Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

flUUUn5ZdQvTUNpS.exe

malicious

SHA256: 84cfa986f2d49c91ab85d7a890c60f479bedcfbdc74191221937fda14e52b8a9

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

2/5

Signed executable failed signature validation

Backdoor

Trojan

08kPkW7P7TYUiQnn.exe

2025-12-02T12:04:10.378

Windows Exe (x86-64)

08kPkW7P7TYUiQnn.exe

malicious

SHA256: 5d96c5b85cbaa95e7f88138f40a6efcb5ebb989478dc0d659c4f5c6485d670c1

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

XWorm configuration was extracted

3/5

Redirect program startups

1/5

Resolves API functions dynamically

1/5

A monitored process crashed

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Accesses volumes directly

1/5

Modifies application directory

1/5

Possibly does reconnaissance

Spyware

MN1lHeaYQtpw0KcJ.exe

2025-12-02T11:59:48.729

Windows Exe (x86-64)

MN1lHeaYQtpw0KcJ.exe

malicious

SHA256: a80dfaabdc03f9e7e2d0722c34d7b3d530ddc1a9094698361c55cd11205b7c79

VMRay Threat Identifiers

Severity

Operation

5/5

XWorm configuration was extracted

5/5

Malicious content matched by YARA rules

3/5

Redirect program startups

2/5

Signed executable failed signature validation

2/5

Creates a new process from a system binary

2/5

Reads network adapter information

1/5

Connects to remote host

1/5

Query OS Information

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Accesses volumes directly

1/5

Enables process privileges

1/5

Modifies application directory

1/5

Creates mutex

1/5

Installs system startup script or application

1/5

Performs DNS request

Spyware

http://bafybeicakljrcne7ikzpdmshde2j5kof5arq2ywfu3j7vzutwmub32mgrq.ipfs.dweb.link

2025-12-02T11:54:43.446

URL

http://bafybeicakljrcne7ikzpdmshde2j5kof5arq2ywfu3j7vzutwmub32mgrq.ipfs.dweb.link

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Logon form is hosted on a static web hoster

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

3/5

Suspicious content matched by YARA rules

2/5

Contains a mark of the web from a known service

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

Logon form detected via Computer Vision

Phishing

iNEvIBasIVO0f4yr.exe

2025-12-02T11:53:10.240

Windows Exe (x86-32)

iNEvIBasIVO0f4yr.exe

malicious

SHA256: 86683b50b1b6a048694fcd8d1c580c8ba08238c39b1e0417043d3f195929c667

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Allows invalid SSL certificates

1/5

Creates process with hidden window

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Executes dropped PE file

Ransomware