle | [] | 2021-12-31 | | | |
| | | BalkanDoor | [] | win.balkan_door | [] | 2019-09-03 | | | |
| | | Bamital | [] | win.bamital | [] | 2019-10-21 | | | |
| | | Banatrix | [] | win.banatrix | [] | 2017-05-22 | | | |
| | | Bandit Stealer | [] | win.bandit | [] | 2024-05-14 | | | |
| | | Bandook | ['Bandok'] | win.bandook | ['Dark Caracal'] | 2025-12-08 | | | |
| | | bangat | [] | win.bangat | ['Comment Crew'] | 2018-09-11 | | | |
| | | Banjori | ['MultiBanker 2', 'BankPatch', 'BackPatcher'] | win.banjori | [] | 2018-07-31 | | | |
| | | Bankshot | ['COPPERHEDGE', 'FoggyBrass'] | win.bankshot | ['Lazarus Group'] | 2026-09-24 | | | |
| | | BanPolMex RAT | [] | win.banpolmex | ['Lazarus Group'] | 2023-08-31 | | | |