[gnu8]

I think it is chiefly used by malware developers at this time.

[ADSstreamsthrow]

It's used widely by popular applications (Adobe / Microsoft software products).

[mst]

Which are, in my experience, more ransomware than malware.

[makomk]

To be fair, it's also used by DRM schemes and those aren't technically malware as such.