| | | Wslink | ['FinickyFrogfish'] | win.wslink | [] | 2022-03-30 | | | |
| | | X-Agent | ['splm', 'chopstick'] | win.xagent | ['APT28'] | 2026-03-11 | | | |
| | | XBot POS | [] | win.xbot_pos | [] | 2017-09-14 | | | |
| | | XBTL | [] | win.xbtl | [] | 2016-05-10 | | | |
| | | XDSpy | [] | win.xdspy | [] | 2025-06-23 | | | |
| | | XenArmor | ['XenArmor Suite'] | win.xenarmor | [] | 2023-05-10 | | | |
| | | X-Files Stealer | [] | win.xfilesstealer | [] | 2023-12-04 | | | |
| | | XFSADM | [] | win.xfsadm | [] | 2019-07-12 | | | |
| | | XFSCashNCR | [] | win.xfscashncr | [] | 2019-10-04 | | | |
| | | Xiangoop | [] | win.xiangoop | [] | 2024-10-23 | | | |
| | | XiaoBa | [] | win.xiaoba | [] | 2020-03-19 | | | |
| | | Xorist | [] | win.xorist | [] | 2023-06-09 | | | |
| | | Xpan | [] | win.xpan | ['TeamXRat'] | 2017-02-15 | | | |
| | | XpertRAT | [] | win.xpertrat | [] | 2023-06-09 | | | |
| | | xsPlus | ['nokian'] | win.xsplus | ['Naikon'] | | | | |
| | | XTinyLoader | [] | win.xtinyloader | [] | 2025-09-09 | | | |
| | | XTunnel | ['Shunnael', 'X-Tunnel', 'xaps'] | win.xtunnel | ['APT28'] | 2026-03-11 | | | |
| | | xxmm | ['ShadowWalker'] | win.xxmm | ['Tick'] | 2021-03-02 | | | |
| | | Yahoyah | ['KeyBoy'] | win.yahoyah | ['Pirate Panda'] | 2017-02-15 | | | |
| | | Yakuza | ['Teslarvng Ransomware'] | win.yakuza_ransomware | [] | 2020-03-27 | | | |
| | | Yanluowang | ['Dryxiphia'] | win.yanluowang | [] | 2023-06-09 | | | |
| | | YaRAT | [] | win.yarat | ['APT31'] | 2022-08-15 | | | |
| | | yayih | ['bbsinfo', 'aumlib'] | win.yayih | [] | 2018-09-19 | | | |
| | | YiBackdoor | [] | win.yibackdoor | [] | 2025-09-24 | | | |
| | | Ymir | [] | win.ymir | [] | 2025-03-21 | | | |
| | | Yoddos | [] | win.yoddos | [] | 2019-07-12 | | | |
| | | Yokai | [] | win.yokai | ['MUSTANG PANDA'] | 2025-09-23 | | | |
| | | YoreKey | [] | win.yorekey | ['Kimsuky'] | 2021-12-15 | | | |
| | | YoungLotus | ['DarkShare'] | win.younglotus | [] | 2018-05-28 | | | |
| | | yty | [] | win.yty | ['APT-C-35', 'Donot Team', 'Viceroy Tiger'] | 2022-01-18 | | | |
| | | ZarDoor | [] | win.zardoor | [] | 2024-03-04 | | | |
| | | Zebrocy | ['Zekapab'] | win.zebrocy | ['APT28'] | 2024-07-10 | | | |
| | | Zedhou | [] | win.zedhou | [] | 2018-07-24 | | | |
| | | zenar | [] | win.zenar | [] | 2021-05-11 | | | |
| | | Zeoticus | [] | win.zeoticus | [] | 2021-02-04 | | | |
| | | GhostSocks | [] | win.ghostsocks | [] | 2026-05-05 | | | |
| | | Ghost RAT | ['Farfli', 'Gh0st RAT', 'PCRat'] | win.ghost_rat | ['EMISSARY PANDA', 'Hurricane Panda', 'Lazarus Group', 'Leviathan', 'Red Menshen', 'Stone Panda'] | 2026-01-27 | | | |
| | | GhostSecret | [] | win.ghost_secret | ['Lazarus Group'] | 2023-02-27 | | | |
| | | Gibberish | [] | win.gibberish | [] | 2020-03-22 | | | |
| | | GIFTEDCROOK | [] | win.giftedcrook | ['UAC-0226'] | 2026-01-26 | | | |
| | | Glasses | ['Wordpress Bruteforcer'] | win.glasses | [] | 2016-12-29 | | | |
| | | GlassRAT | [] | win.glassrat | [] | 2018-03-26 | | | |
| | | GlitchPOS | [] | win.glitch_pos | [] | 2019-03-13 | | | |
| | | Global | ['GLOBAL GROUP'] | win.global | [] | 2025-09-23 | | | |
| | | GlobeImposter | ['Fake Globe'] | win.globeimposter | [] | 2023-03-20 | | | |
| | | GlooxMail | [] | win.glooxmail | ['Comment Crew'] | 2018-02-13 | | | |
| | | Glupteba | [] | win.glupteba | [] | 2026-05-18 | | | |
| | | Godzilla Loader | [] | win.godzilla_loader | [] | 2024-02-15 | | | |
| | | Goggles | [] | win.goggles | ['Comment Crew'] | 2018-02-10 | | | |
| | | GOLDBACKDOOR | [] | win.goldbackdoor | ['APT37'] | 2023-10-02 | | | |
| | | GoldenSpy | [] | win.goldenspy | [] | 2026-02-25 | | | |
| | | GoldDragon | ['Lovexxx'] | win.gold_dragon | [] | 2022-02-10 | | | |
| | | GooPic Drooper | [] | win.goopic | [] | 2018-01-25 | | | |
| | | GooseEgg | [] | win.gooseegg | ['APT28'] | 2024-05-21 | | | |
| | | GootKit | ['Waldek', 'Xswkit', 'talalpek'] | win.gootkit | [] | 2025-11-13 | | | |
| | | Gophe | [] | win.gophe | [] | 2020-10-05 | | | |
| | | Gopuram | [] | win.gopuram | ['Lazarus Group'] | 2023-04-08 | | | |
| | | GoToHTTP | [] | win.gotohttp | [] | 2025-12-17 | | | |
| | | GovRAT | [] | win.govrat | [] | 2018-04-20 | | | |
| | | GPCode | [] | win.gpcode | [] | 2018-02-09 | | | |
| | | GrabBot | [] | win.grabbot | [] | 2017-03-28 | | | |
| | | Graftor | ['MewsSpy'] | win.graftor | [] | 2023-09-28 | | | |
| | | Grager | [] | win.grager | [] | 2024-11-11 | | | |
| | | GRAPELOADER | [] | win.grapeloader | ['APT29'] | 2025-04-16 | | | |
| | | GraphDrop | ['GraphicalProton', 'SPICYBEAT'] | win.graphdrop | ['APT29'] | 2024-01-24 | | | |
| | | GraphicalNeutrino | ['SNOWYAMBER'] | win.graphical_neutrino | ['APT29'] | 2023-07-28 | | | |
| | | Graphican | [] | win.graphican | ['APT15'] | 2023-09-08 | | | |
| | | Graphite | [] | win.graphite | ['APT28'] | 2023-11-14 | | | |
| | | GraphSteel | [] | win.graphsteel | [] | 2023-07-31 | | | |
| | | Grateful POS | ['FrameworkPOS', 'SCRAPMINT', 'trinity'] | win.grateful_pos | ['Skeleton Spider', 'FIN6'] | 2021-05-31 | | | |
| | | Gratem | [] | win.gratem | [] | 2017-04-06 | | | |
| | | GRAYRABBIT | [] | win.grayrabbit | ['UNC3569'] | 2026-01-28 | | | |
| | | GREASE | [] | win.grease | ['Kimsuky'] | 2023-08-25 | | | |
| | | GreenShaitan | ['eoehttp'] | win.greenshaitan | [] | 2018-04-23 | | | |
| | | GreenDispenser | [] | win.green_dispenser | [] | 2024-08-29 | | | |
| | | GreetingGhoul | [] | win.greetingghoul | [] | 2023-08-03 | | | |
| | | GreyEnergy | [] | win.grey_energy | ['GreyEnergy', 'TeleBots'] | 2025-11-25 | | | |
| | | GRILLMARK | ['Hellsing Backdoor'] | win.grillmark | ['Hellsing', 'Leviathan'] | 2021-02-06 | | | |
| | | GRIMAGENT | [] | win.grimagent | ['UNC1878'] | 2021-10-08 | | | |
| | | GrimPlant | [] | win.grimplant | [] | 2023-02-27 | | | |
| | | GROK | [] | win.grok | ['Equation Group'] | 2022-05-23 | | | |
| | | GroundPeony | [] | win.ground_peony | [] | 2024-02-02 | | | |
| | | gsecdump | [] | win.gsecdump | [] | 2018-04-17 | | | |
| | | GSpy | [] | win.gspy | [] | 2023-11-28 | | | |
| | | GTPDOOR | [] | win.gtpdoor | ['LightBasin'] | 2024-03-04 | | | |
| | | GUIDLOADER | [] | win.guidloader | [] | 2025-04-25 | | | |
| | | GUP Proxy Tool | [] | win.gup_proxy | [] | 2019-08-07 | | | |
| | | H1N1 Loader | [] | win.h1n1 | [] | 2016-12-27 | | | |
| | | HackBrowserData | [] | win.hackbrowserdata | [] | 2024-03-28 | | | |
| | | Hacksfase | [] | win.hacksfase | ['Comment Crew'] | 2018-02-13 | | | |
| | | HALFRIG | [] | win.halfrig | ['APT29'] | 2023-06-01 | | | |
| | | Hamweq | [] | win.hamweq | [] | 2026-02-25 | | | |
| | | Hancitor | ['Chanitor'] | win.hancitor | [] | 2022-08-22 | | | |
| | | HARDRAIN | [] | win.hardrain | ['Lazarus Group'] | 2020-03-11 | | | |
| | | Harnig | ['Piptea'] | win.harnig | [] | 2018-01-22 | | | |
| | | Havex RAT | [] | win.havex_rat | ['Energetic Bear'] | 2022-03-25 | | | |
| | | Havoc | ['Havokiz'] | win.havoc | [] | 2026-05-08 | | | |
| | | HAWKBALL | [] | win.hawkball | [] | 2019-07-10 | | | |
| | | Hawking | [] | win.hawking | ['OilRig'] | 2025-06-16 | | | |
| | | HazyLoad | [] | win.hazy_load | [' Silent Chollima'] | 2023-12-15 | | | |