Hematite malware family
Hematite is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-08-07, most recently 2026-08-11. Observed ATT&CK techniques include T1105, T1112.
Corpus statistics
- Publicly analyzed samples: 2
- First seen: 2026-08-07
- Last seen: 2026-08-11
- Verdicts: malicious 1, suspicious 1
- File types: pe 2
ATT&CK techniques used by Hematite
Recent Hematite samples
- virussign.com_865deb767909959516d499cde20dfa20.vir - malicious (2026-08-11)
- 483b322982e7f2148700009ab2594917d0a79dda747c7a212210f3a39007b92d - suspicious (2026-08-07)
Frequently asked about Hematite
- What is Hematite?
- Hematite is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-08-07, most recently 2026-08-11. Observed ATT&CK techniques include T1105, T1112.
- How many Hematite samples have been analyzed?
- MalwareAnalyzer by Cyble holds 2 publicly analyzed samples attributed to Hematite, first seen 2026-08-07 and most recently 2026-08-11. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Hematite use?
- Across our Hematite samples the most frequently observed techniques are T1105 (1), T1112 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Hematite use?
- Hematite samples in this corpus are distributed as pe (2).
- Is Hematite malicious?
- 1 of 2 analyzed Hematite samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends