| | | CradleCore | [] | win.cradlecore | [] | 2017-05-12 | | | |
| | | CrackedCantil | [] | win.crackedcantil | [] | 2024-12-09 | | | |
| | | Covid22 | [] | win.covid22 | [] | 2021-11-17 | | | |
| | | Cova | [] | win.cova | [] | 2022-12-07 | | | |
| | | Cotx RAT | [] | win.cotx | ['TA428'] | 2022-08-11 | | | |
| | | Chinad | [] | win.chinad | [] | 2023-06-01 | | | |
| | | CoronaVirus Ransomware | ['CoronaVirus Cover-Ransomware'] | win.coronavirus_ransomware | [] | 2020-04-21 | | | |
| | | Coreshell | ['SOURFACE'] | win.coreshell | ['APT28'] | 2022-05-04 | | | |
| | | CoreDN | [] | win.coredn | ['Lazarus Group'] | 2023-09-07 | | | |
| | | Corebot | [] | win.corebot | [] | 2024-11-25 | | | |
| | | CookieBag | [] | win.cookiebag | ['Comment Crew'] | 2018-02-10 | | | |
| | | Contopee | ['WHITEOUT'] | win.contopee | ['Lazarus Group'] | 2023-08-21 | | | |
| | | Conti | [] | win.conti | ['WIZARD SPIDER'] | 2025-06-04 | | | |
| | | Chthonic | ['AndroKINS'] | win.chthonic | [] | 2021-09-19 | | | |
| | | Client Maximus | [] | win.client_maximus | [] | 2017-06-03 | | | |
| | | CLOUDBURST | ['NickelLoader'] | win.cloudburst | ['Lazarus Group'] | 2025-09-15 | | | |
| | | CloudEyE | ['GuLoader', 'vbdropper'] | win.cloudeye | [] | 2026-05-05 | | | |
| | | CLASSFON | [] | win.classfon | [] | 2019-08-09 | | | |
| | | CloudWizard | [] | win.cloudwizard | [] | 2023-06-01 | | | |
| | | CloudDuke | ['MiniDionis', 'CloudLook'] | win.cloud_duke | ['APT29'] | 2022-11-15 | | | |
| | | Clambling | [] | win.clambling | [] | 2021-01-11 | | | |
| | | Citadel | [] | win.citadel | [] | 2025-07-24 | | | |
| | | Cinobi | [] | win.cinobi | [] | 2021-08-09 | | | |
| | | Cicada3301 | [] | win.cicada3301 | [] | 2025-11-09 | | | |
| | | Chrysalis | [] | win.chrysalis | ['LOTUS PANDA'] | 2026-02-03 | | | |
| | | ChrGetPdsi Stealer | [] | win.chrgetpdsi_stealer | [] | 2024-06-24 | | | |
| | | CMSBrute | [] | win.cmsbrute | [] | 2017-09-07 | | | |
| | | Clop | [] | win.clop | ['TA505'] | 2025-11-09 | | | |
| | | ChiserClient | [] | win.chiser_client | ['Pirate Panda'] | 2022-03-30 | | | |
| | | Chir | [] | win.chir | [] | 2017-01-17 | | | |
| | | Chinoxy | [] | win.chinoxy | [] | 2022-08-28 | | | |
| | | CMSTAR | ['meciv'] | win.cmstar | [] | 2022-07-25 | | | |
| | | Chinotto | [] | win.chinotto | ['APT37'] | 2023-11-22 | | | |
| | | Clipog | [] | win.clipog | [] | 2023-10-20 | | | |
| | | 3CX Backdoor | ['SUDDENICON'] | win.3cx_backdoor | ['Lazarus Group'] | 2025-09-15 | | | |
| | | 5.t Downloader | [] | win.5t_downloader | [] | 2024-06-05 | | | |
| | | 7ev3n | [] | win.7ev3n | [] | 2018-01-23 | | | |
| | | SslMM | [] | win.sslmm | ['Naikon'] | | | | |
| | | SSLoad | [] | win.ssload | ['TA578'] | 2024-11-05 | | | |
| | | Stabuniq | [] | win.stabuniq | [] | | | | |
| | | StarCruft | [] | win.starcruft | ['APT37'] | 2018-04-26 | | | |
| | | StarsyPound | [] | win.starsypound | ['Comment Crew'] | 2018-02-10 | | | |
| | | StartPage | ['Easy Television Access Now'] | win.startpage | [] | 2019-02-27 | | | |
| | | Statc | ['Statc Stealer', 'Static Stealer'] | win.statc | [] | 2025-05-23 | | | |
| | | StealBit | ['Corrempa'] | win.stealbit | [] | 2022-09-26 | | | |
| | | Stealc | [] | win.stealc | [] | 2026-05-05 | | | |
| | | Stealer0x3401 | [] | win.stealer_0x3401 | ['APT31'] | 2022-08-15 | | | |
| | | STEALHOOK | [] | win.stealhook | ['OilRig'] | 2024-11-04 | | | |
| | | StegoLoader | [] | win.stegoloader | [] | 2025-02-28 | | | |
| | | Stinger | [] | win.stinger | [] | 2018-03-19 | | | |
| | | STOP | ['KeyPass', 'Djvu'] | win.stop | [] | 2025-05-02 | | | |
| | | Stormwind | [] | win.stormwind | ['Evilnum'] | 2022-12-14 | | | |
| | | STOWAWAY | [] | win.stowaway | [] | 2026-05-08 | | | |
| | | Stration | [] | win.stration | [] | 2018-07-24 | | | |
| | | StrelaStealer | [] | win.strelastealer | [] | 2025-10-15 | | | |
| | | Stresspaint | [] | win.stresspaint | [] | 2025-07-21 | | | |
| | | StrifeWater RAT | [] | win.strifewater_rat | ['MosesStaff'] | 2023-12-04 | | | |
| | | StrikeSuit Gift | [] | win.strikesuit_gift | ['APT32'] | 2023-09-11 | | | |
| | | StrongPity | [] | win.strongpity | ['PROMETHIUM', 'StrongPity'] | 2023-06-09 | | | |
| | | Stuxnet | [] | win.stuxnet | [] | 2023-10-05 | | | |
| | | Subzero | ['Corelump', 'Jumplump'] | win.subzero | ['Denim Tsunami'] | 2026-01-16 | | | |
| | | SunCrypt | [] | win.suncrypt | [] | 2023-06-09 | | | |
| | | SunOrcal | [] | win.sunorcal | [] | 2017-11-21 | | | |
| | | SUPERNOVA | [] | win.supernova | [] | 2023-10-05 | | | |
| | | Supper | ['SocksShell', 'ZAPCAT'] | win.supper | ['Vanilla Tempest'] | 2026-02-25 | | | |
| | | SuppoBox | ['Bayrob', 'Nivdort', 'pizd'] | win.suppobox | [] | 2024-05-17 | | | |
| | | SVCReady | [] | win.svcready | [] | 2023-06-09 | | | |
| | | swen | [] | win.swen | [] | 2019-07-31 | | | |
| | | Sword | [] | win.sword | ['Comment Crew'] | 2018-02-13 | | | |
| | | sykipot | ['getkys', 'Wkysol'] | win.sykipot | ['Samurai Panda'] | 2022-03-07 | | | |
| | | SyncCrypt | [] | win.synccrypt | [] | 2017-09-14 | | | |
| | | Sync-Scheduler | [] | win.sync_scheduler | [] | 2025-01-15 | | | |
| | | SynFlooder | [] | win.synflooder | ['Cleaver'] | 2017-05-21 | | | |
| | | Sys10 | [] | win.sys10 | ['Naikon'] | | | | |
| | | Syscon | [] | win.syscon | [] | 2020-02-04 | | | |
| | | SysGet | [] | win.sysget | ['DragonOK'] | 2021-04-29 | | | |
| | | SysJoker | [] | win.sysjoker | [] | 2024-01-05 | | | |
| | | Sysraw Stealer | ['Clipsa'] | win.sysraw_stealer | [] | 2019-08-07 | | | |
| | | SystemBC | ['Coroxy', 'DroxiDat'] | win.systembc | ['Vanilla Tempest'] | 2025-09-23 | | | |
| | | T34loader | [] | win.t34loader | [] | 2024-02-02 | | | |
| | | TabMsgSQL | [] | win.tabmsgsql | ['Comment Crew'] | 2018-02-13 | | | |
| | | taidoor | ['simbot'] | win.taidoor | [] | 2022-03-07 | | | |
| | | TAINTEDSCRIBE | [] | win.taintedscribe | [] | 2020-06-23 | | | |
| | | Taleret | [] | win.taleret | [] | 2018-02-10 | | | |
| | | Tandfuy | [] | win.tandfuy | [] | 2018-07-24 | | | |
| | | Tapaoux | [] | win.tapaoux | ['DarkHotel'] | 2018-05-03 | | | |
| | | TargetCompany | ['Fargo', 'Mallox', 'Tohnichi'] | win.targetcompany | [] | 2025-04-25 | | | |
| | | Tarsip | [] | win.tarsip | ['Comment Crew'] | 2018-02-10 | | | |
| | | Taurus Stealer | [] | win.taurus_stealer | [] | 2023-08-07 | | | |
| | | TClient | ['FIRESHADOW'] | win.tclient | ['Pirate Panda'] | 2020-06-05 | | | |
| | | TelB | [] | win.telb | [] | 2020-09-21 | | | |
| | | TeleBot | [] | win.telebot | ['TeleBots', 'Sandworm'] | 2022-08-25 | | | |
| | | Teleport | [] | win.teleport | ['TA505'] | 2022-12-12 | | | |
| | | TelePowerBot | [] | win.telepowerbot | [] | 2026-02-03 | | | |
| | | TellYouThePass | [] | win.tellyouthepass | [] | 2023-06-09 | | | |
| | | Tempedreve | [] | win.tempedreve | [] | 2016-04-20 | | | |
| | | TempStealer | [] | win.temp_stealer | [] | 2022-11-21 | | | |
| | | Tendyron | [] | win.tendyron_dropper | ['TA410'] | 2025-10-15 | | | |
| | | Tenzor | [] | win.tenzor | [] | 2026-04-09 | | | |
| | | Terminator RAT | ['Fakem RAT'] | win.terminator_rat | [] | 2018-01-21 | | | |