| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2026-05-27 | | | |
| | | ValleyRAT | ['Winos'] | win.valley_rat | [] | 2026-05-27 | | | |
| | | Mirax | ['Astrinox', 'Mirax Bot', 'MiraxRAT'] | apk.mirax | [] | 2026-05-27 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2026-05-27 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2026-05-27 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2026-05-19 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2026-05-13 | | | |
| | | RemoteX | [] | win.remotex | [] | 2026-05-22 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | ['CoralRaider'] | 2026-05-21 | | | |
| | | LockBit | [] | elf.lockbit | [] | 2026-05-21 | | | |
| | | LockBit | ['ABCD Ransomware'] | win.lockbit | [] | 2026-05-21 | | | |
| | | PhantomCore | [] | win.phantomcore | [] | 2026-05-21 | | | |
| | | LOTUSLITE | [] | win.lotuslite | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | Payload | [] | win.payload | [] | 2026-05-21 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT17', 'APT23', 'APT41', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA', 'Webworm'] | 2026-05-21 | | | |
| | | Gentlemen | [] | win.gentlemen | ['The Gentlemen'] | 2026-05-21 | | | |
| | | TONESHELL | [] | win.toneshell | ['MUSTANG PANDA'] | 2026-05-21 | | | |
| | | GHOSTBLADE | [] | js.ghostblade | ['UNC6353'] | 2026-05-21 | | | |
| | | FINALDRAFT | [] | win.finaldraft | [] | 2026-05-21 | | | |
| | | VShell | [] | win.vshell | [] | 2026-05-21 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2026-05-21 | | | |
| | | Vidar | [] | win.vidar | [] | 2026-05-19 | | | |
| | | Slopoly | [] | ps1.slopoly | ['Hive0163'] | 2026-05-20 | | | |
| | | Lorem Ipsum | [] | win.lorem_ipsum | [] | 2026-05-20 | | | |
| | | TCLBANKER | [] | win.tclbanker | [] | 2026-05-20 | | | |
| | | DragonBreath | [] | win.dragonbreath | [] | 2026-05-20 | | | |
| | | PicassoLoader | [] | win.picasso_loader | ['Ghostwriter'] | 2026-05-19 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2026-05-19 | | | |
| | | Payload | [] | elf.payload | [] | 2026-05-19 | | | |
| | | Lalia Ransomware | [] | win.lalia_ransomware | [] | 2026-05-19 | | | |
| | | HijackLoader | ['DOILoader', 'GHOSTPULSE', 'IDAT Loader', 'SHADOWLADDER'] | win.hijackloader | [] | 2026-05-19 | | | |
| | | Black Basta | ['no_name_software'] | win.blackbasta | ['GOLD REBELLION', 'STAC5143', 'Storm-0506', 'Storm-0826', 'TA2101', 'UNC3973', 'UNC4393'] | 2026-05-19 | | | |
| | | BanPolMex RAT | [] | win.banpolmex | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Bart | [] | win.bart | [] | 2022-02-14 | | | |
| | | BatchWiper | [] | win.batchwiper | [] | 2021-10-05 | | | |
| | | Batel | [] | win.batel | [] | 2020-04-21 | | | |
| | | BazarBackdoor | ['BEERBOT', 'KEGTAP', 'Team9Backdoor', 'bazaloader', 'bazarloader'] | win.bazarbackdoor | ['UNC1878'] | 2023-10-16 | | | |
| | | BBSRAT | [] | win.bbsrat | [] | 2023-06-23 | | | |
| | | BEARDSHELL | [] | win.beardshell | ['APT28'] | 2026-03-11 | | | |
| | | win.beast | ['blacklockbit'] | win.beast | [] | 2025-04-28 | | | |
| | | BEATDROP | [] | win.beatdrop | ['APT29'] | 2024-02-02 | | | |
| | | Bedep | [] | win.bedep | [] | 2026-05-05 | | | |
| | | Bee | [] | win.bee | [] | 2021-01-29 | | | |
| | | BeepService | [] | win.beepservice | [] | 2020-05-27 | | | |
| | | BernhardPOS | [] | win.bernhardpos | [] | 2022-09-19 | | | |
| | | Bert | [] | win.bert | [] | 2025-09-23 | | | |
| | | BetaBot | ['Neurevt'] | win.betabot | [] | 2026-04-22 | | | |
| | | BHunt | [] | win.bhunt | [] | 2022-02-26 | | | |
| | | BH_A006 | [] | win.bh_a006 | [] | 2024-11-25 | | | |
| | | BiBi | ['BiBi-Windows'] | win.bibi | ['Void Manticore'] | 2024-12-16 | | | |
| | | BI_D Ransomware | [] | win.bid_ransomware | [] | 2019-08-12 | | | |
| | | BillGates | [] | win.billgates | [] | 2023-08-31 | | | |
| | | Biscuit | ['zxdosml'] | win.biscuit | ['Comment Crew'] | 2018-02-10 | | | |
| | | BISTROMATH | [] | win.bistromath | ['Lazarus Group', 'Silent Chollima'] | 2023-09-22 | | | |
| | | BITSloth | [] | win.bitsloth | [] | 2024-08-29 | | | |
| | | Bitsran | ['SHADYCAT'] | win.bitsran | ['Lazarus Group'] | 2019-08-26 | | | |
| | | Bitter RAT | [] | win.bitter_rat | [] | 2025-11-26 | | | |
| | | BitRAT | [] | win.bit_rat | [] | 2025-08-29 | | | |
| | | BKA Trojaner | ['bwin3_bka'] | win.bka_trojaner | [] | 2018-05-28 | | | |
| | | BlackByte | [] | win.blackbyte | [] | 2026-03-02 | | | |
| | | BlackCat | ['ALPHV', 'Noberus'] | win.blackcat | ['Alpha Spider', 'RansomHub', 'Vanilla Tempest'] | 2026-01-12 | | | |
| | | BLACKCOFFEE | ['PNGRAT', 'gresim', 'ZoxPNG'] | win.blackcoffee | ['APT41', 'Aurora Panda', 'Leviathan'] | 2025-04-17 | | | |
| | | BlackEnergy | [] | win.blackenergy | ['Sandworm'] | 2024-04-23 | | | |
| | | BlackLotus | [] | win.blacklotus | [] | 2023-12-27 | | | |
| | | BlackMagic | [] | win.blackmagic | [] | 2022-12-08 | | | |
| | | BlackMatter | [] | win.blackmatter | [] | 2025-03-21 | | | |
| | | BlackPOS | ['Kaptoxa', 'MMon', 'POSWDS', 'Reedum'] | win.blackpos | [] | 2020-10-05 | | | |
| | | BlackShades | [] | win.blackshades | [] | 2020-05-23 | | | |
| | | BlackSoul | [] | win.blacksoul | [] | 2021-01-10 | | | |
| | | BlackSuit | [] | win.blacksuit | [] | 2025-07-28 | | | |
| | | BleachGap | [] | win.bleachgap | [] | 2022-08-28 | | | |
| | | BLINDINGCAN | ['AIRDRY', 'ZetaNile'] | win.blindingcan | ['Lazarus Group'] | 2025-09-15 | | | |
| | | BlindEDR | [] | win.blind_edr | [] | 2025-10-23 | | | |
| | | Blister | ['COLORFAKE'] | win.blister | [] | 2023-11-14 | | | |
| | | BLUEHAZE | [] | win.bluehaze | [] | 2022-12-02 | | | |
| | | BLUELIGHT | [] | win.bluelight | ['APT37'] | 2023-05-24 | | | |
| | | BlueNoroff | [] | win.bluenoroff | ['Lazarus Group'] | 2023-08-14 | | | |
| | | BOATLAUNCH | [] | win.boatlaunch | ['FIN7'] | 2022-04-07 | | | |
| | | Boaxxe | [] | win.boaxxe | [] | 2018-03-26 | | | |
| | | Bohmini | [] | win.bohmini | [] | 2018-07-24 | | | |
| | | BOLDMOVE | [] | win.boldmove | [] | 2023-01-20 | | | |
| | | Bolek | ['KBOT'] | win.bolek | [] | 2020-04-06 | | | |
| | | BookCodes RAT | ['BookCodesTea'] | win.bookcodesrat | ['Lazarus Group'] | 2023-07-24 | | | |
| | | BOOTWRECK | ['MBRkiller'] | win.bootwreck | ['Lazarus Group'] | 2019-10-12 | | | |
| | | BottomLoader | [] | win.bottomloader | [] | 2023-12-15 | | | |
| | | Bouncer | [] | win.bouncer | ['Comment Crew'] | 2018-02-10 | | | |
| | | BoxCaon | [] | win.boxcaon | [] | 2022-10-25 | | | |
| | | BQTlock | [] | win.bqtlock | [] | 2025-09-30 | | | |
| | | Brambul | ['SORRYBRUTE'] | win.brambul | ['Lazarus Group'] | 2022-03-02 | | | |
| | | BravoNC | [] | win.bravonc | ['Lazarus Group'] | 2017-05-23 | | | |
| | | BrbBot | [] | win.brbbot | [] | 2022-02-09 | | | |
| | | BreachRAT | [] | win.breach_rat | ['Operation C-Major'] | 2019-04-08 | | | |
| | | Breakthrough | [] | win.breakthrough_loader | [] | 2018-09-21 | | | |
| | | Bredolab | [] | win.bredolab | [] | 2022-01-28 | | | |
| | | BROLER | ['down_new'] | win.broler | ['Tick'] | 2020-06-02 | | | |
| | | Broomstick | ['CLEANBOOST', 'CleanUp', 'CleanUpLoader', 'Oyster'] | win.broomstick | [] | 2026-02-25 | | | |
| | | Bruh Wiper | [] | win.bruh_wiper | [] | 2023-01-25 | | | |
| | | Brute Ratel C4 | ['BOLDBADGER', 'BruteRatel'] | win.brute_ratel_c4 | [] | 2026-03-10 | | | |
| | | BrutPOS | [] | win.brutpos | [] | 2018-04-23 | | | |
| | | BS2005 | [] | win.bs2005 | ['Mirage'] | 2021-04-29 | | | |