Blog.

Hey there! Welcome to the Triage Sandbox blog! It’s Triage Thursday, and we’re excited to share some of the latest and most popular malware families with you.

These updates are designed to make defense a breeze and help you in your quest to hunt down malware out in the wild.

We’d love to hear your thoughts and feedback, so feel free to share! Let’s dive into the latest threats together and explore our detection and configuration extraction to tackle these malware effectively. Happy hunting!

New Families This Week

• Added detection and extraction for OctalynStealer family, Windows stealer
  • OctalynStealer Analysis
    • 250727-kxsegshk6v
    • 250727-kx51kswqy9
• Added detection and extraction for BofametStealer family, Windows stealer
  • BofametStealer Analysis
    • 250725-jsg8aax1es
• Added detection and extraction for GravityRat family, Windows trojan
  • GravityRat Analysis
    • 250727-kvh32ahk6s
    • 250727-kv26xaxtfz
• Added detection for MS SharePoint webshell vulnerability CVE-2025-53770
  • CVE-2025-53770 Analysis
    • 250722-pcbnfswpz8
    • 250721-vghkfssnv4
• Added detection for LunaStealer packaged with Pyinstaller, Windows stealer
  • LunaStealer Analysis
    • 250727-nzkzzahr61
    • 250727-nzczcshr6x
• Added detection for AthenaHTTP, Windows DDoS bot
  • AthenaHTTP Analysis
    • 250717-mh9rbsxyfx
    • 250717-p662fszscv
• Added detection for RedTigerStealer, Windows stealer
  • RedTigerStealer Analysis
    • 250727-kyfr3shk6x
    • 250727-kyke9swqz4
• Added detection for Blitz downloader, Windows downloader and bot
  • Blitz Analysis
    • 250721-grv2msxlw4
    • 250721-grrdfsz1gt
• Added detection for NordDragonScan family, Windows stealer
  • NordDragonScan Analysis
    • 250620-ne16fsxnt2
• Added detection for SharkStealer family, Windows stealer
  • SharkStealer Analysis
    • 250531-acemsagj81
    • 250725-jmk2zsxzft
• Added detection for Ligolo reverse tunneling tool, cross-platform backdoor
  • Ligolo Analysis
    • 250727-phnj7sak3s
    • 250727-phnvzaak3t
• Added detection for DCHSpy, Android surveillanceware
  • DCHSpy Analysis
    • 250727-kwp8qswqy6
• Added detection for KoiVM, virtualizer plugin for ConfuserEx
  • KoiVM Analysis
    • 250727-k4qjgahk7z
    • 250727-k6lnasxvav

Updates for Existing Families

• Updated detection and extraction for Xworm v6.0
  • Xworm Analysis
    • 250714-s4tj5atpz9
    • 250714-x3qt3agl3z
• Updated detection and extraction for Remcos v7.0.0
  • Remcos Analysis
    • 250714-288dhsyvey
    • 250714-nshahacm6w
• Updated detection for STRRAT, Windows stealer
  • STRRAT Analysis
    • 250712-xtdhdafn7x
    • 250714-n627ts1nt7

If you have any feedback, questions, or issues about Triage feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.

You can find us directly through the website, or using the Feedback option on an analysis report page.

Not signed up yet? Head over to tria.ge to register for a free account.