| | | GreyEnergy | [] | win.grey_energy | ['GreyEnergy', 'TeleBots'] | 2022-08-25 | | | |
| | | GRILLMARK | ['Hellsing Backdoor'] | win.grillmark | ['Hellsing', 'Leviathan'] | 2021-02-06 | | | |
| | | GRIMAGENT | [] | win.grimagent | ['UNC1878'] | 2021-10-08 | | | |
| | | GrimPlant | [] | win.grimplant | [] | 2023-02-27 | | | |
| | | GROK | [] | win.grok | ['Equation Group'] | 2022-05-23 | | | |
| | | GroundPeony | [] | win.ground_peony | [] | 2024-02-02 | | | |
| | | gsecdump | [] | win.gsecdump | [] | 2018-04-17 | | | |
| | | GSpy | [] | win.gspy | [] | 2023-11-28 | | | |
| | | GTPDOOR | [] | win.gtpdoor | ['LightBasin'] | 2024-03-04 | | | |
| | | GUP Proxy Tool | [] | win.gup_proxy | [] | 2019-08-07 | | | |
| | | H1N1 Loader | [] | win.h1n1 | [] | 2016-12-27 | | | |
| | | HackBrowserData | [] | win.hackbrowserdata | [] | 2024-03-28 | | | |
| | | Hacksfase | [] | win.hacksfase | ['Comment Crew'] | 2018-02-13 | | | |
| | | HALFRIG | [] | win.halfrig | ['APT29'] | 2023-06-01 | | | |
| | | Hamweq | [] | win.hamweq | [] | 2020-07-16 | | | |
| | | Hancitor | ['Chanitor'] | win.hancitor | [] | 2022-08-22 | | | |
| | | HARDRAIN | [] | win.hardrain | ['Lazarus Group'] | 2020-03-11 | | | |
| | | Harnig | ['Piptea'] | win.harnig | [] | 2018-01-22 | | | |
| | | Havex RAT | [] | win.havex_rat | ['Energetic Bear'] | 2022-03-25 | | | |
| | | HAWKBALL | [] | win.hawkball | [] | 2019-07-10 | | | |
| | | HazyLoad | [] | win.hazy_load | [' Silent Chollima'] | 2023-12-15 | | | |
| | | HDMR | ['GO-SPORT'] | win.hdmr | [] | 2019-12-18 | | | |
| | | HeaderTip | [] | win.headertip | [] | 2022-08-05 | | | |
| | | Helauto | [] | win.helauto | ['Comment Crew'] | 2018-02-10 | | | |
| | | HelloKitty | ['KittyCrypt'] | win.hellokitty | [] | 2023-12-27 | | | |
| | | Helminth | [] | win.helminth | ['APT34'] | 2021-06-29 | | | |
| | | Heloag | [] | win.heloag | [] | 2018-01-25 | | | |
| | | Heriplor | [] | win.heriplor | ['Energetic Bear'] | 2021-10-26 | | | |
| | | HermeticWiper | ['DriveSlayer', 'FoxBlade', 'KillDisk.NCV', 'NEARMISS'] | win.hermeticwiper | [] | 2024-04-23 | | | |
| | | HermeticWizard | [] | win.hermeticwizard | [] | 2023-03-20 | | | |
| | | HerpesBot | [] | win.herpes | [] | 2016-05-31 | | | |
| | | HesperBot | [] | win.hesperbot | [] | 2024-07-19 | | | |
| | | heyoka | [] | win.heyoka | [] | 2022-07-01 | | | |
| | | HIGHNOTE | ['ChyNode'] | win.highnote | ['APT17'] | 2019-07-31 | | | |
| | | HiKit | [] | win.hikit | ['Aurora Panda', 'Hurricane Panda'] | 2022-08-30 | | | |
| | | himan | [] | win.himan | [] | 2018-09-11 | | | |
| | | Himera Loader | [] | win.himera_loader | [] | 2020-05-18 | | | |
| | | Hive | [] | win.hive | [] | 2023-12-27 | | | |
| | | Hi-Zor RAT | [] | win.hi_zor_rat | [] | 2018-02-15 | | | |
| | | HLUX | [] | win.hlux | [] | 2016-04-26 | | | |
| | | Hodur | [] | win.hodur | ['MUSTANG PANDA'] | 2024-10-09 | | | |
| | | HOLERUN | [] | win.holerun | [] | 2023-04-25 | | | |
| | | homefry | [] | win.homefry | ['Leviathan'] | 2020-05-23 | | | |
| | | HookInjEx | [] | win.hookinjex | [] | 2020-09-21 | | | |
| | | HOPLIGHT | ['HANGMAN'] | win.hoplight | ['Lazarus Group'] | 2020-08-13 | | | |
| | | Hopscotch | [] | win.hopscotch | [] | 2021-02-06 | | | |
| | | HOTCROISSANT | [] | win.hotcroissant | ['Lazarus Group'] | 2020-04-17 | | | |
| | | HOTWAX | [] | win.hotwax | ['Lazarus Group'] | 2023-08-31 | | | |
| | | HtBot | [] | win.htbot | [] | 2017-05-29 | | | |
| | | htpRAT | [] | win.htprat | [] | 2017-12-13 | | | |
| | | HTran | ['HUC Packet Transmit Tool'] | win.htran | ['GALLIUM', 'UPS'] | 2024-03-04 | | | |
| | | HttpBrowser | ['HttpDump'] | win.httpbrowser | ['Wekby', 'EMISSARY PANDA'] | 2022-07-05 | | | |
| | | httpdropper | ['httpdr0pper'] | win.httpdropper | [] | 2018-09-13 | | | |
| | | HTTP(S) uploader | [] | win.httpsuploader | ['Lazarus Group'] | 2023-11-27 | | | |
| | | http_troy | [] | win.http_troy | [] | 2018-09-19 | | | |
| | | Hunter Stealer | [] | win.hunter | [] | 2020-11-12 | | | |
| | | HuskLoader | [] | win.huskloader | [] | 2023-04-28 | | | |
| | | HyperBro | [] | win.hyperbro | ['EMISSARY PANDA'] | 2024-10-15 | | | |
| | | HyperSSL | ['FOCUSFJORD', 'Soldier', 'Sysupdate'] | win.hyperssl | ['EMISSARY PANDA'] | 2023-07-19 | | | |
| | | HZ RAT | [] | win.hzrat | [] | 2022-11-18 | | | |
| | | RCtrl | [] | win.rctrl | ['APT 30'] | 2020-06-20 | | | |
| | | RDAT | ['GREYSTUFF'] | win.rdat | ['OilRig'] | 2022-07-29 | | | |
| | | ReactorBot | [] | win.reactorbot | [] | 2017-06-07 | | | |
| | | Reaver | [] | win.reaver | [] | 2019-05-17 | | | |
| | | RedAlpha | [] | win.redalpha | [] | 2018-07-06 | | | |
| | | RedCurl | [] | win.redcurl | [] | 2024-02-16 | | | |
| | | RedLeaves | ['BUGJUICE'] | win.redleaves | ['Stone Panda'] | 2022-06-22 | | | |
| | | REDPEPPER | ['Adupib'] | win.redpepper | ['PLATINUM'] | 2020-01-01 | | | |
| | | REDSALT | ['Dipsind'] | win.redsalt | ['PLATINUM'] | 2020-01-20 | | | |
| | | REDSHAWL | [] | win.redshawl | ['Lazarus Group'] | 2023-08-31 | | | |
| | | Redyms | [] | win.redyms | [] | 2018-10-18 | | | |
| | | Red Gambler | [] | win.red_gambler | [] | 2018-07-11 | | | |
| | | Regin | [] | win.regin | [] | 2022-03-22 | | | |
| | | RegretLocker | [] | win.regretlocker | [] | 2023-05-25 | | | |
| | | win.rekoobe | ['tinyshell.win', 'tshd.win'] | win.rekoobew | ['FIN7'] | 2021-12-08 | | | |
| | | Rekt Loader | [] | win.rektloader | [] | 2020-07-15 | | | |
| | | RemCom | ['RemoteCommandExecution'] | win.remcom | [] | 2024-04-11 | | | |
| | | Remexi | ['CACHEMONEY'] | win.remexi | ['APT39', 'Chafer'] | 2023-05-25 | | | |
| | | Remsec | [] | win.remsec_strider | ['ProjectSauron'] | 2020-04-21 | | | |
| | | Remy | ['WINDSHIELD'] | win.remy | [] | 2020-05-23 | | | |
| | | Rerdom | [] | win.rerdom | [] | 2018-08-10 | | | |
| | | Retefe | ['Tsukuba', 'Werdlod'] | win.retefe | [] | 2019-05-23 | | | |
| | | Retro | [] | win.retro | ['DarkHotel'] | 2021-12-17 | | | |
| | | Revenant | [] | win.revenant | [] | 2023-04-03 | | | |
| | | REvil | ['Sodinokibi', 'Sodin'] | win.revil | ['Pinchy Spider'] | 2024-06-12 | | | |
| | | RGDoor | [] | win.rgdoor | [] | 2021-08-09 | | | |
| | | Rhino | [] | win.rhino | [] | 2020-05-18 | | | |
| | | RHttpCtrl | [] | win.rhttpctrl | ['APT 30'] | 2020-06-20 | | | |
| | | Rifdoor | [] | win.rifdoor | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | Rikamanu | [] | win.rikamanu | ['Thrip'] | 2018-06-25 | | | |
| | | Rincux | [] | win.rincux | [] | 2018-10-26 | | | |
| | | Ripper ATM | [] | win.ripper_atm | [] | 2020-02-27 | | | |
| | | Rising Sun | [] | win.rising_sun | ['Operation Sharpshooter'] | 2022-05-05 | | | |
| | | RM3 | [] | win.rm3 | [] | 2022-12-29 | | | |
| | | ROADSWEEP | [] | win.roadsweep | [] | 2024-10-18 | | | |
| | | Rockloader | [] | win.rockloader | [] | 2022-02-14 | | | |
| | | Rofin | [] | win.rofin | [] | 2016-04-20 | | | |
| | | Rokku | [] | win.rokku | [] | 2020-12-20 | | | |
| | | RollSling | [] | win.roll_sling | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Rombertik | ['CarbonGrabber'] | win.rombertik | [] | 2017-05-21 | | | |