Threat Feed | Online Malware Sandbox

URL

https://ipfs.io/ipfs/bafkreigiaqyfdvhrprhguegff7iwdu2i4kb4nmw2ov65bsft56r7ltx3w4/#redacted@abuse.ionos.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

TelegramPhishkit configuration was extracted

5/5

Logon form is hosted on a static web hoster

4/5

Malicious content matched by YARA rules

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Logon form detected via Computer Vision

1/5

Page presents itself as a logon page

1/5

Page secured via a Domain Validated SSL certificate

1/5

URL contains email address

1/5

Checks external IP address

1/5

Page uses exact favicon of a popular online service

1/5

Loads image resources from another website

Phishing

iSvjOuFceFAqaPLK.exe

2026-04-06T18:18:37.453

Windows Exe (x86-32)

iSvjOuFceFAqaPLK.exe

malicious

SHA256: c97a5e725638433524e5cff28d36090c6eecab5ba20fc525ebc7f9691acde47d

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Suspicious content matched by YARA rules

1/5

Creates a page with write and execute permissions

1/5

Unusual large memory allocation

1/5

Resolves API functions dynamically

Spyware

EtkQKnMAHqYhNeLa.exe

2026-04-06T18:17:29.264

Windows Exe (x86-32)

EtkQKnMAHqYhNeLa.exe

malicious

SHA256: add9a13bff14d2ae6fa09c6c2bed65720bb563a26345c4f9d1291117170f0fa0

VMRay Threat Identifiers

Severity

Operation

5/5

Deletes user files

5/5

Appends new extensions to many filenames

5/5

Malicious content matched by YARA rules

4/5

Uses a double file extension

1/5

Resolves API functions dynamically

1/5

Creates an unusually large number of files

1/5

Creates a page with write and execute permissions

1/5

Drops PE file

1/5

Modifies application directory

1/5

Changes folder appearance

1/5

Possibly does reconnaissance

Ransomware

Wiper

XMct70nZqsnWlbAg.exe

2026-04-06T18:12:51.965

Windows Exe (x86-32)

XMct70nZqsnWlbAg.exe

malicious

SHA256: 54887da30454fa7c9c90a8ebd25f6d6f67f75ce12ed5a5cdce84d6b526603784

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Known malicious mutex name is created

3/5

Modifies native system functions

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

A monitored process crashed

1/5

Drops PE file

1/5

Uncommon PE properties

1/5

The binary file was created with a packer

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Modifies application directory

1/5

Reads from memory of another process

1/5

Tries to detect debugger

Trojan

Virus

49TW6t8buhnQtwsI.exe

2026-04-06T18:12:35.450

Windows Exe (x86-64)

49TW6t8buhnQtwsI.exe

malicious

SHA256: 4ee3be6d338d75f918f9a917357fe129ed354cab03148c09d90f5a77750ba9e9

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

2/5

Creates an unusually large number of processes

1/5

Creates mutex

1/5

Executes dropped PE file

1/5

Modifies operating system directory

1/5

Creates process with hidden window

1/5

Drops PE file

PUA

Hacktool

Miner