Reactor malware family
Reactor is a malware family tracked by MalwareAnalyzer by Cyble across 4 publicly analyzed samples. First seen 2026-07-26, most recently 2026-07-28. Observed ATT&CK techniques include T1112, T1071.001.
Corpus statistics
- Publicly analyzed samples: 4
- First seen: 2026-07-26
- Last seen: 2026-07-28
- Verdicts: malicious 4
- File types: pe 4
ATT&CK techniques used by Reactor
Extracted command-and-control infrastructure
- 7.0.0.3 - 1 sample
Recent Reactor samples
- virussign.com_2ad0029da9d2630b42953941fd3e7310.vir - malicious (2026-07-28)
- virussign.com_d7bbea88f63b93d102f4c5b63da41bc0.vir - malicious (2026-07-28)
- virussign.com_84c0fa4e761e232073c5e0530fbb9e20.vir - malicious (2026-07-27)
- virussign.com_1e439b45cfb8e0e98507346b34d2aad0.vir - malicious (2026-07-26)
Frequently asked about Reactor
- What is Reactor?
- Reactor is a malware family tracked by MalwareAnalyzer by Cyble across 4 publicly analyzed samples. First seen 2026-07-26, most recently 2026-07-28. Observed ATT&CK techniques include T1112, T1071.001.
- How many Reactor samples have been analyzed?
- MalwareAnalyzer by Cyble holds 4 publicly analyzed samples attributed to Reactor, first seen 2026-07-26 and most recently 2026-07-28. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Reactor use?
- Across our Reactor samples the most frequently observed techniques are T1112 (4), T1071.001 (3). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Reactor use?
- Reactor samples in this corpus are distributed as pe (4).
- Does Reactor use command-and-control infrastructure?
- Yes. 1 distinct command-and-control indicator has been extracted from Reactor samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Reactor malicious?
- 4 of 4 analyzed Reactor samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends