| | | Carberp | [] | win.carberp | [] | 2023-07-24 | | | |
| | | CargoBay | [] | win.cargobay | [] | 2023-02-27 | | | |
| | | CARROTBALL | [] | win.carrotball | [] | 2020-02-04 | | | |
| | | CarrotBat | [] | win.carrotbat | [] | 2020-01-26 | | | |
| | | Casper | [] | win.casper | ['SNOWGLOBE'] | 2018-01-17 | | | |
| | | CatB | [] | win.catb | [] | 2024-09-04 | | | |
| | | Catchamas | [] | win.catchamas | ['Thrip'] | 2018-06-25 | | | |
| | | Chainshot | [] | win.chainshot | [] | 2021-07-20 | | | |
| | | CHAIRSMACK | [] | win.chairsmack | ['Charming Kitten'] | 2023-11-17 | | | |
| | | Chaperone | ['Taj Mahal'] | win.chaperone | [] | 2020-08-13 | | | |
| | | ChChes | ['HAYMAKER', 'Ham Backdoor'] | win.chches | ['Stone Panda'] | 2020-05-23 | | | |
| | | CHEESETRAY | ['CROWDEDFLOUNDER'] | win.cheesetray | ['Lazarus Group'] | 2020-02-27 | | | |
| | | CherryPicker POS | ['cherrypickerpos', 'cherrypicker', 'cherry_picker'] | win.cherry_picker | [] | 2022-12-01 | | | |
| | | ChewBacca | [] | win.chewbacca | [] | 2018-04-26 | | | |
| | | Chinad | [] | win.chinad | [] | 2023-06-01 | | | |
| | | Chinotto | [] | win.chinotto | ['APT37'] | 2023-11-22 | | | |
| | | Chinoxy | [] | win.chinoxy | [] | 2022-08-28 | | | |
| | | Chir | [] | win.chir | [] | 2017-01-17 | | | |
| | | ChiserClient | [] | win.chiser_client | ['Pirate Panda'] | 2022-03-30 | | | |
| | | ChrGetPdsi Stealer | [] | win.chrgetpdsi_stealer | [] | 2024-06-24 | | | |
| | | Chthonic | ['AndroKINS'] | win.chthonic | [] | 2021-09-19 | | | |
| | | Cinobi | [] | win.cinobi | [] | 2021-08-09 | | | |
| | | Citadel | [] | win.citadel | [] | 2021-06-29 | | | |
| | | Clambling | [] | win.clambling | [] | 2021-01-11 | | | |
| | | CLASSFON | [] | win.classfon | [] | 2019-08-09 | | | |
| | | Client Maximus | [] | win.client_maximus | [] | 2017-06-03 | | | |
| | | Clipog | [] | win.clipog | [] | 2023-10-20 | | | |
| | | Clop | [] | win.clop | ['TA505'] | 2024-05-10 | | | |
| | | CLOUDBURST | ['NickelLoader'] | win.cloudburst | ['Lazarus Group'] | 2023-12-27 | | | |
| | | CloudWizard | [] | win.cloudwizard | [] | 2023-06-01 | | | |
| | | CloudDuke | ['MiniDionis', 'CloudLook'] | win.cloud_duke | ['APT29'] | 2022-11-15 | | | |
| | | CMSBrute | [] | win.cmsbrute | [] | 2017-09-07 | | | |
| | | CMSTAR | ['meciv'] | win.cmstar | [] | 2022-07-25 | | | |
| | | CobInt | ['COOLPANTS'] | win.cobint | ['Cobalt'] | 2020-07-24 | | | |
| | | Cobra Carbon System | ['Carbon'] | win.cobra | ['Turla'] | 2023-05-10 | | | |
| | | RawPOS | [] | win.rawpos | [] | 2020-04-17 | | | |
| | | RC2FM | [] | win.rc2fm | [] | 2022-08-25 | | | |
| | | RCtrl | [] | win.rctrl | ['APT 30'] | 2020-06-20 | | | |
| | | ReactorBot | [] | win.reactorbot | [] | 2017-06-07 | | | |
| | | Reaver | [] | win.reaver | [] | 2019-05-17 | | | |
| | | RedAlpha | [] | win.redalpha | [] | 2018-07-06 | | | |
| | | RedCurl | [] | win.redcurl | [] | 2024-02-16 | | | |
| | | RedLeaves | ['BUGJUICE'] | win.redleaves | ['Stone Panda'] | 2022-06-22 | | | |
| | | REDPEPPER | ['Adupib'] | win.redpepper | ['PLATINUM'] | 2020-01-01 | | | |
| | | REDSALT | ['Dipsind'] | win.redsalt | ['PLATINUM'] | 2020-01-20 | | | |
| | | REDSHAWL | [] | win.redshawl | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Redyms | [] | win.redyms | [] | 2018-10-18 | | | |
| | | Red Gambler | [] | win.red_gambler | [] | 2018-07-11 | | | |
| | | Regin | [] | win.regin | [] | 2022-03-22 | | | |
| | | RegretLocker | [] | win.regretlocker | [] | 2023-05-25 | | | |
| | | win.rekoobe | ['tinyshell.win', 'tshd.win'] | win.rekoobew | ['FIN7'] | 2021-12-08 | | | |
| | | Rekt Loader | [] | win.rektloader | [] | 2020-07-15 | | | |
| | | RemCom | ['RemoteCommandExecution'] | win.remcom | [] | 2024-04-11 | | | |
| | | Remexi | ['CACHEMONEY'] | win.remexi | ['APT39', 'Chafer'] | 2023-05-25 | | | |
| | | Remsec | [] | win.remsec_strider | ['ProjectSauron'] | 2020-04-21 | | | |
| | | Remy | ['WINDSHIELD'] | win.remy | [] | 2020-05-23 | | | |
| | | Rerdom | [] | win.rerdom | [] | 2018-08-10 | | | |
| | | Retefe | ['Tsukuba', 'Werdlod'] | win.retefe | [] | 2019-05-23 | | | |
| | | Retro | [] | win.retro | ['DarkHotel'] | 2021-12-17 | | | |
| | | Revenant | [] | win.revenant | [] | 2023-04-03 | | | |
| | | REvil | ['Sodinokibi', 'Sodin'] | win.revil | ['Pinchy Spider'] | 2024-06-12 | | | |
| | | RGDoor | [] | win.rgdoor | [] | 2021-08-09 | | | |
| | | Rhino | [] | win.rhino | [] | 2020-05-18 | | | |
| | | RHttpCtrl | [] | win.rhttpctrl | ['APT 30'] | 2020-06-20 | | | |
| | | Rifdoor | [] | win.rifdoor | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | Rikamanu | [] | win.rikamanu | ['Thrip'] | 2018-06-25 | | | |
| | | Rincux | [] | win.rincux | [] | 2018-10-26 | | | |
| | | Ripper ATM | [] | win.ripper_atm | [] | 2020-02-27 | | | |
| | | Rising Sun | [] | win.rising_sun | ['Operation Sharpshooter'] | 2022-05-05 | | | |
| | | RM3 | [] | win.rm3 | [] | 2022-12-29 | | | |
| | | ROADSWEEP | [] | win.roadsweep | [] | 2024-10-18 | | | |
| | | Rockloader | [] | win.rockloader | [] | 2022-02-14 | | | |
| | | Rofin | [] | win.rofin | [] | 2016-04-20 | | | |
| | | Rokku | [] | win.rokku | [] | 2020-12-20 | | | |
| | | RollSling | [] | win.roll_sling | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Rombertik | ['CarbonGrabber'] | win.rombertik | [] | 2017-05-21 | | | |
| | | ROMCOM RAT | ['PEAPOD', 'SingleCamper', 'SnipBot'] | win.romcom_rat | [] | 2024-10-29 | | | |
| | | Romeo(Alfa,Bravo, ...) | [] | win.romeos | ['Lazarus Group'] | 2017-05-17 | | | |
| | | Rook | [] | win.rook | [] | 2023-05-25 | | | |
| | | Roopirs | [] | win.roopirs | [] | 2018-07-24 | | | |
| | | Roopy | [] | win.roopy | [] | 2023-04-26 | | | |
| | | Rorschach Ransomware | ['BabLock'] | win.rorschach | [] | 2023-04-25 | | | |
| | | Rover | [] | win.rover | [] | 2020-11-04 | | | |
| | | Rovnix | ['Mayachok', 'Cidox', 'BkLoader'] | win.rovnix | [] | 2022-05-25 | | | |
| | | RoyalCli | [] | win.royalcli | ['Mirage'] | 2021-04-29 | | | |
| | | Royal DNS | [] | win.royal_dns | ['Mirage'] | 2021-04-29 | | | |
| | | RTM Locker | ['Read The Manual Locker'] | win.rtm_locker | [] | 2023-11-13 | | | |
| | | rtpos | [] | win.rtpos | [] | 2022-02-01 | | | |
| | | Ruckguv | [] | win.ruckguv | [] | 2018-03-01 | | | |
| | | Rumish | [] | win.rumish | [] | 2018-07-24 | | | |
| | | Rustock | [] | win.rustock | [] | 2022-02-14 | | | |
| | | Ryuk | [] | win.ryuk | ['FIN6', 'GRIM SPIDER', 'UNC1878', 'WIZARD SPIDER'] | 2024-06-12 | | | |
| | | Ryuk Stealer | ['Sidoh'] | win.ryuk_stealer | [] | 2021-09-02 | | | |
| | | SafeNet | [] | win.safenet | [] | 2020-01-22 | | | |
| | | SAGE | ['Saga'] | win.sage_ransom | [] | 2019-07-20 | | | |
| | | SaiGon | [] | win.saigon | [] | 2020-09-01 | | | |
| | | Saint Bot | [] | win.saint_bot | [] | 2022-07-25 | | | |
| | | Sakula RAT | ['Sakurel'] | win.sakula_rat | ['APT 26', 'Hurricane Panda'] | 2024-05-21 | | | |
| | | Salgorea | ['BadCake'] | win.salgorea | ['APT32'] | 2020-05-06 | | | |
| | | Sality | [] | win.sality | ['Salty Spider'] | 2023-11-14 | | | |