SBadur malware family
SBadur is a malware family tracked by MalwareAnalyzer by Cyble across 76 publicly analyzed samples. First seen 2026-08-05, most recently 2026-08-16. Observed ATT&CK techniques include T1105, T1112, T1566.002.
Corpus statistics
- Publicly analyzed samples: 76
- First seen: 2026-08-05
- Last seen: 2026-08-16
- Verdicts: malicious 75, suspicious 1
- File types: pdf 76
ATT&CK techniques used by SBadur
Extracted command-and-control infrastructure
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/gapovowumepekegosiza.pdf - 3 samples
- https://cdn-cms.f-static.net/uploads/4365546/normal_5f8712f1274b0.pdf - 2 samples
- https://dutitujazekap.weebly.com/uploads/1/3/0/8/130814390/vigirupiruwovilav.pdf - 2 samples
- https://fijojonibiw.weebly.com/uploads/1/3/2/6/132681787/613a711ec7ef.pdf - 2 samples
- https://genigudepa.weebly.com/uploads/1/3/1/0/131070712/duwivif.pdf - 2 samples
- https://gimejexoxixaza.weebly.com/uploads/1/3/1/8/131872185/monirafulowafix.pdf - 2 samples
- https://guwomenod.weebly.com/uploads/1/3/0/8/130873843/297c0.pdf - 2 samples
- https://jakedekokobara.weebly.com/uploads/1/3/1/3/131381480/7d3707d5d.pdf - 2 samples
- https://keniwuki.weebly.com/uploads/1/3/1/4/131483234/2c029f.pdf - 2 samples
- https://mogilifus.weebly.com/uploads/1/3/0/7/130739831/bosilo_ginasesif.pdf - 2 samples
- https://rakamukomegu.weebly.com/uploads/1/3/2/6/132681656/wajosemimanisonoliro.pdf - 2 samples
- https://vuxozajuje.weebly.com/uploads/1/3/1/3/131379873/debizikirapanas.pdf - 2 samples
- https://balejumefem.weebly.com/uploads/1/3/0/8/130814467/9760646.pdf - 1 sample
- https://batarodev.weebly.com/uploads/1/3/1/3/131380453/61d7ce66.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/837046.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/8e42bfb8d1b0f.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/baputedev.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/lukuxaluk.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/xewuj.pdf - 1 sample
- https://bedizegoresupa.weebly.com/uploads/1/3/1/3/131379398/zanazanekoxel.pdf - 1 sample
Recent SBadur samples
- a467527c6684c.pdf - suspicious (2026-08-16)
- 3067330.pdf - malicious (2026-08-15)
- f26382ce38bd1.pdf - malicious (2026-08-15)
- 8486a8d.pdf - malicious (2026-08-15)
- 1ece1.pdf - malicious (2026-08-14)
- 8118384.pdf - malicious (2026-08-14)
- tagerezupubiji.pdf - malicious (2026-08-14)
- 357a0f.pdf - malicious (2026-08-14)
- xajuxerunuxasi-wexujazawik-xiselibu.pdf - malicious (2026-08-14)
- 3792489.pdf - malicious (2026-08-14)
- samupekawi.pdf - malicious (2026-08-13)
- mekidisinamu.pdf - malicious (2026-08-13)
- 68f148888da839.pdf - malicious (2026-08-13)
- 63123db.pdf - malicious (2026-08-13)
- sutusozupixapu.pdf - malicious (2026-08-12)
- zamiv_tixomutudorasuv.pdf - malicious (2026-08-12)
- vesuropuxinikaluzik.pdf - malicious (2026-08-12)
- 86fe977f2a4403.pdf - malicious (2026-08-10)
- riripitel.pdf - malicious (2026-08-10)
- 8225448.pdf - malicious (2026-08-10)
- fupesoxevigeka.pdf - malicious (2026-08-10)
- 1257824.pdf - malicious (2026-08-10)
- 2022221.pdf - malicious (2026-08-10)
- jinaxuganoka.pdf - malicious (2026-08-10)
Frequently asked about SBadur
- What is SBadur?
- SBadur is a malware family tracked by MalwareAnalyzer by Cyble across 76 publicly analyzed samples. First seen 2026-08-05, most recently 2026-08-16. Observed ATT&CK techniques include T1105, T1112, T1566.002.
- How many SBadur samples have been analyzed?
- MalwareAnalyzer by Cyble holds 76 publicly analyzed samples attributed to SBadur, first seen 2026-08-05 and most recently 2026-08-16. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does SBadur use?
- Across our SBadur samples the most frequently observed techniques are T1105 (57), T1112 (50), T1566.002 (48). Counts are the number of analyzed samples in which each technique was observed.
- What file types does SBadur use?
- SBadur samples in this corpus are distributed as pdf (76).
- Does SBadur use command-and-control infrastructure?
- Yes. 50 distinct command-and-control indicators have been extracted from SBadur samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is SBadur malicious?
- 75 of 76 analyzed SBadur samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends