| | | STOP | ['KeyPass', 'Djvu'] | win.stop | [] | 2025-05-02 | | | |
| | | Stormwind | [] | win.stormwind | ['Evilnum'] | 2022-12-14 | | | |
| | | STOWAWAY | [] | win.stowaway | [] | 2026-05-08 | | | |
| | | Stration | [] | win.stration | [] | 2018-07-24 | | | |
| | | StrelaStealer | [] | win.strelastealer | [] | 2025-10-15 | | | |
| | | Stresspaint | [] | win.stresspaint | [] | 2025-07-21 | | | |
| | | StrifeWater RAT | [] | win.strifewater_rat | ['MosesStaff'] | 2023-12-04 | | | |
| | | StrikeSuit Gift | [] | win.strikesuit_gift | ['APT32'] | 2023-09-11 | | | |
| | | StrongPity | [] | win.strongpity | ['PROMETHIUM', 'StrongPity'] | 2023-06-09 | | | |
| | | Stuxnet | [] | win.stuxnet | [] | 2023-10-05 | | | |
| | | Subzero | ['Corelump', 'Jumplump'] | win.subzero | ['Denim Tsunami'] | 2026-01-16 | | | |
| | | SunCrypt | [] | win.suncrypt | [] | 2023-06-09 | | | |
| | | SunOrcal | [] | win.sunorcal | [] | 2017-11-21 | | | |
| | | SUPERNOVA | [] | win.supernova | [] | 2023-10-05 | | | |
| | | Supper | ['SocksShell', 'ZAPCAT'] | win.supper | ['Vanilla Tempest'] | 2026-02-25 | | | |
| | | SuppoBox | ['Bayrob', 'Nivdort', 'pizd'] | win.suppobox | [] | 2024-05-17 | | | |
| | | SVCReady | [] | win.svcready | [] | 2023-06-09 | | | |
| | | swen | [] | win.swen | [] | 2019-07-31 | | | |
| | | Sword | [] | win.sword | ['Comment Crew'] | 2018-02-13 | | | |
| | | sykipot | ['getkys', 'Wkysol'] | win.sykipot | ['Samurai Panda'] | 2022-03-07 | | | |
| | | SyncCrypt | [] | win.synccrypt | [] | 2017-09-14 | | | |
| | | Sync-Scheduler | [] | win.sync_scheduler | [] | 2025-01-15 | | | |
| | | SynFlooder | [] | win.synflooder | ['Cleaver'] | 2017-05-21 | | | |
| | | Sys10 | [] | win.sys10 | ['Naikon'] | | | | |
| | | Syscon | [] | win.syscon | [] | 2020-02-04 | | | |
| | | SysGet | [] | win.sysget | ['DragonOK'] | 2021-04-29 | | | |
| | | SysJoker | [] | win.sysjoker | [] | 2024-01-05 | | | |
| | | Sysraw Stealer | ['Clipsa'] | win.sysraw_stealer | [] | 2019-08-07 | | | |
| | | T34loader | [] | win.t34loader | [] | 2024-02-02 | | | |
| | | TabMsgSQL | [] | win.tabmsgsql | ['Comment Crew'] | 2018-02-13 | | | |
| | | taidoor | ['simbot'] | win.taidoor | [] | 2022-03-07 | | | |
| | | TAINTEDSCRIBE | [] | win.taintedscribe | [] | 2020-06-23 | | | |
| | | Taleret | [] | win.taleret | [] | 2018-02-10 | | | |
| | | Tandfuy | [] | win.tandfuy | [] | 2018-07-24 | | | |
| | | Tapaoux | [] | win.tapaoux | ['DarkHotel'] | 2018-05-03 | | | |
| | | TargetCompany | ['Fargo', 'Mallox', 'Tohnichi'] | win.targetcompany | [] | 2025-04-25 | | | |
| | | Tarsip | [] | win.tarsip | ['Comment Crew'] | 2018-02-10 | | | |
| | | Taurus Stealer | [] | win.taurus_stealer | [] | 2023-08-07 | | | |
| | | TClient | ['FIRESHADOW'] | win.tclient | ['Pirate Panda'] | 2020-06-05 | | | |
| | | TelB | [] | win.telb | [] | 2020-09-21 | | | |
| | | TeleBot | [] | win.telebot | ['TeleBots', 'Sandworm'] | 2022-08-25 | | | |
| | | Teleport | [] | win.teleport | ['TA505'] | 2022-12-12 | | | |
| | | TelePowerBot | [] | win.telepowerbot | [] | 2026-02-03 | | | |
| | | TellYouThePass | [] | win.tellyouthepass | [] | 2023-06-09 | | | |
| | | Tempedreve | [] | win.tempedreve | [] | 2016-04-20 | | | |
| | | VSingle | [] | win.vsingle | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | vSkimmer | [] | win.vskimmer | [] | 2018-04-26 | | | |
| | | vxRat | [] | win.vx_rat | [] | 2025-10-20 | | | |
| | | Vyveva RAT | [] | win.vyveva | ['Lazarus Group'] | 2023-09-18 | | | |
| | | w32times | [] | win.w32times | ['UPS'] | 2018-04-13 | | | |
| | | WannaCryptor | ['Wana Decrypt0r', 'WannaCry', 'WannaCrypt', 'Wcry'] | win.wannacryptor | ['Lazarus Group'] | 2026-05-05 | | | |
| | | WannaHusky | [] | win.wannahusky | [] | 2022-04-08 | | | |
| | | Warezov | ['Stration', 'Opnis'] | win.warezov | [] | 2024-04-29 | | | |
| | | WarHawk | [] | win.warhawk | [] | 2024-08-29 | | | |
| | | WarLock | [] | win.warlock | [] | 2025-08-20 | | | |
| | | WarmCookie | ['Badspace', 'Carrotstick', 'QUICKBIND'] | win.warmcookie | [] | 2025-11-25 | | | |
| | | WastedLoader | [] | win.wastedloader | [] | 2022-07-01 | | | |
| | | WastedLocker | [] | win.wastedlocker | [] | 2026-05-05 | | | |
| | | WaterMiner | [] | win.waterminer | [] | 2018-08-01 | | | |
| | | WaterSpout | [] | win.waterspout | ['IXESHE'] | 2017-05-21 | | | |
| | | WebbyTea | [] | win.webbytea | ['Lazarus Group'] | 2025-09-15 | | | |
| | | WebC2-AdSpace | [] | win.webc2_adspace | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Ausov | [] | win.webc2_ausov | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Bolid | [] | win.webc2_bolid | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Cson | [] | win.webc2_cson | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-GreenCat | [] | win.webc2_greencat | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Head | [] | win.webc2_head | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Kt3 | [] | win.webc2_kt3 | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Qbp | [] | win.webc2_qbp | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Rave | [] | win.webc2_rave | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Table | [] | win.webc2_table | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-UGX | [] | win.webc2_ugx | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Yahoo | [] | win.webc2_yahoo | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebMonitor RAT | ['RevCode'] | win.webmonitor | [] | 2020-11-19 | | | |
| | | WhiskerSpy | [] | win.whiskerspy | [] | 2023-02-24 | | | |
| | | WhisperGate | ['PAYWIPE'] | win.whispergate | [] | 2026-01-05 | | | |
| | | WhiteBird | [] | win.whitebird | [] | 2020-10-02 | | | |
| | | WhiteBlackCrypt | ['WARYLOOK'] | win.whiteblackcrypt | [] | 2022-03-07 | | | |
| | | WinDealer | [] | win.windealer | [] | 2023-12-27 | | | |
| | | WinInetLoader | ['LIDSHOT'] | win.wininetloader | ['Lazarus Group'] | 2025-09-15 | | | |
| | | Winnti | ['BleDoor', 'JUMPALL', 'RbDoor', 'Pasteboy'] | win.winnti | ['APT17'] | 2025-02-28 | | | |
| | | WinorDLL64 | [] | win.winordll64 | ['Lazarus Group'] | 2023-02-27 | | | |
| | | Winos | [] | win.winos | ['Void Arachne'] | 2026-01-19 | | | |
| | | Winsloader | [] | win.winsloader | ['Pirate Panda'] | | | | |
| | | Wipbot | ['Epic', 'Tavdig'] | win.wipbot | ['Turla'] | 2024-12-11 | | | |
| | | WMI Ghost | ['Wimmie', 'Syndicasec'] | win.wmighost | ['Thrip'] | 2018-06-22 | | | |
| | | WmRAT | [] | win.wm_rat | ['HAZY TIGER'] | 2025-06-05 | | | |
| | | WndTest | [] | win.wndtest | ['Cleaver'] | 2017-05-21 | | | |
| | | Wonknu | [] | win.wonknu | [] | 2022-07-29 | | | |
| | | woody | [] | win.woody | [] | 2018-04-26 | | | |
| | | Woody RAT | [] | win.woodyrat | [] | 2022-08-05 | | | |
| | | Woolger | ['WoolenLogger'] | win.woolger | ['Rocket Kitten'] | 2022-04-29 | | | |
| | | WORMHOLE | [] | win.wormhole | ['Lazarus Group'] | 2023-08-14 | | | |
| | | WpBruteBot | [] | win.wpbrutebot | [] | 2020-09-23 | | | |
| | | WSCSPL | [] | win.wscspl | ['Dropping Elephant'] | 2022-01-03 | | | |
| | | Wslink | ['FinickyFrogfish'] | win.wslink | [] | 2022-03-30 | | | |
| | | X-Agent | ['splm', 'chopstick'] | win.xagent | ['APT28'] | 2026-03-11 | | | |
| | | XBot POS | [] | win.xbot_pos | [] | 2017-09-14 | | | |
| | | XBTL | [] | win.xbtl | [] | 2016-05-10 | | | |
| | | XDSpy | [] | win.xdspy | [] | 2025-06-23 | | | |