| | | WarLock | [] | win.warlock | [] | 2025-08-20 | | | |
| | | WarmCookie | ['Badspace', 'Carrotstick', 'QUICKBIND'] | win.warmcookie | [] | 2025-11-25 | | | |
| | | WastedLoader | [] | win.wastedloader | [] | 2022-07-01 | | | |
| | | WastedLocker | [] | win.wastedlocker | [] | 2026-05-05 | | | |
| | | WaterMiner | [] | win.waterminer | [] | 2018-08-01 | | | |
| | | WaterSpout | [] | win.waterspout | ['IXESHE'] | 2017-05-21 | | | |
| | | WebbyTea | [] | win.webbytea | ['Lazarus Group'] | 2025-09-15 | | | |
| | | WebC2-AdSpace | [] | win.webc2_adspace | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Ausov | [] | win.webc2_ausov | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Bolid | [] | win.webc2_bolid | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Cson | [] | win.webc2_cson | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-GreenCat | [] | win.webc2_greencat | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Head | [] | win.webc2_head | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Kt3 | [] | win.webc2_kt3 | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Qbp | [] | win.webc2_qbp | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Rave | [] | win.webc2_rave | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-Table | [] | win.webc2_table | ['Comment Crew'] | 2018-02-13 | | | |
| | | WebC2-UGX | [] | win.webc2_ugx | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebC2-Yahoo | [] | win.webc2_yahoo | ['Comment Crew'] | 2018-02-10 | | | |
| | | WebMonitor RAT | ['RevCode'] | win.webmonitor | [] | 2020-11-19 | | | |
| | | WhiskerSpy | [] | win.whiskerspy | [] | 2023-02-24 | | | |
| | | WhisperGate | ['PAYWIPE'] | win.whispergate | [] | 2026-01-05 | | | |
| | | WhiteBird | [] | win.whitebird | [] | 2020-10-02 | | | |
| | | WhiteBlackCrypt | ['WARYLOOK'] | win.whiteblackcrypt | [] | 2022-03-07 | | | |
| | | WinDealer | [] | win.windealer | [] | 2023-12-27 | | | |
| | | WinInetLoader | ['LIDSHOT'] | win.wininetloader | ['Lazarus Group'] | 2025-09-15 | | | |
| | | WinorDLL64 | [] | win.winordll64 | ['Lazarus Group'] | 2023-02-27 | | | |
| | | Winos | [] | win.winos | ['Void Arachne'] | 2026-01-19 | | | |
| | | Winsloader | [] | win.winsloader | ['Pirate Panda'] | | | | |
| | | Wipbot | ['Epic', 'Tavdig'] | win.wipbot | ['Turla'] | 2024-12-11 | | | |
| | | WMI Ghost | ['Wimmie', 'Syndicasec'] | win.wmighost | ['Thrip'] | 2018-06-22 | | | |
| | | WmRAT | [] | win.wm_rat | ['HAZY TIGER'] | 2025-06-05 | | | |
| | | WndTest | [] | win.wndtest | ['Cleaver'] | 2017-05-21 | | | |
| | | Wonknu | [] | win.wonknu | [] | 2022-07-29 | | | |
| | | woody | [] | win.woody | [] | 2018-04-26 | | | |
| | | Woody RAT | [] | win.woodyrat | [] | 2022-08-05 | | | |
| | | Woolger | ['WoolenLogger'] | win.woolger | ['Rocket Kitten'] | 2022-04-29 | | | |
| | | WORMHOLE | [] | win.wormhole | ['Lazarus Group'] | 2023-08-14 | | | |
| | | WpBruteBot | [] | win.wpbrutebot | [] | 2020-09-23 | | | |
| | | WSCSPL | [] | win.wscspl | ['Dropping Elephant'] | 2022-01-03 | | | |
| | | Wslink | ['FinickyFrogfish'] | win.wslink | [] | 2022-03-30 | | | |
| | | X-Agent | ['splm', 'chopstick'] | win.xagent | ['APT28'] | 2026-03-11 | | | |
| | | XBot POS | [] | win.xbot_pos | [] | 2017-09-14 | | | |
| | | XBTL | [] | win.xbtl | [] | 2016-05-10 | | | |
| | | XDSpy | [] | win.xdspy | [] | 2025-06-23 | | | |
| | | XenArmor | ['XenArmor Suite'] | win.xenarmor | [] | 2023-05-10 | | | |
| | | X-Files Stealer | [] | win.xfilesstealer | [] | 2023-12-04 | | | |
| | | XFSADM | [] | win.xfsadm | [] | 2019-07-12 | | | |
| | | XFSCashNCR | [] | win.xfscashncr | [] | 2019-10-04 | | | |
| | | Xiangoop | [] | win.xiangoop | [] | 2024-10-23 | | | |
| | | XiaoBa | [] | win.xiaoba | [] | 2020-03-19 | | | |
| | | Xorist | [] | win.xorist | [] | 2023-06-09 | | | |
| | | Xpan | [] | win.xpan | ['TeamXRat'] | 2017-02-15 | | | |
| | | XpertRAT | [] | win.xpertrat | [] | 2023-06-09 | | | |
| | | xsPlus | ['nokian'] | win.xsplus | ['Naikon'] | | | | |
| | | XTinyLoader | [] | win.xtinyloader | [] | 2025-09-09 | | | |
| | | XTunnel | ['Shunnael', 'X-Tunnel', 'xaps'] | win.xtunnel | ['APT28'] | 2026-03-11 | | | |
| | | xxmm | ['ShadowWalker'] | win.xxmm | ['Tick'] | 2021-03-02 | | | |
| | | Yahoyah | ['KeyBoy'] | win.yahoyah | ['Pirate Panda'] | 2017-02-15 | | | |
| | | Yakuza | ['Teslarvng Ransomware'] | win.yakuza_ransomware | [] | 2020-03-27 | | | |
| | | Yanluowang | ['Dryxiphia'] | win.yanluowang | [] | 2023-06-09 | | | |
| | | YaRAT | [] | win.yarat | ['APT31'] | 2022-08-15 | | | |
| | | yayih | ['bbsinfo', 'aumlib'] | win.yayih | [] | 2018-09-19 | | | |
| | | YiBackdoor | [] | win.yibackdoor | [] | 2025-09-24 | | | |
| | | Ymir | [] | win.ymir | [] | 2025-03-21 | | | |
| | | Yoddos | [] | win.yoddos | [] | 2019-07-12 | | | |
| | | Yokai | [] | win.yokai | ['MUSTANG PANDA'] | 2025-09-23 | | | |
| | | YoreKey | [] | win.yorekey | ['Kimsuky'] | 2021-12-15 | | | |
| | | YoungLotus | ['DarkShare'] | win.younglotus | [] | 2018-05-28 | | | |
| | | yty | [] | win.yty | ['APT-C-35', 'Donot Team', 'Viceroy Tiger'] | 2022-01-18 | | | |
| | | ZarDoor | [] | win.zardoor | [] | 2024-03-04 | | | |
| | | Zebrocy | ['Zekapab'] | win.zebrocy | ['APT28'] | 2024-07-10 | | | |
| | | Zedhou | [] | win.zedhou | [] | 2018-07-24 | | | |
| | | zenar | [] | win.zenar | [] | 2021-05-11 | | | |
| | | Zeoticus | [] | win.zeoticus | [] | 2021-02-04 | | | |
| | | ZeroAccess | ['Max++', 'Sirefef', 'Smiscer', 'ZAccess'] | win.zeroaccess | [] | 2025-07-24 | | | |
| | | ZeroCleare | [] | win.zerocleare | ['OilRig'] | 2023-01-19 | | | |
| | | ZeroT | [] | win.zerot | [] | 2017-02-04 | | | |
| | | Zeus | ['Zbot'] | win.zeus | [] | 2026-04-22 | | | |
| | | ZeusAction | [] | win.zeus_action | [] | 2021-02-01 | | | |
| | | Zeus MailSniffer | [] | win.zeus_mailsniffer | [] | 2016-12-28 | | | |
| | | Zeus OpenSSL | ['XSphinx'] | win.zeus_openssl | [] | 2020-04-01 | | | |
| | | Zeus Sphinx | [] | win.zeus_sphinx | [] | 2022-09-21 | | | |
| | | ZhCat | [] | win.zhcat | [] | 2018-04-17 | | | |
| | | ZitMo | ['ZeuS-in-the-Mobile'] | win.zitmo | [] | 2021-05-25 | | | |
| | | ZiyangRAT | [] | win.ziyangrat | [] | 2020-05-27 | | | |
| | | Zloader | ['DELoader', 'SILENTNIGHT', 'Terdot'] | win.zloader | [] | 2025-02-25 | | | |
| | | Zlob | [] | win.zlob | [] | 2020-12-14 | | | |
| | | Zumanek | [] | win.zumanek | [] | 2022-01-05 | | | |
| | | Zupdax | [] | win.zupdax | [] | 2022-05-25 | | | |
| | | ZxxZ | ['MuuyDownloader'] | win.zxxz | ['HAZY TIGER'] | 2025-06-05 | | | |
| | | TempStealer | [] | win.temp_stealer | [] | 2022-11-21 | | | |
| | | Tendyron | [] | win.tendyron_dropper | ['TA410'] | 2025-10-15 | | | |
| | | Tenzor | [] | win.tenzor | [] | 2026-04-09 | | | |
| | | Terminator RAT | ['Fakem RAT'] | win.terminator_rat | [] | 2018-01-21 | | | |
| | | Termite | [] | win.termite | [] | 2022-06-27 | | | |
| | | TerraStealer | ['StealerOne', 'SONE', 'Taurus Loader Stealer Module'] | win.terra_stealer | ['VENOM SPIDER', 'FIN6'] | 2025-05-12 | | | |
| | | TeslaCrypt | ['cryptesla'] | win.teslacrypt | [] | 2023-06-09 | | | |
| | | Tetra Loader | [] | win.tetra_loader | [] | 2025-05-26 | | | |
| | | TFlower | [] | win.tflower | [] | 2021-03-04 | | | |