| | | Maze | ['ChaCha'] | win.maze | ['FIN6', 'TA2101'] | 2024-05-10 | | | |
| | | MBRlock | ['DexLocker'] | win.mbrlock | [] | 2018-03-01 | | | |
| | | MBR Locker | [] | win.mbrlocker | [] | 2021-11-22 | | | |
| | | Mebromi | ['MyBios'] | win.mebromi | [] | 2018-06-28 | | | |
| | | MECHANICAL | ['GoldStamp'] | win.mechanical | ['Kimsuky'] | 2023-02-09 | | | |
| | | MediaPI | ['Eyeglass'] | win.mediapi | ['Charming Kitten'] | 2024-03-28 | | | |
| | | MedusaLocker | ['AKO Ransomware', 'AKO Doxware', 'MedusaReborn'] | win.medusalocker | [] | 2024-09-26 | | | |
| | | Meduza Stealer | [] | win.meduza | [] | 2024-08-29 | | | |
| | | MegaCortex | [] | win.megacortex | [] | 2023-01-06 | | | |
| | | MeguminTrojan | [] | win.megumin | [] | 2022-08-28 | | | |
| | | MeltingClaw | [] | win.meltingclaw | [] | 2024-10-29 | | | |
| | | Meow | [] | win.meow | [] | 2023-05-26 | | | |
| | | Merdoor | [] | win.merdoor | [] | 2023-08-28 | | | |
| | | Mespinoza | ['pysa'] | win.mespinoza | [] | 2022-06-27 | | | |
| | | MetadataBin | ['Ransomware32'] | win.metadatabin | [] | 2020-10-29 | | | |
| | | Mewsei | [] | win.mewsei | [] | 2016-04-19 | | | |
| | | MgBot | ['BLame', 'MgmBot', 'POCOSTICK'] | win.mgbot | [] | 2024-10-29 | | | |
| | | Miancha | [] | win.miancha | [] | 2017-05-21 | | | |
| | | Micrass | [] | win.micrass | [] | 2018-04-13 | | | |
| | | MicroBackdoor | [] | win.microbackdoor | ['Ghostwriter'] | 2022-08-05 | | | |
| | | Microcin | [] | win.microcin | [] | 2022-08-26 | | | |
| | | Mikoponi | [] | win.mikoponi | [] | 2019-10-13 | | | |
| | | MILKMAID | [] | win.milkmaid | ['APT 30'] | 2018-04-26 | | | |
| | | Milum | [] | win.milum | [] | 2021-07-09 | | | |
| | | mim221 | [] | win.mim221 | ['Operation Soft Cell'] | 2023-03-27 | | | |
| | | Mimic Ransomware | [] | win.mimic | [] | 2024-01-11 | | | |
| | | Mindware | [] | win.mindware | [] | 2022-06-09 | | | |
| | | MiniASP | [] | win.miniasp | ['Comment Crew'] | 2018-02-10 | | | |
| | | MINIBIKE | [] | win.minibike | [] | 2024-04-29 | | | |
| | | miniBlindingCan | ['AIRDRY.V2', 'EventHorizon'] | win.miniblindingcan | ['Lazarus Group'] | 2023-12-19 | | | |
| | | MINIBUS | [] | win.minibus | [] | 2024-04-29 | | | |
| | | miniTypeFrame | [] | win.minitypeframe | ['Lazarus Group'] | 2023-12-11 | | | |
| | | Mirage | [] | win.mirage | ['Mirage'] | 2020-10-02 | | | |
| | | MirageFox | [] | win.miragefox | ['Mirage'] | 2018-06-19 | | | |
| | | Mirai | [] | win.mirai | [] | 2022-09-16 | | | |
| | | MirrorKey | [] | win.mirrorkey | [] | 2023-02-17 | | | |
| | | Misfox | ['Dromedan', 'MixFox', 'ModPack'] | win.misfox | [] | 2024-06-05 | | | |
| | | Misha | [] | win.misha | [] | 2022-11-28 | | | |
| | | MISTCLOAK | ['HIUPAN'] | win.mistcloak | [] | 2023-09-08 | | | |
| | | Miuref | [] | win.miuref | [] | 2016-04-19 | | | |
| | | SelfMake Loader | [] | win.selfmake | ['BlackTech'] | 2022-09-30 | | | |
| | | SendSafe | [] | win.sendsafe | [] | 2021-01-11 | | | |
| | | SepSys | ['Silvertor Ransomware'] | win.sepsys | [] | 2020-10-15 | | | |
| | | Sepulcher | [] | win.sepulcher | ['TA413'] | 2021-02-25 | | | |
| | | SessionManager | [] | win.session_manager | ['Gelsemium'] | 2022-07-05 | | | |
| | | Sfile | ['Morseop', 'Escal'] | win.sfile | [] | 2022-06-09 | | | |
| | | shadowhammer | ['DAYJOB'] | win.shadowhammer | ['Operation ShadowHammer'] | 2021-09-19 | | | |
| | | ShadyHammock | [] | win.shady_hammock | [] | 2024-10-29 | | | |
| | | Shakti | [] | win.shakti | [] | 2017-02-15 | | | |
| | | SHAPESHIFT | [] | win.shapeshift | ['APT33'] | 2017-09-29 | | | |
| | | shareip | ['remotecmd'] | win.shareip | ['UPS'] | 2018-04-17 | | | |
| | | SHARPKNOT | ['Bitrep'] | win.sharpknot | ['Silent Chollima'] | 2018-04-13 | | | |
| | | SHATTEREDGLASS | ['Unidentified 081'] | win.shatteredglass | ['Silent Chollima'] | 2024-08-01 | | | |
| | | Shifu | [] | win.shifu | [] | 2022-02-14 | | | |
| | | Shim RAT | [] | win.shimrat | ['Mofang'] | 2020-05-23 | | | |
| | | SHIPSHAPE | [] | win.shipshape | ['APT 30'] | 2022-08-25 | | | |
| | | Shujin | [] | win.shujin | [] | 2018-02-21 | | | |
| | | Shylock | ['Caphaw'] | win.shylock | [] | 2023-05-23 | | | |
| | | SideWalk | ['ScrambleCross'] | win.sidewalk | [] | 2024-09-02 | | | |
| | | SideWinder | [] | win.sidewinder | ['RAZOR TIGER', 'SloppyLemming'] | 2025-02-10 | | | |
| | | SiennaPurple | ['HolyLocker', 'H0lyGh0st'] | win.sienna_purple | [] | 2024-02-08 | | | |
| | | Silence | ['TrueBot'] | win.silence | ['Silence group', 'TA505'] | 2023-11-17 | | | |
| | | Silon | [] | win.silon | [] | 2018-06-28 | | | |
| | | SimpleFileMover | [] | win.simplefilemover | [] | 2020-05-27 | | | |
| | | Sinowal | ['Theola', 'Quarian', 'Mebroot', 'Anserin', 'Torpig'] | win.sinowal | [] | 2022-01-28 | | | |
| | | Sisfader | [] | win.sisfader | ['Hellsing'] | 2020-02-03 | | | |
| | | SkinnyBoy | [] | win.skinnyboy | [] | 2021-08-06 | | | |
| | | skip-2.0 | [] | win.skip20 | ['APT41'] | 2019-12-08 | | | |
| | | Skipper | ['Kotel'] | win.skipper | ['Turla'] | 2023-02-13 | | | |
| | | Skyplex | [] | win.skyplex | [] | 2017-02-15 | | | |
| | | Slave | [] | win.slave | [] | 2017-05-22 | | | |
| | | SLICKSHOES | [] | win.slickshoes | ['Lazarus Group'] | 2020-02-27 | | | |
| | | Slingshot | [] | win.slingshot | [] | 2022-11-28 | | | |
| | | SlothfulMedia | ['QueenOfClubs'] | win.slothfulmedia | ['PowerPool'] | 2023-06-09 | | | |
| | | SLUB | [] | win.slub | [] | 2020-12-16 | | | |
| | | smac | ['speccom'] | win.smac | [] | 2020-05-23 | | | |
| | | SManager | ['PhantomNet'] | win.smanager | [] | 2023-10-07 | | | |
| | | SmartEyes | [] | win.smarteyes | [] | 2021-01-29 | | | |
| | | Smominru | ['Ismo'] | win.smominru | [] | 2018-02-07 | | | |
| | | SnatchCrypto | ['BackbitingTea'] | win.snatchcrypto | ['Lazarus Group'] | 2023-12-19 | | | |
| | | SnatchLoader | [] | win.snatch_loader | [] | 2020-10-08 | | | |
| | | SNEEPY | ['ByeByeShell'] | win.sneepy | [] | 2017-11-17 | | | |
| | | Snojan | [] | win.snojan | [] | 2018-01-23 | | | |
| | | SnowFlake Stealer | [] | win.snowflake_stealer | [] | 2023-08-07 | | | |
| | | Sobig | ['Palyh'] | win.sobig | [] | 2019-05-20 | | | |
| | | Socelars | [] | win.socelars | [] | 2022-12-29 | | | |
| | | SocksBot | ['BIRDDOG', 'Nadrac'] | win.socksbot | ['Anunak'] | 2023-01-19 | | | |
| | | Solarbot | ['Napolar'] | win.solarbot | [] | 2020-02-26 | | | |
| | | SombRAT | [] | win.sombrat | ['[Unnamed group]'] | 2023-12-28 | | | |
| | | soraya | [] | win.soraya | [] | 2018-09-07 | | | |
| | | Soul | ['SoulSearcher'] | win.soul | [] | 2023-07-24 | | | |
| | | SOUNDBITE | ['denis'] | win.soundbite | ['APT32'] | 2020-11-11 | | | |
| | | SPACESHIP | [] | win.spaceship | ['APT 30'] | 2022-08-25 | | | |
| | | Spectre Rat | [] | win.spectre | [] | 2024-06-24 | | | |
| | | Spedear | [] | win.spedear | ['Thrip'] | 2018-06-25 | | | |
| | | SPHijacker | [] | win.sphijacker | [] | 2023-05-04 | | | |
| | | SPIDERPIG RAT | [] | win.spider_rat | ['BlackTech'] | 2022-09-30 | | | |
| | | splitloader | [] | win.splitloader | [] | 2024-09-23 | | | |
| | | SpyBot | [] | win.spybot | [] | 2016-04-26 | | | |
| | | Spyder Patchwork | [] | win.spyder_patchwork | ['QUILTED TIGER'] | 2024-08-29 | | | |