---
title: "Discussion on \"MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain\" | Hashnode"
description: "Discussion on \"MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain\". TL;DR. The malware sample uses the three-file set Avk.exe, Avk.dll, and AVKTray.dat, deployed from an MSI file downloaded by Browser_Updater.exe. The execution chain starts with DLL sideloading throug"
url: "https://hashnode.com/posts/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain/6a1514eb7d85e6a1af2ff42b"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain](https://bluecyber.hashnode.dev/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain?utm_source=hashnode&utm_medium=feed)

TL;DR. The malware sample uses the three-file set Avk.exe, Avk.dll, and AVKTray.dat, deployed from an MSI file downloaded by Browser\_Updater.exe. The execution chain starts with DLL sideloading throug

May 26 · 35 min read · bluecyber.hashnode.dev  
Updated May 27  
Read the article

-   [#malware](https://hashnode.com/tag/malware)
-   [#malware-analysis](https://hashnode.com/tag/malware-analysis)
-   [#reverse-engineering](https://hashnode.com/tag/reverse-engineering)
-   [#advanced-persistent-threats-apts](https://hashnode.com/tag/advanced-persistent-threats-apts)

## Written by

[Nigmaz](https://hashnode.com/@nigmao)

@nigmao

  
[View profile](https://hashnode.com/@nigmao)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.