| | | PolarEdge | [] | elf.polaredge | [] | 2025-11-05 | | | |
| | | MetaStealer | [] | win.metastealer | ['UNC5537'] | 2025-11-05 | | | |
| | | Broomstick | ['CLEANBOOST', 'CleanUp', 'CleanUpLoader', 'Oyster'] | win.broomstick | [] | 2025-11-03 | | | |
| | | XWorm | [] | win.xworm | ['Hive0137'] | 2025-11-03 | | | |
| | | LinkPro | [] | elf.linkpro | [] | 2025-11-03 | | | |
| | | Aisuru | [] | elf.aisuru | [] | 2025-11-03 | | | |
| | | JADESNOW | ['ChainedDown'] | js.jadesnow | [] | 2025-11-03 | | | |
| | | Latrodectus | ['BLACKWIDOW', 'IceNova', 'Latrodectus', 'Lotus'] | win.latrodectus | [] | 2025-10-28 | | | |
| | | Kamasers | [] | win.kamasers | [] | 2025-10-31 | | | |
| | | PostNapTea | ['SIGNBT'] | win.postnaptea | ['Lazarus Group'] | 2025-10-31 | | | |
| | | DRATzarus | ['ThreatNeedle', 'ThreatNeedleTea'] | win.dratzarus | ['Lazarus Group'] | 2025-10-31 | | | |
| | | Bankshot | ['COPPERHEDGE', 'FoggyBrass'] | win.bankshot | ['Lazarus Group'] | 2025-10-31 | | | |
| | | wAgentTea | ['wAgent'] | win.wagenttea | ['Lazarus Group'] | 2025-10-31 | | | |
| | | Aura Stealer | ['AURA Stealer', 'AURASTEAL'] | win.aurastealer | [] | 2025-09-16 | | | |
| | | Supper | ['SocksShell', 'ZAPCAT'] | win.supper | ['Vanilla Tempest'] | 2025-07-01 | | | |
| | | SparrowDoor | [] | win.sparrow_door | ['GhostEmperor'] | 2025-10-29 | | | |
| | | EntryShell | [] | win.entryshell | [] | 2025-10-29 | | | |
| | | DracuLoader | [] | win.dracu_loader | ['Earth Estries'] | 2025-10-29 | | | |
| | | ShadowPad | ['POISONPLUG.SHADOW', 'XShellGhost'] | win.shadowpad | ['APT23', 'APT41', 'APT17', 'DAGGER PANDA', 'Earth Lusca', 'Tonto Team', 'WET PANDA'] | 2025-10-29 | | | |
| | | Cobalt Strike | ['Agentemis', 'BEACON', 'CobaltStrike', 'cobeacon'] | win.cobalt_strike | ['APT 29', 'APT29', 'APT32', 'APT41', 'AQUATIC PANDA', 'Anunak', 'Cobalt', 'Codoso', 'CopyKittens', 'DarkHydrus', 'Earth Baxia', 'FIN6', 'FIN7', 'Leviathan', 'Mustang Panda', 'Shell Crew', 'Stone Panda', 'TianWu', 'UNC1878', 'UNC2452', 'Winnti Umbrella'] | 2025-10-29 | | | |
| | | SNAPPYBEE | ['Deed RAT', 'POISONPLUG.DEED'] | win.snappybee | ['Earth Estries'] | 2025-10-29 | | | |
| | | Vidar | [] | win.vidar | [] | 2025-10-23 | | | |
| | | BUSHWALK | [] | elf.bushwalk | [] | 2025-10-28 | | | |
| | | PITFUEL | [] | elf.pitfuel | [] | 2025-10-28 | | | |
| | | PITSOCK | [] | elf.pitsock | [] | 2025-10-28 | | | |
| | | PITHOOK | [] | elf.pithook | [] | 2025-10-28 | | | |
| | | PulsarTea | [] | win.pulsartea | ['Lazarus Group'] | 2025-10-28 | | | |
| | | Kubo Injector | [] | elf.kubo_injector | [] | 2025-10-28 | | | |
| | | NikiHTTP | [] | win.nikihttp | ['Kimsuky'] | 2025-10-28 | | | |
| | | PylangGhost | [] | py.pylangghost | ['WageMole'] | 2025-10-20 | | | |
| | | LockBit | [] | elf.lockbit | [] | 2025-10-22 | | | |
| | | Princess | [] | apk.princess | [] | 2025-10-24 | | | |
| | | ScoringMathTea | [] | win.scoring_math_tea | ['Lazarus Group'] | 2025-10-24 | | | |
| | | QuanPinLoader | [] | win.quan_pin_loader | ['Lazarus Group'] | 2025-10-24 | | | |
| | | AMOS | ['Atomic macOS Stealer'] | osx.amos | [] | 2025-10-24 | | | |
| | | BlindEDR | [] | win.blind_edr | [] | 2025-10-23 | | | |
| | | LockBit | ['ABCD Ransomware'] | win.lockbit | [] | 2025-10-22 | | | |
| | | ValleyRAT | ['Winos'] | win.valley_rat | [] | 2025-10-23 | | | |
| | | RedLine Stealer | ['RECORDSTEALER'] | win.redline_stealer | [] | 2025-10-23 | | | |
| | | Remcos | ['RemcosRAT', 'Remvio', 'Socmer'] | win.remcos | ['APT33', 'The Gorgon Group', 'UAC-0050'] | 2025-10-23 | | | |
| | | Formbook | ['win.xloader'] | win.formbook | ['SWEED', 'Cobalt'] | 2025-10-23 | | | |
| | | Agent Tesla | ['AgenTesla', 'AgentTesla', 'Negasteal'] | win.agent_tesla | ['SWEED'] | 2025-10-23 | | | |
| | | InvisibleFerret | [] | py.invisibleferret | ['WageMole'] | 2025-10-23 | | | |
| | | OtterCookie | [] | js.otter_cookie | ['WageMole'] | 2025-10-23 | | | |
| | | BeaverTail | [] | js.beavertail | ['WageMole'] | 2025-10-23 | | | |
| | | NOROBOT | ['BAITSWITCH'] | win.norobot | ['Callisto'] | 2025-10-22 | | | |
| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2025-10-22 | | | |
| | | YESROBOT | [] | win.yesrobot | ['Callisto'] | 2025-10-22 | | | |
| | | GlassWorm | [] | js.glassworm | [] | 2025-10-21 | | | |
| | | MAYBEROBOT | [''] | win.mayberobot | ['Callisto'] | 2025-10-22 | | | |
| | | BRICKSTORM | [] | elf.brickstorm | ['UTA0178'] | 2025-10-22 | | | |
| | | TOLLBOOTH | ['HijackServer IIS'] | win.tollbooth | [] | 2025-10-22 | | | |
| | | PureLogs Stealer | [] | win.purelogs | [] | 2025-10-20 | | | |
| | | vGet | [] | elf.vget | [] | 2025-10-20 | | | |
| | | OtterCandy | ['HardHatRAT', 'UNSEENMINK'] | js.ottercandy | [] | 2025-10-22 | | | |
| | | Bofamet | [] | win.bofamet | [] | 2025-10-21 | | | |
| | | ACR Stealer | [] | win.acr_stealer | [] | 2025-10-21 | | | |
| | | TONESHELL | [] | win.toneshell | ['MUSTANG PANDA'] | 2025-09-23 | | | |
| | | Tendyron | [] | win.tendyron_dropper | ['TA410'] | 2025-10-15 | | | |
| | | NightshadeC2 | ['CastleRAT'] | win.nightshade_c2 | [] | 2025-10-20 | | | |
| | | DanderSpritz | ['Dsz'] | win.danderspritz | [] | 2025-10-20 | | | |
| | | vxRat | [] | win.vx_rat | [] | 2025-10-20 | | | |
| | | JSOutProx | [] | win.jsoutprox | ['SOLAR SPIDER'] | 2024-04-08 | | | |
| | | GolangGhost | ['BitStep RAT', 'WeaselStore'] | win.golangghost | ['WageMole'] | 2025-10-20 | | | |
| | | Tropidoor | [] | win.tropidoor | ['WageMole'] | 2025-10-20 | | | |
| | | TsunamiKit | [] | win.tsunamikit | ['WageMole'] | 2025-10-20 | | | |
| | | AkdoorTea | [] | win.akdoortea | ['WageMole'] | 2025-10-20 | | | |
| | | ClipBanker | [] | win.clipbanker | [] | 2025-10-20 | | | |
| | | PureRAT | ['PureHVNC', 'ResolverRAT'] | win.pure_rat | [] | 2025-10-20 | | | |
| | | Lookback | [] | win.lookback | ['TA410'] | 2025-10-20 | | | |
| | | MimiKatz | [] | win.mimikatz | ['APT10', 'APT32', 'Anunak', 'GALLIUM'] | 2025-10-20 | | | |
| | | CHINACHOPPER | [] | win.chinachopper | ['APT41', 'EMISSARY PANDA', 'GALLIUM', 'HAFNIUM', 'Hurricane Panda', 'Leviathan'] | 2025-10-20 | | | |
| | | Brute Ratel C4 | ['BOLDBADGER', 'BruteRatel'] | win.brute_ratel_c4 | [] | 2025-10-15 | | | |
| | | Amatera | [] | win.amatera | [] | 2025-10-15 | | | |
| | | HOMESTEEL | [] | vbs.homesteel | [] | 2025-10-15 | | | |
| | | WRECKSTEEL | [] | ps1.wrecksteel | [] | 2025-10-15 | | | |
| | | GIFTEDCROOK | [] | win.giftedcrook | ['UAC-0226'] | 2025-10-15 | | | |
| | | StrelaStealer | [] | win.strelastealer | [] | 2025-10-15 | | | |
| | | Lumma Stealer | ['LummaC2 Stealer'] | win.lumma | ['Angry Likho'] | 2025-10-15 | | | |
| | | BellaCiao | [] | win.bellaciao | [] | 2025-10-15 | | | |
| | | Pantegana | [] | win.pantegana | [] | 2025-10-15 | | | |
| | | Vampire Bot | [] | win.vampire_bot | [] | 2025-10-15 | | | |
| | | SparkRAT | [] | win.spark_rat | [] | 2025-10-15 | | | |
| | | Leslieloader | [] | win.leslieloader | [] | 2025-10-15 | | | |
| | | NET-STAR | [] | win.net_star | [] | 2025-10-15 | | | |
| | | Rhadamanthys | [] | win.rhadamanthys | ['Sandworm'] | 2025-10-15 | | | |
| | | Loki Password Stealer (PWS) | ['Burkina', 'Loki', 'LokiBot', 'LokiPWS'] | win.lokipws | ['SWEED', 'The Gorgon Group', 'Cobalt'] | 2025-10-15 | | | |
| | | MonsterV2 | ['Aurotun Stealer'] | win.monsterv2 | [] | 2025-10-15 | | | |
| | | PXA Stealer | ['PXAStealer', 'PXA'] | py.pxa_stealer | [] | 2025-10-15 | | | |
| | | Quasar RAT | ['CinaRAT', 'QuasarRAT', 'Yggdrasil'] | win.quasar_rat | ['APT33', 'Dropping Elephant', 'Stone Panda', 'The Gorgon Group'] | 2025-10-15 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2025-10-15 | | | |
| | | FlowCloud | [] | win.flowcloud | ['Stone Panda'] | 2025-10-15 | | | |
| | | x4 | [] | win.x4 | [] | 2025-10-15 | | | |
| | | Unidentified 096 (Keylogger) | [] | win.unidentified_096 | ['TA410'] | 2025-10-15 | | | |
| | | SoulSearcher | [] | win.soulsearcher | ['SharpPanda'] | 2025-10-15 | | | |
| | | Soul | ['SoulSearcher'] | win.soul | [] | 2025-10-15 | | | |
| | | AdaptixC2 | [] | win.adaptix_c2 | [] | 2025-10-15 | | | |
| | | RunForestRun | ['Blackhole', 'Sutra'] | js.runforestrun | [] | 2025-10-15 | | | |
| | | BumbleBee | ['COLDTRAIN', 'SHELLSTING', 'Shindig'] | win.bumblebee | ['EXOTIC LILY', 'GOLD CABIN', 'TA578', 'TA579'] | 2025-10-15 | | | |
| | | WarmCookie | ['Badspace', 'Carrotstick', 'QUICKBIND'] | win.warmcookie | [] | 2025-10-02 | | | |