Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

winmgmt.exe

malicious

SHA256: 01b4c1807035d2822274cd12d73c6ebe4a8382ab0c68880790af4322cc81151f

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections shows multiple input capture behaviors

5/5

AsyncRAT configuration was extracted

5/5

Malicious content matched by YARA rules

3/5

Monitors keyboard input

1/5

Tries to connect using an uncommon port

1/5

Connects to remote host

1/5

Enables process privileges

1/5

Creates mutex

1/5

Performs DNS request

Spyware

Backdoor

2025-04-26T03:40:02.391

Windows Exe (x86-32)

Da produtora de.exe

malicious

SHA256: 552560c25dccf7dd9d5a491f12f0040c3c5e1e3c025c5023780694ab79d3239c

VMRay Threat Identifiers

Severity

Operation

4/5

Bypasses Windows User Account Control (UAC)

4/5

Tries to disable antivirus software

3/5

Modifies native system functions

3/5

All network connection attempts failed

2/5

Sets up server that accepts incoming connections

1/5

Query CPU Properties

1/5

Resolves API functions dynamically

1/5

Creates process with hidden window

1/5

Modifies application directory

1/5

A monitored process crashed

1/5

Enumerates running processes

1/5

Performs DNS request

1/5

Installs system startup script or application

2025-04-26T03:39:37.995

Windows Exe (x86-32)

Da produtora de.exe

malicious

SHA256: db4fd3ff1052ea04b11f53cd2b15bb24ebf6336647827314691a63d7a8ddfe28

VMRay Threat Identifiers

Severity

Operation

4/5

Bypasses Windows User Account Control (UAC)

4/5

Tries to disable antivirus software

3/5

All network connection attempts failed

3/5

Modifies native system functions

2/5

Sets up server that accepts incoming connections

1/5

Modifies application directory

1/5

Installs system startup script or application

1/5

Query CPU Properties

1/5

Resolves API functions dynamically

1/5

Creates process with hidden window

1/5

Performs DNS request

1/5

Enumerates running processes

2025-04-26T03:39:07.269

Windows Exe (x86-32)

Da produtora de.exe

malicious

SHA256: 0dee19ace77654ff1be2ffcdde7b44e0db7a4852e078d5d3167e9c4c20960f38

VMRay Threat Identifiers

Severity

Operation

4/5

Bypasses Windows User Account Control (UAC)

4/5

Tries to disable antivirus software

3/5

Modifies native system functions

3/5

All network connection attempts failed

2/5

Sets up server that accepts incoming connections

1/5

Query CPU Properties

1/5

Resolves API functions dynamically

1/5

Creates process with hidden window

1/5

Modifies application directory

1/5

A monitored process crashed

1/5

Enumerates running processes

1/5

Performs DNS request

1/5

Installs system startup script or application

2025-04-26T03:38:16.013

Windows Exe (x86-32)

Da produtora de.exe

malicious

SHA256: 5dc34a8b5bf5f1714747f6922b652a173353b80dda7d2017c0dc358a31c54e09

VMRay Threat Identifiers

Severity

Operation

4/5

Bypasses Windows User Account Control (UAC)

4/5

Tries to disable antivirus software

3/5

Modifies native system functions

3/5

All network connection attempts failed

2/5

Sets up server that accepts incoming connections

1/5

Query CPU Properties

1/5

Resolves API functions dynamically

1/5

Creates process with hidden window

1/5

Modifies application directory

1/5

A monitored process crashed

1/5

Enumerates running processes

1/5

Performs DNS request

1/5

Installs system startup script or application