Threat Feed | Online Malware Sandbox

URL

https://securetransfer-x9hs6dlg4jzk.duckdns.org

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

4/5

Combination of other detections indicates the page is malicious

4/5

Phishing page detected via Machine Learning

4/5

Malicious host or URL detected via reputation

2/5

Page uses an invalid certificate

2/5

Performs DNS request for known DDNS domain

1/5

Page contains a form with unusual text spacing

1/5

Loads image resources from another website

Phishing

NTau6vESuxX9gR5m.exe

2026-11-02T08:39:33.548

Windows Exe (x86-64)

NTau6vESuxX9gR5m.exe

malicious

SHA256: 9ae699b69acd4137985546e5670b5a5498bf62048eeab31c96e2e4302d92a761

VMRay Threat Identifiers

Severity

Operation

5/5

Known malicious mutex name is created

4/5

Malicious file detected via reputation

2/5

Tries to detect virtual machine

1/5

Possibly does reconnaissance

1/5

Creates a page with write and execute permissions

1/5

Modifies application directory

1/5

Resolves API functions dynamically

1/5

Queries system time

Ransomware

BP1YdVotMaFKHU9E.exe

2026-11-02T08:39:15.775

Windows Exe (x86-32)

BP1YdVotMaFKHU9E.exe

malicious

SHA256: fd88302fe66e10941052f322d2682243c41bb29d0ff19282ff15c1b6acbaaf2c

VMRay Threat Identifiers

Severity

Operation

5/5

Tries to read default login credentials

4/5

Malicious file detected via reputation

3/5

All network connection attempts failed

2/5

Suspicious content matched by YARA rules

2/5

Delays execution

2/5

Searches for sensitive mail data

2/5

Sets up server that accepts incoming connections

2/5

Disables a system tool

1/5

The binary file was created with a packer

1/5

Installs system startup script or application

1/5

Peripheral Device Discovery

1/5

Executes dropped PE file

1/5

Drops PE masquerading Filename

1/5

Installs system service

1/5

Enables process privileges

1/5

Possibly does reconnaissance

1/5

Modifies application directory

1/5

Drops PE file

1/5

Modifies operating system directory

1/5

Enumerates running processes

1/5

Query OS Information

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Resolves API functions dynamically

1/5

Queries system time

0c0jhd3PByjSeAC4.exe

2026-11-02T08:38:46.596

Windows Exe (x86-64)

0c0jhd3PByjSeAC4.exe

malicious

SHA256: 6b4c6840192149f83fc53d1d71f713a6c8fea760a83e67d60c2ca12f219426fb

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

2/5

Creates an unusually large number of processes

1/5

Creates process with hidden window

1/5

Resolves API functions dynamically

1/5

Creates an unusually large number of files

1/5

Drops PE file

1/5

Creates mutex

1/5

Executes dropped PE file

1/5

Queries system time

1/5

Modifies operating system directory

PUA

Miner

rehKQSW4xar2Hn8B.exe

2026-11-02T08:35:43.828

Windows Exe (x86-32)

rehKQSW4xar2Hn8B.exe

malicious

SHA256: 0ceaec7e3b2ad84bb774fb07503d0a3c6bb56e4e502340a6e1c4fb1b7f15f3f7

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections shows multiple input capture behaviors

5/5

Remcos configuration was extracted

5/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

4/5

Known malicious mutex name is opened

3/5

Captures clipboard data

3/5

Monitors keyboard input

2/5

Delays execution

1/5

Queries system time

1/5

Tries to detect virtual machine

1/5

Query OS Information

1/5

Creates mutex

Spyware

Backdoor