| | | xsPlus | ['nokian'] | win.xsplus | ['Naikon'] | | | | |
| | | XTunnel | ['Shunnael', 'X-Tunnel', 'xaps'] | win.xtunnel | ['APT28'] | 2022-03-14 | | | |
| | | xxmm | ['ShadowWalker'] | win.xxmm | ['Tick'] | 2021-03-02 | | | |
| | | Yahoyah | ['KeyBoy'] | win.yahoyah | ['Pirate Panda'] | 2017-02-15 | | | |
| | | Yakuza | ['Teslarvng Ransomware'] | win.yakuza_ransomware | [] | 2020-03-27 | | | |
| | | Yanluowang | ['Dryxiphia'] | win.yanluowang | [] | 2023-06-09 | | | |
| | | YaRAT | [] | win.yarat | ['APT31'] | 2022-08-15 | | | |
| | | yayih | ['bbsinfo', 'aumlib'] | win.yayih | [] | 2018-09-19 | | | |
| | | Yoddos | [] | win.yoddos | [] | 2019-07-12 | | | |
| | | YoreKey | [] | win.yorekey | ['Kimsuky'] | 2021-12-15 | | | |
| | | YoungLotus | ['DarkShare'] | win.younglotus | [] | 2018-05-28 | | | |
| | | yty | [] | win.yty | ['APT-C-35', 'Donot Team', 'Viceroy Tiger'] | 2022-01-18 | | | |
| | | ZarDoor | [] | win.zardoor | [] | 2024-03-04 | | | |
| | | Zebrocy | ['Zekapab'] | win.zebrocy | ['APT28'] | 2024-07-10 | | | |
| | | Zedhou | [] | win.zedhou | [] | 2018-07-24 | | | |
| | | zenar | [] | win.zenar | [] | 2021-05-11 | | | |
| | | Zeoticus | [] | win.zeoticus | [] | 2021-02-04 | | | |
| | | ZeroCleare | [] | win.zerocleare | ['OilRig'] | 2023-01-19 | | | |
| | | ZeroT | [] | win.zerot | [] | 2017-02-04 | | | |
| | | Zeus | ['Zbot'] | win.zeus | [] | 2024-03-12 | | | |
| | | ZeusAction | [] | win.zeus_action | [] | 2021-02-01 | | | |
| | | Zeus MailSniffer | [] | win.zeus_mailsniffer | [] | 2016-12-28 | | | |
| | | Zeus OpenSSL | ['XSphinx'] | win.zeus_openssl | [] | 2020-04-01 | | | |
| | | Zeus Sphinx | [] | win.zeus_sphinx | [] | 2022-09-21 | | | |
| | | ZhCat | [] | win.zhcat | [] | 2018-04-17 | | | |
| | | ZitMo | ['ZeuS-in-the-Mobile'] | win.zitmo | [] | 2021-05-25 | | | |
| | | ZiyangRAT | [] | win.ziyangrat | [] | 2020-05-27 | | | |
| | | Zlob | [] | win.zlob | [] | 2020-12-14 | | | |
| | | Zumanek | [] | win.zumanek | [] | 2022-01-05 | | | |
| | | Zupdax | [] | win.zupdax | [] | 2022-05-25 | | | |
| | | Silon | [] | win.silon | [] | 2018-06-28 | | | |
| | | SimpleFileMover | [] | win.simplefilemover | [] | 2020-05-27 | | | |
| | | Sisfader | [] | win.sisfader | ['Hellsing'] | 2020-02-03 | | | |
| | | SkinnyBoy | [] | win.skinnyboy | [] | 2021-08-06 | | | |
| | | skip-2.0 | [] | win.skip20 | ['APT41'] | 2019-12-08 | | | |
| | | Skipper | ['Kotel'] | win.skipper | ['Turla'] | 2023-02-13 | | | |
| | | Skyplex | [] | win.skyplex | [] | 2017-02-15 | | | |
| | | Slave | [] | win.slave | [] | 2017-05-22 | | | |
| | | SLICKSHOES | [] | win.slickshoes | ['Lazarus Group'] | 2020-02-27 | | | |
| | | Slingshot | [] | win.slingshot | [] | 2022-11-28 | | | |
| | | SlothfulMedia | ['QueenOfClubs'] | win.slothfulmedia | ['PowerPool'] | 2023-06-09 | | | |
| | | SLUB | [] | win.slub | [] | 2020-12-16 | | | |
| | | smac | ['speccom'] | win.smac | [] | 2020-05-23 | | | |
| | | SManager | ['PhantomNet'] | win.smanager | [] | 2023-10-07 | | | |
| | | SmartEyes | [] | win.smarteyes | [] | 2021-01-29 | | | |
| | | Smominru | ['Ismo'] | win.smominru | [] | 2018-02-07 | | | |
| | | SnatchLoader | [] | win.snatch_loader | [] | 2020-10-08 | | | |
| | | SNEEPY | ['ByeByeShell'] | win.sneepy | [] | 2017-11-17 | | | |
| | | Snojan | [] | win.snojan | [] | 2018-01-23 | | | |
| | | SnowFlake Stealer | [] | win.snowflake_stealer | [] | 2023-08-07 | | | |
| | | Sobig | ['Palyh'] | win.sobig | [] | 2019-05-20 | | | |
| | | Socelars | [] | win.socelars | [] | 2022-12-29 | | | |
| | | SocksBot | ['BIRDDOG', 'Nadrac'] | win.socksbot | ['Anunak'] | 2023-01-19 | | | |
| | | Solarbot | ['Napolar'] | win.solarbot | [] | 2020-02-26 | | | |
| | | SombRAT | [] | win.sombrat | ['[Unnamed group]'] | 2023-12-28 | | | |
| | | soraya | [] | win.soraya | [] | 2018-09-07 | | | |
| | | SOUNDBITE | ['denis'] | win.soundbite | ['APT32'] | 2020-11-11 | | | |
| | | SPACESHIP | [] | win.spaceship | ['APT 30'] | 2022-08-25 | | | |
| | | Spectre Rat | [] | win.spectre | [] | 2024-06-24 | | | |
| | | Spedear | [] | win.spedear | ['Thrip'] | 2018-06-25 | | | |
| | | SPHijacker | [] | win.sphijacker | [] | 2023-05-04 | | | |
| | | SPIDERPIG RAT | [] | win.spider_rat | ['BlackTech'] | 2022-09-30 | | | |
| | | SpyBot | [] | win.spybot | [] | 2016-04-26 | | | |
| | | Spyder Patchwork | [] | win.spyder_patchwork | ['QUILTED TIGER'] | 2024-08-29 | | | |
| | | SpyEye | [] | win.spyeye | [] | 2021-06-29 | | | |
| | | SquidLoader | [] | win.squidloader | [] | 2024-07-03 | | | |
| | | Squirrelwaffle | ['DatopLoader'] | win.squirrelwaffle | [] | 2022-07-19 | | | |
| | | SslMM | [] | win.sslmm | ['Naikon'] | | | | |
| | | SSLoad | [] | win.ssload | ['TA578'] | 2024-11-05 | | | |
| | | Stabuniq | [] | win.stabuniq | [] | | | | |
| | | StarCruft | [] | win.starcruft | ['APT37'] | 2018-04-26 | | | |
| | | StarsyPound | [] | win.starsypound | ['Comment Crew'] | 2018-02-10 | | | |
| | | StartPage | ['Easy Television Access Now'] | win.startpage | [] | 2019-02-27 | | | |
| | | StealBit | ['Corrempa'] | win.stealbit | [] | 2022-09-26 | | | |
| | | Stealer0x3401 | [] | win.stealer_0x3401 | ['APT31'] | 2022-08-15 | | | |
| | | STEALHOOK | [] | win.stealhook | ['OilRig'] | 2024-11-04 | | | |
| | | Stinger | [] | win.stinger | [] | 2018-03-19 | | | |
| | | Stormwind | [] | win.stormwind | ['Evilnum'] | 2022-12-14 | | | |
| | | Stration | [] | win.stration | [] | 2018-07-24 | | | |
| | | StrifeWater RAT | [] | win.strifewater_rat | ['MosesStaff'] | 2023-12-04 | | | |
| | | StrongPity | [] | win.strongpity | ['PROMETHIUM', 'StrongPity'] | 2023-06-09 | | | |
| | | Stuxnet | [] | win.stuxnet | [] | 2023-10-05 | | | |
| | | Subzero | ['Corelump', 'Jumplump'] | win.subzero | [] | 2024-02-08 | | | |
| | | SunCrypt | [] | win.suncrypt | [] | 2023-06-09 | | | |
| | | SunOrcal | [] | win.sunorcal | [] | 2017-11-21 | | | |
| | | SuppoBox | ['Bayrob', 'Nivdort', 'pizd'] | win.suppobox | [] | 2024-05-17 | | | |
| | | SVCReady | [] | win.svcready | [] | 2023-06-09 | | | |
| | | swen | [] | win.swen | [] | 2019-07-31 | | | |
| | | Sword | [] | win.sword | ['Comment Crew'] | 2018-02-13 | | | |
| | | sykipot | ['getkys', 'Wkysol'] | win.sykipot | ['Samurai Panda'] | 2022-03-07 | | | |
| | | SyncCrypt | [] | win.synccrypt | [] | 2017-09-14 | | | |
| | | SynFlooder | [] | win.synflooder | ['Cleaver'] | 2017-05-21 | | | |
| | | Sys10 | [] | win.sys10 | ['Naikon'] | | | | |
| | | Syscon | [] | win.syscon | [] | 2020-02-04 | | | |
| | | SysGet | [] | win.sysget | ['DragonOK'] | 2021-04-29 | | | |
| | | SysJoker | [] | win.sysjoker | [] | 2024-01-05 | | | |
| | | Sysraw Stealer | ['Clipsa'] | win.sysraw_stealer | [] | 2019-08-07 | | | |
| | | T34loader | [] | win.t34loader | [] | 2024-02-02 | | | |
| | | TabMsgSQL | [] | win.tabmsgsql | ['Comment Crew'] | 2018-02-13 | | | |
| | | taidoor | ['simbot'] | win.taidoor | [] | 2022-03-07 | | | |