| | | SunOrcal | [] | win.sunorcal | [] | 2017-11-21 | | | |
| | | SUPERNOVA | [] | win.supernova | [] | 2023-10-05 | | | |
| | | Supper | ['SocksShell', 'ZAPCAT'] | win.supper | ['Vanilla Tempest'] | 2026-02-25 | | | |
| | | SuppoBox | ['Bayrob', 'Nivdort', 'pizd'] | win.suppobox | [] | 2024-05-17 | | | |
| | | SVCReady | [] | win.svcready | [] | 2023-06-09 | | | |
| | | swen | [] | win.swen | [] | 2019-07-31 | | | |
| | | Sword | [] | win.sword | ['Comment Crew'] | 2018-02-13 | | | |
| | | sykipot | ['getkys', 'Wkysol'] | win.sykipot | ['Samurai Panda'] | 2022-03-07 | | | |
| | | SyncCrypt | [] | win.synccrypt | [] | 2017-09-14 | | | |
| | | Sync-Scheduler | [] | win.sync_scheduler | [] | 2025-01-15 | | | |
| | | SynFlooder | [] | win.synflooder | ['Cleaver'] | 2017-05-21 | | | |
| | | Sys10 | [] | win.sys10 | ['Naikon'] | | | | |
| | | Syscon | [] | win.syscon | [] | 2020-02-04 | | | |
| | | SysGet | [] | win.sysget | ['DragonOK'] | 2021-04-29 | | | |
| | | SysJoker | [] | win.sysjoker | [] | 2024-01-05 | | | |
| | | Sysraw Stealer | ['Clipsa'] | win.sysraw_stealer | [] | 2019-08-07 | | | |
| | | SystemBC | ['Coroxy', 'DroxiDat'] | win.systembc | ['Vanilla Tempest'] | 2026-06-30 | | | |
| | | T34loader | [] | win.t34loader | [] | 2024-02-02 | | | |
| | | TabMsgSQL | [] | win.tabmsgsql | ['Comment Crew'] | 2018-02-13 | | | |
| | | taidoor | ['simbot'] | win.taidoor | [] | 2022-03-07 | | | |
| | | TAINTEDSCRIBE | [] | win.taintedscribe | [] | 2020-06-23 | | | |
| | | Taleret | [] | win.taleret | [] | 2018-02-10 | | | |
| | | Tandfuy | [] | win.tandfuy | [] | 2018-07-24 | | | |
| | | Tapaoux | [] | win.tapaoux | ['DarkHotel'] | 2018-05-03 | | | |
| | | TargetCompany | ['Fargo', 'Mallox', 'Tohnichi'] | win.targetcompany | [] | 2025-04-25 | | | |
| | | Tarsip | [] | win.tarsip | ['Comment Crew'] | 2018-02-10 | | | |
| | | Taurus Stealer | [] | win.taurus_stealer | [] | 2023-08-07 | | | |
| | | TClient | ['FIRESHADOW'] | win.tclient | ['Pirate Panda'] | 2020-06-05 | | | |
| | | TelB | [] | win.telb | [] | 2020-09-21 | | | |
| | | TeleBot | [] | win.telebot | ['TeleBots', 'Sandworm'] | 2022-08-25 | | | |
| | | Teleport | [] | win.teleport | ['TA505'] | 2022-12-12 | | | |
| | | TelePowerBot | [] | win.telepowerbot | [] | 2026-02-03 | | | |
| | | TellYouThePass | [] | win.tellyouthepass | [] | 2023-06-09 | | | |
| | | Tempedreve | [] | win.tempedreve | [] | 2016-04-20 | | | |
| | | TempStealer | [] | win.temp_stealer | [] | 2022-11-21 | | | |
| | | Tendyron | [] | win.tendyron_dropper | ['TA410'] | 2025-10-15 | | | |
| | | Tenzor | [] | win.tenzor | [] | 2026-04-09 | | | |
| | | Terminator RAT | ['Fakem RAT'] | win.terminator_rat | [] | 2018-01-21 | | | |
| | | Termite | [] | win.termite | [] | 2022-06-27 | | | |
| | | TerraStealer | ['StealerOne', 'SONE', 'Taurus Loader Stealer Module'] | win.terra_stealer | ['VENOM SPIDER', 'FIN6'] | 2025-05-12 | | | |
| | | TeslaCrypt | ['cryptesla'] | win.teslacrypt | [] | 2023-06-09 | | | |
| | | Tetra Loader | [] | win.tetra_loader | [] | 2025-05-26 | | | |
| | | TFlower | [] | win.tflower | [] | 2021-03-04 | | | |
| | | Thanatos | ['Alphabot'] | win.thanatos | [] | 2017-01-05 | | | |
| | | Thanatos Ransomware | [] | win.thanatos_ransom | [] | 2018-07-05 | | | |
| | | ThemeForestRAT | ['TALLSHIP'] | win.theme_forest_rat | ['Lazarus Group'] | 2026-06-02 | | | |
| | | ThreeByte | [] | win.threebyte | ['IXESHE'] | 2017-05-21 | | | |
| | | ThumbThief | [] | win.thumbthief | [] | | | | |
| | | ThunderX | ['Ranzy Locker'] | win.thunderx | [] | 2022-01-24 | | | |
| | | Thunker | [] | win.thunker | [] | 2018-07-24 | | | |
| | | Tidepool | [] | win.tidepool | ['Mirage'] | 2023-01-25 | | | |
| | | TigerLite | [] | win.tigerlite | ['Silent Chollima'] | 2024-08-15 | | | |
| | | Tiger RAT | [] | win.tiger_rat | ['Silent Chollima'] | 2026-06-18 | | | |
| | | tildeb | [] | win.tildeb | ['Equation Group'] | 2021-09-19 | | | |
| | | Tinba | ['Zusy', 'TinyBanker', 'Illi'] | win.tinba | [] | 2022-06-09 | | | |
| | | TinyFluff | [] | win.tinyfluff | [] | 2023-07-12 | | | |
| | | TinyLoader | [] | win.tinyloader | ['Tiny Spider'] | 2020-07-24 | | | |
| | | TinyMet | ['TiniMet'] | win.tinymet | ['Anunak', 'TA505'] | 2023-08-03 | | | |
| | | TinyTurlaNG | ['TTNG'] | win.tinyturla_ng | ['Turla'] | 2024-10-21 | | | |
| | | TinyTyphon | [] | win.tinytyphon | ['Dropping Elephant'] | 2020-04-06 | | | |
| | | TinyTurla | [] | win.tiny_turla | ['Turla'] | 2023-10-05 | | | |
| | | Tiop | [] | win.tiop | [] | 2018-07-24 | | | |
| | | Tmanger | ['LuckyBack'] | win.tmanger | ['TA428'] | 2024-10-15 | | | |
| | | Tofsee | ['Gheg'] | win.tofsee | [] | 2023-10-17 | | | |
| | | TokyoX | [] | win.tokyox | [] | 2022-01-18 | | | |
| | | TOLLBOOTH | ['HijackServer IIS'] | win.tollbooth | [] | 2025-10-22 | | | |
| | | TONEDEAF | [] | win.tonedeaf | ['APT34'] | 2021-04-10 | | | |
| | | TONERJAM | [] | win.tonerjam | [] | 2026-02-25 | | | |
| | | Topinambour | [] | win.topinambour | [] | 2023-04-26 | | | |
| | | Torisma | [] | win.torisma | ['Lazarus Group'] | 2024-11-29 | | | |
| | | TorrentLocker | ['Teerac'] | win.torrentlocker | [] | 2021-09-19 | | | |
| | | TorLoader | [] | win.tor_loader | [] | 2023-07-11 | | | |
| | | TOUCHMOVE | [] | win.touchmove | ['Lazarus Group'] | 2023-11-27 | | | |
| | | TOUGHPROGRESS | ['Calendarwalk'] | win.toughprogress | ['APT41'] | 2026-03-23 | | | |
| | | TransBox | [] | win.transbox | [] | 2023-02-17 | | | |
| | | TreasureHunter | ['huntpos'] | win.treasurehunter | [] | 2018-05-14 | | | |
| | | TriBack Loader | [] | win.triback_loader | [] | 2026-07-24 | | | |
| | | TrickBot | ['Trickster', 'TheTrick', 'TrickLoader'] | win.trickbot | ['TA505', 'UNC1878', 'WIZARD SPIDER'] | 2026-04-22 | | | |
| | | Trochilus RAT | [] | win.trochilus_rat | ['APT31', 'GALLIUM', 'Stone Panda'] | 2022-09-20 | | | |
| | | Troldesh | ['Shade'] | win.troldesh | [] | 2023-05-02 | | | |
| | | Troll Stealer | [] | win.troll_stealer | ['Kimsuky'] | 2024-02-09 | | | |
| | | Tropidoor | [] | win.tropidoor | ['WageMole'] | 2025-10-20 | | | |
| | | Tuoni | [] | win.tuoni | [] | 2024-05-14 | | | |
| | | turian | [] | win.turian | [] | 2023-06-09 | | | |
| | | TurlaRPC | [] | win.turla_rpc | ['Turla'] | 2022-12-01 | | | |
| | | Turla SilentMoon | ['BigBoss', 'Cacao', 'GoldenSky', 'HyperStack'] | win.turla_silentmoon | ['Turla'] | 2022-12-01 | | | |
| | | TURNEDUP | ['Notestuk'] | win.turnedup | ['APT33'] | 2020-08-21 | | | |
| | | TYPEFRAME | [] | win.typeframe | ['Lazarus Group'] | 2023-12-11 | | | |
| | | TypeHash | ['SkinnyD'] | win.typehash | ['Tonto Team'] | 2020-10-08 | | | |
| | | UACMe | ['Akagi'] | win.uacme | [] | 2019-05-17 | | | |
| | | UDPoS | [] | win.udpos | [] | 2019-10-29 | | | |
| | | UFR Stealer | ['Usteal'] | win.ufrstealer | [] | 2019-02-22 | | | |
| | | UnderminerEK | [] | win.underminer_ek | [] | 2022-07-01 | | | |
| | | Unidentified 001 | [] | win.unidentified_001 | [] | 2016-12-29 | | | |
| | | Unidentified 003 | [] | win.unidentified_003 | [] | 2016-12-29 | | | |
| | | Unidentified 006 | [] | win.unidentified_006 | [] | 2016-05-10 | | | |
| | | Unidentified 013 (Korean) | [] | win.unidentified_013_korean_malware | [] | 2017-04-29 | | | |
| | | Unidentified 020 (Vault7) | [] | win.unidentified_020_cia_vault7 | ['Longhorn'] | 2017-05-02 | | | |
| | | Unidentified 023 | [] | win.unidentified_023 | [] | 2017-04-29 | | | |
| | | Unidentified 031 | [] | win.unidentified_031 | [] | 2017-08-22 | | | |