Modified malware family
Modified is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-08-02, most recently 2026-08-10. Observed ATT&CK techniques include T1105.
Corpus statistics
- Publicly analyzed samples: 5
- First seen: 2026-08-02
- Last seen: 2026-08-10
- Verdicts: suspicious 4, malicious 1
- File types: elf 5
ATT&CK techniques used by Modified
- T1105 - 2 samples
Extracted command-and-control infrastructure
- http://upx.sf.net - 4 samples
Recent Modified samples
- 30f45db7e5b98dd497b81f5cc7b86cb252c8113466e6ad7a5dbc436e8d65e4b5.elf - suspicious (2026-08-10)
- 1460d31f0473b71fddf08c397d9cdbad8986b1bef2addbd9e7b9ceeb301280da.elf - suspicious (2026-08-05)
- 098dfef2c9a5aa3abb0f3517184dffef1bfda17cffe8b81aebcfb017d5b24c75.elf - suspicious (2026-08-02)
- 3b520f138b30704f7a94682b10912ccbed47e33a8fe9445ab6c8ca681d3e8bb2.elf - suspicious (2026-08-02)
- 33adb2cf048181b5de75d5dd5c837565a738ebd1350b7953e0dc47a3fb7040fe.elf - malicious (2026-08-02)
Frequently asked about Modified
- What is Modified?
- Modified is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-08-02, most recently 2026-08-10. Observed ATT&CK techniques include T1105.
- How many Modified samples have been analyzed?
- MalwareAnalyzer by Cyble holds 5 publicly analyzed samples attributed to Modified, first seen 2026-08-02 and most recently 2026-08-10. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Modified use?
- Across our Modified samples the most frequently observed techniques are T1105 (2). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Modified use?
- Modified samples in this corpus are distributed as elf (5).
- Does Modified use command-and-control infrastructure?
- Yes. 1 distinct command-and-control indicator has been extracted from Modified samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Modified malicious?
- 1 of 5 analyzed Modified samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends