Caphaw malware family
Caphaw is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-07-30, most recently 2026-08-01. Observed ATT&CK techniques include T1003, T1112, T1555.
Corpus statistics
- Publicly analyzed samples: 2
- First seen: 2026-07-30
- Last seen: 2026-08-01
- Verdicts: malicious 2
- File types: pe 2
ATT&CK techniques used by Caphaw
Recent Caphaw samples
- 766_Win32.Caphaw.Shylock.bin - malicious (2026-08-01)
- f65fa71e8ffe11bb6e7c6c84c3d365f4fe729e1e9c38cb4f073d2b65058465fa - malicious (2026-07-30)
Frequently asked about Caphaw
- What is Caphaw?
- Caphaw is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-07-30, most recently 2026-08-01. Observed ATT&CK techniques include T1003, T1112, T1555.
- How many Caphaw samples have been analyzed?
- MalwareAnalyzer by Cyble holds 2 publicly analyzed samples attributed to Caphaw, first seen 2026-07-30 and most recently 2026-08-01. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Caphaw use?
- Across our Caphaw samples the most frequently observed techniques are T1003 (1), T1112 (1), T1555 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Caphaw use?
- Caphaw samples in this corpus are distributed as pe (2).
- Is Caphaw malicious?
- 2 of 2 analyzed Caphaw samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends