| | | Ryuk | [] | win.ryuk | ['FIN6', 'GRIM SPIDER', 'UNC1878', 'WIZARD SPIDER'] | 2026-02-25 | | | |
| | | Ryuk Stealer | ['Sidoh'] | win.ryuk_stealer | [] | 2021-09-02 | | | |
| | | SADBRIDGE | [] | win.sadbridge | [] | 2025-01-02 | | | |
| | | SafeNet | [] | win.safenet | [] | 2020-01-22 | | | |
| | | Sagerunex | [] | win.sagerunex | ['LOTUS PANDA'] | 2026-01-05 | | | |
| | | SAGE | ['Saga'] | win.sage_ransom | [] | 2019-07-20 | | | |
| | | SaiGon | [] | win.saigon | [] | 2020-09-01 | | | |
| | | Saint Bot | [] | win.saint_bot | [] | 2022-07-25 | | | |
| | | Sakula RAT | ['Sakurel'] | win.sakula_rat | ['APT 26', 'Hurricane Panda'] | 2024-05-21 | | | |
| | | Salgorea | ['BadCake'] | win.salgorea | ['APT32'] | 2020-05-06 | | | |
| | | Sality | [] | win.sality | ['Salty Spider'] | 2023-11-14 | | | |
| | | Sanny | [] | win.sanny | [] | 2020-06-08 | | | |
| | | SantaStealer | [] | win.santa_stealer | [] | 2026-01-05 | | | |
| | | SappyCache | [] | win.sappycache | [] | 2020-07-15 | | | |
| | | Sarhust | ['ENDCMD', 'Hussarini'] | win.sarhust | [] | 2020-06-30 | | | |
| | | Sasfis | ['Oficla'] | win.sasfis | [] | 2018-11-28 | | | |
| | | Satan | ['5ss5c', 'DBGer', 'Lucky Ransomware'] | win.satan | [] | 2020-01-16 | | | |
| | | Satana | [] | win.satana | [] | 2023-06-09 | | | |
| | | Satellite Turla | [] | win.satellite_turla | ['Turla'] | 2022-11-17 | | | |
| | | Sathurbot | [] | win.sathurbot | [] | 2020-02-03 | | | |
| | | ScanLine | [] | win.scanline | ['Volt Typhoon'] | 2024-02-08 | | | |
| | | ScanPOS | [] | win.scanpos | [] | 2022-09-19 | | | |
| | | Scarabey | ['MVP', 'Scarab-Russian', 'Scarab'] | win.scarabey | [] | 2019-08-19 | | | |
| | | ScareCrow | [] | win.scarecrow | [] | 2022-12-19 | | | |
| | | Scavenger | ['scavenger', 'SCVNGR', 'scvngr'] | win.scavenger | [] | 2025-07-29 | | | |
| | | Scieron | [] | win.scieron | [] | 2022-09-20 | | | |
| | | Scout | [] | win.scout | ['Lazarus Group'] | 2023-10-20 | | | |
| | | Scranos | [] | win.scranos | [] | 2025-07-21 | | | |
| | | ScreenCap | [] | win.screencap | [] | 2022-10-24 | | | |
| | | SDBbot | [] | win.sdbbot | ['TA505'] | 2023-02-17 | | | |
| | | SeaSalt | [] | win.seasalt | ['Comment Crew'] | 2018-02-13 | | | |
| | | SecondHandTea | [] | win.secondhandtea | ['Lazarus Group'] | 2025-09-15 | | | |
| | | SeDll | [] | win.sedll | ['Leviathan'] | 2020-05-23 | | | |
| | | Sedreco | ['azzy', 'eviltoss'] | win.sedreco | ['APT28'] | 2022-05-04 | | | |
| | | Seduploader | ['jhuhugit', 'jkeyskw', 'downrage', 'carberplike', 'GAMEFISH'] | win.seduploader | ['APT28'] | 2024-07-10 | | | |
| | | SelfMake Loader | [] | win.selfmake | ['BlackTech'] | 2022-09-30 | | | |
| | | SendSafe | [] | win.sendsafe | [] | 2021-01-11 | | | |
| | | SepSys | ['Silvertor Ransomware'] | win.sepsys | [] | 2020-10-15 | | | |
| | | Sepulcher | [] | win.sepulcher | ['TA413'] | 2021-02-25 | | | |
| | | SessionManager | [] | win.session_manager | ['Gelsemium'] | 2022-07-05 | | | |
| | | Sfile | ['Morseop', 'Escal'] | win.sfile | [] | 2022-06-09 | | | |
| | | shadowhammer | ['DAYJOB'] | win.shadowhammer | ['Operation ShadowHammer'] | 2021-09-19 | | | |
| | | Shadow RAT | [] | win.shadow_rat | [] | 2025-11-13 | | | |
| | | ShadyHammock | [] | win.shady_hammock | [] | 2025-11-25 | | | |
| | | Shakti | [] | win.shakti | [] | 2017-02-15 | | | |
| | | SHAPESHIFT | [] | win.shapeshift | ['APT33'] | 2017-09-29 | | | |
| | | shareip | ['remotecmd'] | win.shareip | ['UPS'] | 2018-04-17 | | | |
| | | SHARPKNOT | ['Bitrep'] | win.sharpknot | ['Silent Chollima'] | 2018-04-13 | | | |
| | | SHATTEREDGLASS | ['Unidentified 081'] | win.shatteredglass | ['Silent Chollima'] | 2024-08-01 | | | |
| | | Shifu | [] | win.shifu | [] | 2022-02-14 | | | |
| | | Shim RAT | [] | win.shimrat | ['Mofang'] | 2020-05-23 | | | |
| | | SHIPSHAPE | [] | win.shipshape | ['APT 30'] | 2022-08-25 | | | |
| | | ShortLeash | [] | win.shortleash | [] | 2025-06-24 | | | |
| | | ShrinkLocker | [] | win.shrinklocker | [] | 2025-02-25 | | | |
| | | Shujin | [] | win.shujin | [] | 2018-02-21 | | | |
| | | Shylock | ['Caphaw'] | win.shylock | [] | 2023-05-23 | | | |
| | | SideTwist | [] | win.sidetwist | ['OilRig'] | 2023-09-07 | | | |
| | | SideWalk | ['ScrambleCross'] | win.sidewalk | [] | 2024-09-02 | | | |
| | | SideWinder | [] | win.sidewinder | ['RAZOR TIGER', 'SloppyLemming'] | 2025-02-10 | | | |
| | | SiennaPurple | ['HolyLocker', 'H0lyGh0st'] | win.sienna_purple | [] | 2024-02-08 | | | |
| | | Sierra(Alfa,Bravo, ...) | ['Destover'] | win.sierras | ['Lazarus Group'] | 2024-11-29 | | | |
| | | Xloader | ['Formbook'] | osx.xloader | [] | 2026-05-18 | | | |
| | | TrickMo | [] | apk.trickmo | [] | 2026-05-18 | | | |
| | | ZionSiphon | [] | win.zionsiphon | [] | 2026-05-18 | | | |
| | | OSAMiner | [] | osx.osaminer | [] | 2026-05-18 | | | |
| | | Coruna | [] | ios.coruna | [] | 2026-05-08 | | | |
| | | PeerTime | [] | elf.peer_time | ['UAT-9244'] | 2026-05-11 | | | |
| | | Eternidade Stealer | [] | win.eternidade_stealer | [] | 2026-05-13 | | | |
| | | AppleChris | [] | win.apple_chris | ['CL-STA-1087'] | 2026-05-11 | | | |
| | | DohDoor | [] | win.dohdoor | [] | 2026-05-11 | | | |
| | | BoryptGrab | [] | win.boryptgrab | [] | 2026-05-11 | | | |
| | | TernDoor | [] | win.terndoor | ['UAT-9244'] | 2026-05-11 | | | |
| | | BruteEntry | [] | elf.brute_entry | ['UAT-9244'] | 2026-05-11 | | | |
| | | GRIDTIDE | [] | elf.gridtide | ['UNC2814'] | 2026-05-11 | | | |
| | | Tsundere | ['DinDoor'] | js.tsundere | ['MuddyWater'] | 2026-05-08 | | | |
| | | Loki (Mythic) | [] | win.loki_mythic | ['Mythic Likho'] | 2026-05-08 | | | |
| | | MicroStealer | [] | jar.microstealer | [] | 2026-05-08 | | | |
| | | LucidRook | [] | win.lucidrook | [] | 2026-05-08 | | | |
| | | LucidKnight | [] | win.lucidknight | [] | 2026-05-08 | | | |
| | | LucidPawn | [] | win.lucidpawn | [] | 2026-05-08 | | | |
| | | SpyFRPTunnel | ['fvncBot'] | apk.spyfrptunnel | [] | 2026-05-08 | | | |
| | | SafePay | [] | win.safepay | [] | 2026-05-08 | | | |
| | | Babuk | [] | elf.babuk | [] | 2026-05-08 | | | |
| | | DracuLoader | [] | win.dracu_loader | ['Earth Estries'] | 2026-05-08 | | | |
| | | Phantom Stealer | [] | win.phantom_stealer | [] | 2026-05-08 | | | |
| | | GeckoStealer | [] | win.geckostealer | [] | 2026-05-06 | | | |
| | | ProSpy | [] | apk.prospy | ['HAZY TIGER'] | 2026-05-06 | | | |
| | | LedgerChecker Stealer | [] | win.ledgerchecker | [] | 2026-05-06 | | | |
| | | VoltStealer | [] | win.voltstealer | [] | 2026-05-06 | | | |
| | | SpankRAT | [] | win.spank_rat | [] | 2026-05-06 | | | |
| | | HanGhost | [] | win.hanghost | [] | 2026-05-06 | | | |
| | | AGEWHEEZE | [] | win.agewheeze | ['Cyber Serp'] | 2026-05-06 | | | |
| | | ABCDoor | [] | win.abcdoor | [] | 2026-05-06 | | | |
| | | SmartApeSG | ['HANEYMANEY', 'ZPHP'] | js.smartapesg | [] | 2026-05-05 | | | |
| | | QLNX | ['Quasar Linux RAT'] | elf.qlnx | [] | 2026-05-05 | | | |
| | | Macaw | [] | win.macaw | [] | 2026-05-05 | | | |
| | | SNOWBASIN | [] | py.snowbasin | ['UNC6692'] | 2026-05-05 | | | |
| | | POWERSTATS | ['Valyria'] | ps1.powerstats | ['MuddyWater'] | 2026-05-05 | | | |
| | | PowGoop | [] | ps1.powgoop | ['MuddyWater'] | 2026-05-05 | | | |
| | | STARWHALE | ['Canopy', 'SloughRAT'] | vbs.starwhale | ['MuddyWater'] | 2026-05-05 | | | |