| | | Oni | [] | win.oni | [] | 2019-08-14 | | | |
| | | OnionDuke | [] | win.onionduke | ['APT29'] | 2020-07-06 | | | |
| | | OnlinerSpambot | ['SBot', 'Onliner'] | win.onliner | [] | 2023-01-25 | | | |
| | | Opachki | [] | win.opachki | [] | 2018-06-28 | | | |
| | | OpenCarrot | [] | win.open_carrot | ['APT37'] | 2023-08-07 | | | |
| | | OpBlockBuster | [] | win.op_blockbuster | ['Lazarus Group'] | 2017-05-17 | | | |
| | | ORANGEADE | [] | win.orangeade | ['APT 30'] | 2019-04-17 | | | |
| | | OrcaRAT | [] | win.orcarat | [] | 2020-05-23 | | | |
| | | Orchard | ['Antavmu'] | win.orchard | [] | 2023-05-17 | | | |
| | | ORPCBackdoor | [] | win.orpcbackdoor | [] | 2025-06-05 | | | |
| | | Oski Stealer | [] | win.oski | [] | 2025-05-01 | | | |
| | | Outlook Backdoor | ['FACADE'] | win.outlook_backdoor | ['Turla'] | 2020-07-24 | | | |
| | | Overlord RAT | [] | win.overlord | [] | 2026-06-09 | | | |
| | | Owlproxy | [] | win.owlproxy | [] | 2022-07-05 | | | |
| | | paladin | [] | win.paladin | ['Pitty Panda'] | 2018-09-30 | | | |
| | | PandaBanker | ['ZeusPanda'] | win.pandabanker | [] | 2022-01-25 | | | |
| | | Pandora | [] | win.pandora | [] | 2022-09-20 | | | |
| | | Parallax RAT | ['ParallaxRAT'] | win.parallax | [] | 2025-04-28 | | | |
| | | parasite_http | [] | win.parasite_http | [] | 2018-09-13 | | | |
| | | PATHLOADER | [] | win.pathloader | [] | 2025-04-25 | | | |
| | | PathWiper | [] | win.pathwiper | [] | 2025-06-05 | | | |
| | | Pay2Key | ['Cobalt'] | win.pay2key | [] | 2021-05-13 | | | |
| | | Payload | [] | win.payload | [] | 2026-05-21 | | | |
| | | PayloadBIN | [] | win.payloadbin | ['Evil Corp'] | 2022-07-01 | | | |
| | | PcShare | [] | win.pcshare | ['Pirate Panda'] | 2022-07-29 | | | |
| | | PEBBLEDASH | [] | win.pebbledash | [] | 2025-05-23 | | | |
| | | Penco | [] | win.penco | [] | 2018-07-24 | | | |
| | | PetitPotato | [] | win.petit_potato | ['Silent Chollima'] | 2026-01-27 | | | |
| | | PetrWrap | [] | win.petrwrap | [] | 2023-07-22 | | | |
| | | Petya | [] | win.petya | [] | 2023-10-30 | | | |
| | | pgift | ['ReRol'] | win.pgift | ['Pitty Panda'] | 2018-01-25 | | | |
| | | PhanDoor | [] | win.phandoor | ['Lazarus Group', 'Silent Chollima'] | 2023-08-28 | | | |
| | | PhantomCore | [] | win.phantomcore | [] | 2026-08-13 | | | |
| | | PhantomGraph | [] | win.phantomgraph | ['Head Mare'] | 2026-08-13 | | | |
| | | Phobos | [] | win.phobos | [] | 2025-07-21 | | | |
| | | Phoenix Locker | [] | win.phoenix_locker | [] | 2025-03-07 | | | |
| | | PHOREAL | ['Rizzo'] | win.phoreal | ['APT32'] | 2022-03-08 | | | |
| | | Phorpiex | ['Tldr', 'Trik', 'TwizT', 'phorphiex'] | win.phorpiex | [] | 2026-05-05 | | | |
| | | PHOTOFORK | [] | win.photofork | [] | 2024-12-11 | | | |
| | | PHOTOLITE | [] | win.photolite | [] | 2023-08-14 | | | |
| | | PhotoLoader | ['GZIPLOADER'] | win.photoloader | [] | 2024-04-03 | | | |
| | | PICKPOCKET | [] | win.pickpocket | ['APT34'] | 2021-06-29 | | | |
| | | Pikabot | [] | win.pikabot | [] | 2025-11-25 | | | |
| | | PILLOWMINT | [] | win.pillowmint | ['Anunak'] | 2023-05-23 | | | |
| | | PinchDuke | [] | win.pinchduke | ['APT29'] | 2022-11-15 | | | |
| | | pipcreat | [] | win.pipcreat | [] | 2018-09-11 | | | |
| | | PipeMagic | [] | win.pipemagic | [] | 2025-04-25 | | | |
| | | PipeMon | [] | win.pipemon | ['Winnti Umbrella'] | 2023-05-23 | | | |
| | | pirpi | ['SHOTPUT', 'CookieCutter'] | win.pirpi | ['UPS'] | 2020-05-23 | | | |
| | | Pitou | [] | win.pitou | [] | 2024-09-04 | | | |
| | | PittyTiger RAT | [] | win.pittytiger_rat | [] | 2018-01-19 | | | |
| | | PixyNetLoader | [] | win.pixynet_loader | ['APT28'] | 2026-06-10 | | | |
| | | Pkybot | ['Pykbot', 'TBag', 'Bublik'] | win.pkybot | [] | 2018-02-15 | | | |
| | | PLAINTEE | [] | win.plaintee | ['RANCOR'] | 2022-07-29 | | | |
| | | PLAY | ['PlayCrypt'] | win.play | [] | 2026-09-24 | | | |
| | | playwork | [] | win.playwork | [] | 2018-09-13 | | | |
| | | PLEAD | ['DRAWDOWN', 'GOODTIMES', 'Linopid'] | win.plead | ['BlackTech'] | 2021-03-02 | | | |
| | | ployx | [] | win.ployx | [] | 2018-09-19 | | | |
| | | PlugX | ['Destroy RAT', 'Kaba', 'Korplug', 'Sogu', 'TIGERPLUG', 'RedDelta'] | win.plugx | ['APT 22', 'APT 26', 'APT31', 'APT41', 'Aurora Panda', 'Calypso group', 'DragonOK', 'EMISSARY PANDA', 'Hellsing', 'Hurricane Panda', 'Leviathan', 'Mirage', 'Mustang Panda', 'NetTraveler', 'Nightshade Panda', 'SLIME29', 'Samurai Panda', 'Stone Panda', 'UPS', 'Violin Panda'] | 2026-06-01 | | | |
| | | Plurox | [] | win.plurox | [] | 2019-09-25 | | | |
| | | pngdowner | [] | win.pngdowner | ['APT2', 'Putter Panda'] | 2025-10-01 | | | |
| | | PocoDown | ['Blitz', 'PocoDownloader'] | win.pocodown | ['APT28'] | 2020-03-25 | | | |
| | | Poison Ivy | ['SPIVY', 'pivy', 'poisonivy'] | win.poison_ivy | ['GALLIUM', 'Molerats', 'Mustang Panda', 'Nightshade Panda', 'Pirate Panda', 'Stone Panda', 'TA428', 'Temper Panda'] | 2025-05-21 | | | |
| | | Poison RAT | [] | win.poison_rat | [] | 2020-08-12 | | | |
| | | Poldat | ['Zlib', 'KABOB'] | win.poldat | ['Samurai Panda', 'Stone Panda'] | 2020-01-15 | | | |
| | | PolPo | [] | win.polpo | ['EMISSARY PANDA'] | 2024-10-15 | | | |
| | | PolyglotDuke | [] | win.polyglotduke | ['APT29'] | 2020-05-23 | | | |
| | | Polyglot | [] | win.polyglot_ransom | [] | 2017-02-15 | | | |
| | | PolyVice | ['Chily'] | win.polyvice | [] | 2024-02-08 | | | |
| | | Pony | ['Siplog', 'Fareit'] | win.pony | ['Cobalt'] | 2024-06-05 | | | |
| | | PoohMilk Loader | [] | win.poohmilk | ['APT37'] | 2017-11-16 | | | |
| | | POORTRY | [] | win.poortry | [] | 2026-09-07 | | | |
| | | PortDoor | [] | win.portdoor | [] | 2023-04-06 | | | |
| | | PortStarter | ['SocksProxyGo'] | win.portstarter | ['Vanilla Tempest'] | 2026-02-25 | | | |
| | | poscardstealer | [] | win.poscardstealer | [] | 2018-09-11 | | | |
| | | PoSlurp | ['PUNCHTRACK'] | win.poslurp | ['FIN8'] | 2021-03-24 | | | |
| | | PostNapTea | ['SIGNBT'] | win.postnaptea | ['Lazarus Group'] | 2026-09-24 | | | |
| | | Poweliks | [] | win.poweliks | [] | 2020-04-23 | | | |
| | | PowerDuke | [] | win.powerduke | ['APT 29'] | 2023-07-28 | | | |
| | | PowerLoader | [] | win.powerloader | [] | 2020-07-15 | | | |
| | | PowerPool | [] | win.powerpool | [] | 2018-09-07 | | | |
| | | PowerShellRunner | [] | win.powershellrunner | ['Turla'] | 2019-05-30 | | | |
| | | Powersniff | ['PUNCHBUGGY'] | win.powersniff | [] | 2020-06-03 | | | |
| | | Predator The Thief | [] | win.predator | [] | 2021-04-12 | | | |
| | | Prestige | [] | win.prestige | [] | 2023-05-25 | | | |
| | | Prikormka | [] | win.prikormka | ['Groundbait'] | 2023-06-01 | | | |
| | | Prilex | [] | win.prilex | [] | 2018-03-16 | | | |
| | | PrivateLoader | [] | win.privateloader | [] | 2025-01-07 | | | |
| | | ProjectWood | [] | win.project_wood | [] | 2024-02-02 | | | |
| | | Prometei | [] | win.prometei | [] | 2024-10-24 | | | |
| | | Proto8RAT | [] | win.proto8_rat | [] | 2022-08-26 | | | |
| | | ProtonBot | [] | win.protonbot | [] | 2021-10-24 | | | |
| | | PseudoManuscrypt | [] | win.pseudo_manuscrypt | [] | 2025-09-25 | | | |
| | | PSLogger | ['ECCENTRICBANDWAGON'] | win.pslogger | ['Lazarus Group'] | 2022-11-21 | | | |
| | | PC Surveillance System | ['PSS'] | win.pss | [] | 2018-02-07 | | | |
| | | Pteranodon | ['Pterodo'] | win.pteranodon | ['Gamaredon Group', 'Operation Armageddon'] | 2026-09-22 | | | |
| | | Pterois | [] | win.pterois | ['Swan Vector'] | 2025-11-13 | | | |
| | | PUBLOAD | ['ClaimLoader', 'PUBLOAD'] | win.pubload | [] | 2025-09-23 | | | |
| | | PulsarTea | [] | win.pulsartea | ['Lazarus Group'] | 2025-10-28 | | | |
| | | Punkey POS | ['poscardstealer', 'pospunk', 'punkeypos'] | win.punkey_pos | [] | 2023-02-21 | | | |