| | | SPHijacker | [] | win.sphijacker | [] | 2023-05-04 | | | |
| | | SPIDERPIG RAT | [] | win.spider_rat | ['BlackTech'] | 2022-09-30 | | | |
| | | splitloader | [] | win.splitloader | [] | 2024-09-23 | | | |
| | | SpyBot | [] | win.spybot | [] | 2016-04-26 | | | |
| | | Spyder Patchwork | [] | win.spyder_patchwork | ['QUILTED TIGER'] | 2024-08-29 | | | |
| | | SpyEye | [] | win.spyeye | [] | 2021-06-29 | | | |
| | | SquidLoader | [] | win.squidloader | [] | 2024-07-03 | | | |
| | | Squirrelwaffle | ['DatopLoader'] | win.squirrelwaffle | [] | 2022-07-19 | | | |
| | | SslMM | [] | win.sslmm | ['Naikon'] | | | | |
| | | SSLoad | [] | win.ssload | ['TA578'] | 2024-11-05 | | | |
| | | Stabuniq | [] | win.stabuniq | [] | | | | |
| | | StarCruft | [] | win.starcruft | ['APT37'] | 2018-04-26 | | | |
| | | StarsyPound | [] | win.starsypound | ['Comment Crew'] | 2018-02-10 | | | |
| | | StartPage | ['Easy Television Access Now'] | win.startpage | [] | 2019-02-27 | | | |
| | | StealBit | ['Corrempa'] | win.stealbit | [] | 2022-09-26 | | | |
| | | Stealer0x3401 | [] | win.stealer_0x3401 | ['APT31'] | 2022-08-15 | | | |
| | | STEALHOOK | [] | win.stealhook | ['OilRig'] | 2024-11-04 | | | |
| | | Stinger | [] | win.stinger | [] | 2018-03-19 | | | |
| | | Stormwind | [] | win.stormwind | ['Evilnum'] | 2022-12-14 | | | |
| | | Stration | [] | win.stration | [] | 2018-07-24 | | | |
| | | StrifeWater RAT | [] | win.strifewater_rat | ['MosesStaff'] | 2023-12-04 | | | |
| | | StrongPity | [] | win.strongpity | ['PROMETHIUM', 'StrongPity'] | 2023-06-09 | | | |
| | | Stuxnet | [] | win.stuxnet | [] | 2023-10-05 | | | |
| | | Subzero | ['Corelump', 'Jumplump'] | win.subzero | [] | 2024-02-08 | | | |
| | | SunCrypt | [] | win.suncrypt | [] | 2023-06-09 | | | |
| | | SunOrcal | [] | win.sunorcal | [] | 2017-11-21 | | | |
| | | VM Zeus | ['VMzeus', 'ZeusVM', 'Zberp'] | win.vmzeus | [] | 2018-05-22 | | | |
| | | Vobfus | ['Beebone'] | win.vobfus | [] | 2022-11-12 | | | |
| | | Vohuk | [] | win.vohuk | [] | 2022-12-19 | | | |
| | | Void | ['VoidCrypt'] | win.void | [] | 2021-10-11 | | | |
| | | Voidoor | [] | win.voidoor | [] | 2023-07-19 | | | |
| | | Volgmer | ['FALLCHILL', 'Manuscrypt'] | win.volgmer | ['Lazarus Group'] | 2023-11-27 | | | |
| | | VSingle | [] | win.vsingle | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | vSkimmer | [] | win.vskimmer | [] | 2018-04-26 | | | |
| | | Vyveva RAT | [] | win.vyveva | ['Lazarus Group'] | 2023-09-18 | | | |
| | | w32times | [] | win.w32times | ['UPS'] | 2018-04-13 | | | |
| | | WannaHusky | [] | win.wannahusky | [] | 2022-04-08 | | | |
| | | Warezov | ['Stration', 'Opnis'] | win.warezov | [] | 2024-04-29 | | | |
| | | WarHawk | [] | win.warhawk | [] | 2024-08-29 | | | |
| | | WastedLoader | [] | win.wastedloader | [] | 2022-07-01 | | | |
| | | WastedLocker | [] | win.wastedlocker | [] | 2022-08-02 | | | |
| | | WaterMiner | [] | win.waterminer | [] | 2018-08-01 | | | |
| | | WaterSpout | [] | win.waterspout | ['IXESHE'] | 2017-05-21 | | | |
| | | WebbyTea | [] | win.webbytea | ['Lazarus Group'] | 2023-12-19 | | | |
| | | WebC2-AdSpace | [] | win.webc2_adspace | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Ausov | [] | win.webc2_ausov | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Bolid | [] | win.webc2_bolid | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Cson | [] | win.webc2_cson | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-DIV | [] | win.webc2_div | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-GreenCat | [] | win.webc2_greencat | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Head | [] | win.webc2_head | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Kt3 | [] | win.webc2_kt3 | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Qbp | [] | win.webc2_qbp | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Rave | [] | win.webc2_rave | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Table | [] | win.webc2_table | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-UGX | [] | win.webc2_ugx | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Yahoo | [] | win.webc2_yahoo | ['Comment Crew'] | 2018-02-10 | | | |
| | | WhiskerSpy | [] | win.whiskerspy | [] | 2023-02-24 | | | |
| | | WhiteBird | [] | win.whitebird | [] | 2020-10-02 | | | |
| | | WhiteBlackCrypt | ['WARYLOOK'] | win.whiteblackcrypt | [] | 2022-03-07 | | | |
| | | WinDealer | [] | win.windealer | [] | 2023-12-27 | | | |
| | | WinInetLoader | ['LIDSHOT'] | win.wininetloader | ['Lazarus Group'] | 2023-12-19 | | | |
| | | WinMM | [] | win.winmm | ['Naikon'] | | | | |
| | | WinorDLL64 | [] | win.winordll64 | ['Lazarus Group'] | 2023-02-27 | | | |
| | | Winsloader | [] | win.winsloader | ['Pirate Panda'] | | | | |
| | | WMI Ghost | ['Wimmie', 'Syndicasec'] | win.wmighost | ['Thrip'] | 2018-06-22 | | | |
| | | WndTest | [] | win.wndtest | ['Cleaver'] | 2017-05-21 | | | |
| | | Wonknu | [] | win.wonknu | [] | 2022-07-29 | | | |
| | | woody | [] | win.woody | [] | 2018-04-26 | | | |
| | | Woody RAT | [] | win.woodyrat | [] | 2022-08-05 | | | |
| | | Woolger | ['WoolenLogger'] | win.woolger | ['Rocket Kitten'] | 2022-04-29 | | | |
| | | WORMHOLE | [] | win.wormhole | ['Lazarus Group'] | 2023-08-14 | | | |
| | | WpBruteBot | [] | win.wpbrutebot | [] | 2020-09-23 | | | |
| | | WSCSPL | [] | win.wscspl | ['Dropping Elephant'] | 2022-01-03 | | | |
| | | Wslink | ['FinickyFrogfish'] | win.wslink | [] | 2022-03-30 | | | |
| | | X-Agent | ['splm', 'chopstick'] | win.xagent | ['APT28'] | 2024-07-10 | | | |
| | | XBot POS | [] | win.xbot_pos | [] | 2017-09-14 | | | |
| | | XBTL | [] | win.xbtl | [] | 2016-05-10 | | | |
| | | X-Files Stealer | [] | win.xfilesstealer | [] | 2023-12-04 | | | |
| | | XFSADM | [] | win.xfsadm | [] | 2019-07-12 | | | |
| | | XFSCashNCR | [] | win.xfscashncr | [] | 2019-10-04 | | | |
| | | Xiangoop | [] | win.xiangoop | [] | 2024-10-23 | | | |
| | | Xorist | [] | win.xorist | [] | 2023-06-09 | | | |
| | | Xpan | [] | win.xpan | ['TeamXRat'] | 2017-02-15 | | | |
| | | XpertRAT | [] | win.xpertrat | [] | 2023-06-09 | | | |
| | | xsPlus | ['nokian'] | win.xsplus | ['Naikon'] | | | | |
| | | XTunnel | ['Shunnael', 'X-Tunnel', 'xaps'] | win.xtunnel | ['APT28'] | 2022-03-14 | | | |
| | | xxmm | ['ShadowWalker'] | win.xxmm | ['Tick'] | 2021-03-02 | | | |
| | | Yahoyah | ['KeyBoy'] | win.yahoyah | ['Pirate Panda'] | 2017-02-15 | | | |
| | | Yakuza | ['Teslarvng Ransomware'] | win.yakuza_ransomware | [] | 2020-03-27 | | | |
| | | Yanluowang | ['Dryxiphia'] | win.yanluowang | [] | 2023-06-09 | | | |
| | | YaRAT | [] | win.yarat | ['APT31'] | 2022-08-15 | | | |
| | | yayih | ['bbsinfo', 'aumlib'] | win.yayih | [] | 2018-09-19 | | | |
| | | Yoddos | [] | win.yoddos | [] | 2019-07-12 | | | |
| | | YoreKey | [] | win.yorekey | ['Kimsuky'] | 2021-12-15 | | | |
| | | YoungLotus | ['DarkShare'] | win.younglotus | [] | 2018-05-28 | | | |
| | | yty | [] | win.yty | ['APT-C-35', 'Donot Team', 'Viceroy Tiger'] | 2022-01-18 | | | |
| | | ZarDoor | [] | win.zardoor | [] | 2024-03-04 | | | |
| | | Zebrocy | ['Zekapab'] | win.zebrocy | ['APT28'] | 2024-07-10 | | | |
| | | Zedhou | [] | win.zedhou | [] | 2018-07-24 | | | |