| | | DoublePulsar | [] | win.doublepulsar | ['Equation Group', 'UPS'] | 2022-06-08 | | | |
| | | Downdelph | ['DELPHACY'] | win.downdelph | ['APT28'] | 2021-04-20 | | | |
| | | Downeks | [] | win.downeks | [] | 2020-03-03 | | | |
| | | DramNudge | [] | win.dramnudge | [] | 2018-07-24 | | | |
| | | DreamBot | [] | win.dreambot | [] | 2022-08-28 | | | |
| | | Dripion | ['Masson'] | win.dripion | [] | 2019-09-06 | | | |
| | | DROPSHOT | [] | win.dropshot | ['APT33'] | 2018-06-25 | | | |
| | | DUBrute | [] | win.dubrute | [] | 2018-09-13 | | | |
| | | DUSTMAN | [] | win.dustman | [] | 2023-01-19 | | | |
| | | DUSTPAN | ['StealthVector'] | win.dustpan | [] | 2024-10-21 | | | |
| | | DUSTTRAP | ['CurveLoad', 'DodgeBox', 'StealthReacher'] | win.dusttrap | ['APT41'] | 2024-11-04 | | | |
| | | Duuzer | ['Escad'] | win.duuzer | ['Lazarus Group'] | 2020-12-08 | | | |
| | | DYEPACK | ['BanSwift', 'swift'] | win.dyepack | ['Lazarus Group'] | 2023-08-21 | | | |
| | | Dyre | ['Dyreza'] | win.dyre | ['WIZARD SPIDER'] | 2024-05-15 | | | |
| | | EHDevel | [] | win.ehdevel | [] | 2024-08-19 | | | |
| | | ELECTRICFISH | [] | win.electricfish | ['Lazarus Group'] | 2023-02-21 | | | |
| | | ElectricPowder | [] | win.electric_powder | [] | 2019-02-14 | | | |
| | | Elirks | [] | win.elirks | [] | 2023-08-29 | | | |
| | | Elise | ['EVILNEST'] | win.elise | ['Lotus Blossom'] | 2021-05-25 | | | |
| | | Emdivi | [] | win.emdivi | ['Stone Panda'] | 2021-03-02 | | | |
| | | Enfal | ['Lurid'] | win.enfal | [] | 2022-08-30 | | | |
| | | Enigma Loader | [] | win.enigma_loader | [] | 2023-02-13 | | | |
| | | EntryShell | [] | win.entryshell | [] | 2024-10-18 | | | |
| | | EquationDrug | [] | win.equationdrug | ['Equation Group'] | 2022-05-23 | | | |
| | | Erbium Stealer | [] | win.erbium_stealer | [] | 2022-12-05 | | | |
| | | Erebus | [] | win.erebus | [] | 2017-02-15 | | | |
| | | ReactorBot | [] | win.reactorbot | [] | 2017-06-07 | | | |
| | | Reaver | [] | win.reaver | [] | 2019-05-17 | | | |
| | | RedAlpha | [] | win.redalpha | [] | 2018-07-06 | | | |
| | | RCtrl | [] | win.rctrl | ['APT 30'] | 2020-06-20 | | | |
| | | RedCurl | [] | win.redcurl | [] | 2024-02-16 | | | |
| | | RedLeaves | ['BUGJUICE'] | win.redleaves | ['Stone Panda'] | 2022-06-22 | | | |
| | | QHost | ['Tolouge'] | win.qhost | [] | 2024-09-11 | | | |
| | | RC2FM | [] | win.rc2fm | [] | 2022-08-25 | | | |
| | | Rekt Loader | [] | win.rektloader | [] | 2020-07-15 | | | |
| | | Revenant | [] | win.revenant | [] | 2023-04-03 | | | |
| | | Retro | [] | win.retro | ['DarkHotel'] | 2021-12-17 | | | |
| | | Retefe | ['Tsukuba', 'Werdlod'] | win.retefe | [] | 2019-05-23 | | | |
| | | Rerdom | [] | win.rerdom | [] | 2018-08-10 | | | |
| | | Remy | ['WINDSHIELD'] | win.remy | [] | 2020-05-23 | | | |
| | | Remsec | [] | win.remsec_strider | ['ProjectSauron'] | 2020-04-21 | | | |
| | | Remexi | ['CACHEMONEY'] | win.remexi | ['APT39', 'Chafer'] | 2023-05-25 | | | |
| | | RemCom | ['RemoteCommandExecution'] | win.remcom | [] | 2024-04-11 | | | |
| | | REDPEPPER | ['Adupib'] | win.redpepper | ['PLATINUM'] | 2020-01-01 | | | |
| | | win.rekoobe | ['tinyshell.win', 'tshd.win'] | win.rekoobew | ['FIN7'] | 2021-12-08 | | | |
| | | RegretLocker | [] | win.regretlocker | [] | 2023-05-25 | | | |
| | | Regin | [] | win.regin | [] | 2022-03-22 | | | |
| | | Red Gambler | [] | win.red_gambler | [] | 2018-07-11 | | | |
| | | Redyms | [] | win.redyms | [] | 2018-10-18 | | | |
| | | REDSHAWL | [] | win.redshawl | ['Lazarus Group'] | 2023-08-31 | | | |
| | | REDSALT | ['Dipsind'] | win.redsalt | ['PLATINUM'] | 2020-01-20 | | | |
| | | Rad | [] | win.rad | [] | 2021-10-24 | | | |
| | | Ranbyus | [] | win.ranbyus | [] | 2024-02-13 | | | |
| | | Ramsay | [] | win.ramsay | ['DarkHotel'] | 2022-12-01 | | | |
| | | Ramnit | ['Nimnul'] | win.ramnit | [] | 2023-11-14 | | | |
| | | Ramdo | [] | win.ramdo | [] | 2016-04-20 | | | |
| | | Rambo | ['brebsd'] | win.rambo | ['DragonOK'] | 2022-09-19 | | | |
| | | RagnarLocker | [] | win.ragnarlocker | [] | 2024-03-18 | | | |
| | | RadRAT | [] | win.radrat | [] | 2018-04-23 | | | |
| | | Radamant | [] | win.radamant | [] | 2017-02-15 | | | |
| | | RawPOS | [] | win.rawpos | [] | 2020-04-17 | | | |
| | | Racket Downloader | [] | win.racket | ['Lazarus Group'] | 2023-12-11 | | | |
| | | r980 | [] | win.r980 | [] | 2017-02-15 | | | |
| | | QuiteRAT | ['Acres'] | win.quiterat | ['Silent Chollima'] | 2023-08-28 | | | |
| | | QUICKMUTE | [] | win.quickmute | ['Tonto Team'] | 2022-07-13 | | | |
| | | QUARTERRIG | ['MUSKYBEAT', 'STATICNOISE'] | win.quarterrig | ['APT29'] | 2023-10-18 | | | |
| | | QuantLoader | [] | win.quantloader | ['Guru Spider'] | 2022-02-14 | | | |
| | | QtBot | ['qtproject'] | win.qtbot | [] | 2017-11-07 | | | |
| | | Ratankba | ['QUICKRIDE'] | win.ratankba | ['Lazarus Group'] | 2023-08-13 | | | |
| | | RATel | [] | win.ratel | [] | 2023-08-25 | | | |
| | | Ransoc | [] | win.ransoc | [] | 2016-12-28 | | | |
| | | rarstar | [] | win.rarstar | ['Tick'] | 2022-11-15 | | | |
| | | Ransomlock | ['WinLock'] | win.ransomlock | [] | 2018-01-02 | | | |
| | | RatankbaPOS | ['RATANKBAPOS'] | win.ratankbapos | ['Lazarus Group'] | 2023-08-14 | | | |
| | | Rarog | [] | win.rarog | [] | 2019-01-06 | | | |
| | | Rapid Ransom | [] | win.rapid_ransom | [] | 2022-11-15 | | | |
| | | HALFRIG | [] | win.halfrig | ['APT29'] | 2023-06-01 | | | |
| | | Hamweq | [] | win.hamweq | [] | 2020-07-16 | | | |
| | | Hancitor | ['Chanitor'] | win.hancitor | [] | 2022-08-22 | | | |
| | | HARDRAIN | [] | win.hardrain | ['Lazarus Group'] | 2020-03-11 | | | |
| | | Harnig | ['Piptea'] | win.harnig | [] | 2018-01-22 | | | |
| | | Havex RAT | [] | win.havex_rat | ['Energetic Bear'] | 2022-03-25 | | | |
| | | HAWKBALL | [] | win.hawkball | [] | 2019-07-10 | | | |
| | | HazyLoad | [] | win.hazy_load | [' Silent Chollima'] | 2023-12-15 | | | |
| | | HDMR | ['GO-SPORT'] | win.hdmr | [] | 2019-12-18 | | | |
| | | HeaderTip | [] | win.headertip | [] | 2022-08-05 | | | |
| | | Helauto | [] | win.helauto | ['Comment Crew'] | 2018-02-10 | | | |
| | | HelloKitty | ['KittyCrypt'] | win.hellokitty | [] | 2023-12-27 | | | |
| | | Helminth | [] | win.helminth | ['APT34'] | 2021-06-29 | | | |
| | | Heloag | [] | win.heloag | [] | 2018-01-25 | | | |
| | | Heriplor | [] | win.heriplor | ['Energetic Bear'] | 2021-10-26 | | | |
| | | HermeticWiper | ['DriveSlayer', 'FoxBlade', 'KillDisk.NCV', 'NEARMISS'] | win.hermeticwiper | [] | 2024-04-23 | | | |
| | | HermeticWizard | [] | win.hermeticwizard | [] | 2023-03-20 | | | |
| | | HerpesBot | [] | win.herpes | [] | 2016-05-31 | | | |
| | | HesperBot | [] | win.hesperbot | [] | 2024-07-19 | | | |
| | | heyoka | [] | win.heyoka | ['Aoqin Dragon'] | 2025-09-01 | | | |
| | | HIGHNOTE | ['ChyNode'] | win.highnote | ['APT17'] | 2019-07-31 | | | |
| | | himan | [] | win.himan | [] | 2018-09-11 | | | |
| | | Himera Loader | [] | win.himera_loader | [] | 2020-05-18 | | | |
| | | Hive | [] | win.hive | [] | 2023-12-27 | | | |