| | | Dtrack | ['Preft', 'TroyRAT'] | win.dtrack | ['Lazarus Group', 'Silent Chollima'] | 2024-11-29 | | | |
| | | DUBrute | [] | win.dubrute | [] | 2018-09-13 | | | |
| | | DuQu | [] | win.duqu | ['Unit 8200'] | 2025-02-28 | | | |
| | | DUSTMAN | [] | win.dustman | [] | 2023-01-19 | | | |
| | | DUSTPAN | ['StealthVector'] | win.dustpan | [] | 2024-10-21 | | | |
| | | DUSTTRAP | ['CurveLoad', 'DodgeBox', 'StealthReacher'] | win.dusttrap | ['APT41'] | 2024-11-04 | | | |
| | | Duuzer | ['Escad'] | win.duuzer | ['Lazarus Group'] | 2020-12-08 | | | |
| | | DYEPACK | ['BanSwift', 'swift'] | win.dyepack | ['Lazarus Group'] | 2023-08-21 | | | |
| | | Dyre | ['Dyreza'] | win.dyre | ['WIZARD SPIDER'] | 2024-05-15 | | | |
| | | EagerBee | ['Thumtais'] | win.eagerbee | [] | 2025-06-16 | | | |
| | | EchoGather | [] | win.echo_gather | [] | 2026-01-05 | | | |
| | | Edam | ['SECONDBEST'] | win.edam | [] | 2024-12-09 | | | |
| | | EDDIESTEALER | [] | win.eddiestealer | [] | 2025-06-02 | | | |
| | | EDRSilencer | [] | win.edr_silencer | [] | 2024-11-07 | | | |
| | | EHDevel | [] | win.ehdevel | [] | 2024-08-19 | | | |
| | | ELECTRICFISH | [] | win.electricfish | ['Lazarus Group'] | 2023-02-21 | | | |
| | | ElectricPowder | [] | win.electric_powder | [] | 2019-02-14 | | | |
| | | Elirks | [] | win.elirks | [] | 2023-08-29 | | | |
| | | Elise | ['EVILNEST'] | win.elise | ['Lotus Blossom'] | 2021-05-25 | | | |
| | | Emdivi | [] | win.emdivi | ['Stone Panda'] | 2021-03-02 | | | |
| | | Remexi | ['CACHEMONEY'] | win.remexi | ['APT39', 'Chafer'] | 2023-05-25 | | | |
| | | Remsec | [] | win.remsec_strider | ['ProjectSauron'] | 2020-04-21 | | | |
| | | Remy | ['WINDSHIELD'] | win.remy | [] | 2020-05-23 | | | |
| | | Rerdom | [] | win.rerdom | [] | 2018-08-10 | | | |
| | | Resident | [] | win.resident | ['TA866'] | 2024-11-11 | | | |
| | | Retefe | ['Tsukuba', 'Werdlod'] | win.retefe | [] | 2019-05-23 | | | |
| | | Retro | [] | win.retro | ['DarkHotel'] | 2021-12-17 | | | |
| | | RevC2 | [] | win.revc2 | [] | 2025-07-07 | | | |
| | | Revenant | [] | win.revenant | [] | 2023-04-03 | | | |
| | | REvil | ['Sodinokibi', 'Sodin'] | win.revil | ['Pinchy Spider'] | 2024-06-12 | | | |
| | | RGDoor | [] | win.rgdoor | [] | 2021-08-09 | | | |
| | | Rhino | [] | win.rhino | [] | 2020-05-18 | | | |
| | | RHttpCtrl | [] | win.rhttpctrl | ['APT 30'] | 2020-06-20 | | | |
| | | Rhysida | [] | win.rhysida | ['Vanilla Tempest'] | 2025-09-09 | | | |
| | | Rifdoor | [] | win.rifdoor | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | Rikamanu | [] | win.rikamanu | ['Thrip'] | 2018-06-25 | | | |
| | | Rincux | [] | win.rincux | [] | 2018-10-26 | | | |
| | | Ripper ATM | [] | win.ripper_atm | [] | 2020-02-27 | | | |
| | | RisePro | [] | win.risepro | [] | 2024-12-11 | | | |
| | | Rising Sun | [] | win.rising_sun | ['Operation Sharpshooter'] | 2022-05-05 | | | |
| | | RM3 | [] | win.rm3 | [] | 2022-12-29 | | | |
| | | ROADSWEEP | [] | win.roadsweep | [] | 2024-10-18 | | | |
| | | Rockloader | [] | win.rockloader | [] | 2022-02-14 | | | |
| | | Rofin | [] | win.rofin | [] | 2016-04-20 | | | |
| | | Rokku | [] | win.rokku | [] | 2020-12-20 | | | |
| | | RokRAT | ['DOGCALL'] | win.rokrat | ['APT37'] | 2025-12-23 | | | |
| | | RollSling | [] | win.roll_sling | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Rombertik | ['CarbonGrabber'] | win.rombertik | [] | 2017-05-21 | | | |
| | | ROMCOM RAT | ['PEAPOD', 'SingleCamper', 'SnipBot'] | win.romcom_rat | [] | 2025-12-12 | | | |
| | | Romeo(Alfa,Bravo, ...) | [] | win.romeos | ['Lazarus Group'] | 2017-05-17 | | | |
| | | Rook | [] | win.rook | [] | 2023-05-25 | | | |
| | | Roopirs | [] | win.roopirs | [] | 2018-07-24 | | | |
| | | Roopy | [] | win.roopy | [] | 2023-04-26 | | | |
| | | Roseam | ['PisLoader'] | win.roseam | ['Wekby'] | 2024-11-29 | | | |
| | | Rover | [] | win.rover | [] | 2020-11-04 | | | |
| | | Rovnix | ['Mayachok', 'Cidox', 'BkLoader'] | win.rovnix | [] | 2022-05-25 | | | |
| | | RoyalCli | [] | win.royalcli | ['Mirage'] | 2021-04-29 | | | |
| | | Royal DNS | [] | win.royal_dns | ['Mirage'] | 2021-04-29 | | | |
| | | RTM Locker | ['Read The Manual Locker'] | win.rtm_locker | [] | 2023-11-13 | | | |
| | | rtpos | [] | win.rtpos | [] | 2022-02-01 | | | |
| | | Ruckguv | [] | win.ruckguv | [] | 2018-03-01 | | | |
| | | Rugmi | ['Penguish'] | win.rugmi | [] | 2025-04-09 | | | |
| | | Rumish | [] | win.rumish | [] | 2018-07-24 | | | |
| | | Running RAT | ['running_rat'] | win.runningrat | [] | 2024-11-15 | | | |
| | | Rustock | [] | win.rustock | [] | 2022-02-14 | | | |
| | | Rustonotto | ['CHILLYCHINO'] | win.rustonotto | ['APT37'] | 2025-09-09 | | | |
| | | RustyClaw | [] | win.rusty_claw | ['RomCom'] | 2025-11-25 | | | |
| | | Ryuk | [] | win.ryuk | ['FIN6', 'GRIM SPIDER', 'UNC1878', 'WIZARD SPIDER'] | 2024-06-12 | | | |
| | | Ryuk Stealer | ['Sidoh'] | win.ryuk_stealer | [] | 2021-09-02 | | | |
| | | SADBRIDGE | [] | win.sadbridge | [] | 2025-01-02 | | | |
| | | SafeNet | [] | win.safenet | [] | 2020-01-22 | | | |
| | | Sagerunex | [] | win.sagerunex | ['LOTUS PANDA'] | 2026-01-05 | | | |
| | | SAGE | ['Saga'] | win.sage_ransom | [] | 2019-07-20 | | | |
| | | SaiGon | [] | win.saigon | [] | 2020-09-01 | | | |
| | | Saint Bot | [] | win.saint_bot | [] | 2022-07-25 | | | |
| | | Sakula RAT | ['Sakurel'] | win.sakula_rat | ['APT 26', 'Hurricane Panda'] | 2024-05-21 | | | |
| | | Salgorea | ['BadCake'] | win.salgorea | ['APT32'] | 2020-05-06 | | | |
| | | Sality | [] | win.sality | ['Salty Spider'] | 2023-11-14 | | | |
| | | Sanny | [] | win.sanny | [] | 2020-06-08 | | | |
| | | SantaStealer | [] | win.santa_stealer | [] | 2026-01-05 | | | |
| | | SappyCache | [] | win.sappycache | [] | 2020-07-15 | | | |
| | | Sarhust | ['ENDCMD', 'Hussarini'] | win.sarhust | [] | 2020-06-30 | | | |
| | | Sasfis | ['Oficla'] | win.sasfis | [] | 2018-11-28 | | | |
| | | Satan | ['5ss5c', 'DBGer', 'Lucky Ransomware'] | win.satan | [] | 2020-01-16 | | | |
| | | Satana | [] | win.satana | [] | 2023-06-09 | | | |
| | | Satellite Turla | [] | win.satellite_turla | ['Turla'] | 2022-11-17 | | | |
| | | Sathurbot | [] | win.sathurbot | [] | 2020-02-03 | | | |
| | | ScanLine | [] | win.scanline | ['Volt Typhoon'] | 2024-02-08 | | | |
| | | ScanPOS | [] | win.scanpos | [] | 2022-09-19 | | | |
| | | Scarabey | ['MVP', 'Scarab-Russian', 'Scarab'] | win.scarabey | [] | 2019-08-19 | | | |
| | | ScareCrow | [] | win.scarecrow | [] | 2022-12-19 | | | |
| | | Scavenger | ['scavenger', 'SCVNGR', 'scvngr'] | win.scavenger | [] | 2025-07-29 | | | |
| | | Scieron | [] | win.scieron | [] | 2022-09-20 | | | |
| | | ScoringMathTea | [] | win.scoring_math_tea | ['Lazarus Group'] | 2025-11-21 | | | |
| | | Scout | [] | win.scout | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Scranos | [] | win.scranos | [] | 2025-07-21 | | | |
| | | ScreenCap | [] | win.screencap | [] | 2022-10-24 | | | |
| | | SDBbot | [] | win.sdbbot | ['TA505'] | 2023-02-17 | | | |
| | | SeaSalt | [] | win.seasalt | ['Comment Crew'] | 2018-02-13 | | | |
| | | SecondHandTea | [] | win.secondhandtea | ['Lazarus Group'] | 2025-09-15 | | | |