RiskTool malware family
RiskTool is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-07-31, most recently 2026-08-04. Observed ATT&CK techniques include T1496.
Corpus statistics
- Publicly analyzed samples: 5
- First seen: 2026-07-31
- Last seen: 2026-08-04
- Verdicts: malicious 5
- File types: elf 5
ATT&CK techniques used by RiskTool
- T1496 - 1 sample
Extracted command-and-control infrastructure
- https://xmrig.com/docs/algorithms - 4 samples
Recent RiskTool samples
- 1a749712883354d7da407004b49ece6ae638a22314ed70a095316429b5c41c22.elf - malicious (2026-08-04)
- libxmrig.so - malicious (2026-07-31)
- libxmrig-mo.so - malicious (2026-07-31)
- libxmrig.so - malicious (2026-07-31)
- xmrig_arm64 - malicious (2026-07-31)
Frequently asked about RiskTool
- What is RiskTool?
- RiskTool is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-07-31, most recently 2026-08-04. Observed ATT&CK techniques include T1496.
- How many RiskTool samples have been analyzed?
- MalwareAnalyzer by Cyble holds 5 publicly analyzed samples attributed to RiskTool, first seen 2026-07-31 and most recently 2026-08-04. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does RiskTool use?
- Across our RiskTool samples the most frequently observed techniques are T1496 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does RiskTool use?
- RiskTool samples in this corpus are distributed as elf (5).
- Does RiskTool use command-and-control infrastructure?
- Yes. 1 distinct command-and-control indicator has been extracted from RiskTool samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is RiskTool malicious?
- 5 of 5 analyzed RiskTool samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends