Threat Feed
a7a50e1b8d87a7874efde8c69b5f36ee6f5f6a21c292b5da0d4b0f1d0e54ef67-dropped.exe
2026-10-20T20:05:26.052
malicious
Windows Exe (x86-32)
Close
a7a50e1b8d87a7874efde8c69b5f36ee6f5f6a21c292b5da0d4b0f1d0e54ef67-dropped.exe
malicious
SHA256:
a7a50e1b8d87a7874efde8c69b5f36ee6f5f6a21c292b5da0d4b0f1d0e54ef67
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Deletes user files
4/5
Malicious file detected via reputation
1/5
Modifies application directory
1/5
Possibly does reconnaissance
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Queries system time
1/5
Timestamp manipulation
1/5
Modifies operating system directory
Wiper
stage1_bef7f2a722bf.sh
2026-10-20T20:00:25.960
malicious
Shell Script
Close
stage1_bef7f2a722bf.sh
malicious
SHA256:
bef7f2a722bf846bc291fc68257e74e0a54384305d259160c607a9cd8daac958
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious content matched by YARA rules
3/5
Suspicious content matched by YARA rules
3/5
Creates an unusually large number of processes
2/5
Suspicious content matched by YARA rules
2/5
Performs DNS request
1/5
Content matched by YARA rules
1/5
Creates hidden file or folder
1/5
Connects to remote host
1/5
Reads system data
Spyware
123.exe
2026-10-20T19:59:48.797
malicious
Windows Exe (x86-64)
Close
123.exe
malicious
SHA256:
55e0883241d3aeda28c2b6849eb4c59fcee224bb6d5c74bb705000599ede02cb
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
XMRig configuration was extracted
4/5
Loads a known vulnerable file
4/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Suspicious file detected via reputation
3/5
Executes code with kernel privileges
2/5
Sets up server that accepts incoming connections
2/5
Sends control codes to a driver
2/5
Creates an unusually large number of processes
2/5
Reads network adapter information
2/5
Schedules task
1/5
Executes dropped PE file
1/5
Queries system time
1/5
Connects to remote host
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Query OS Information
1/5
Unusual large memory allocation
1/5
Performs DNS request
1/5
Drops PE file
1/5
Reads system data
1/5
Content matched by YARA rules
1/5
Enables process privileges
PUA
Miner
AssemblyChange.exe
2026-10-20T19:59:09.078
malicious
Windows Exe (x86-32)
Close
AssemblyChange.exe
malicious
SHA256:
b81f3dd26a7a266b1521108328c7ac7bfd9bd704cdfdd31448045867d3cc0360
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows multiple input capture behaviors
4/5
Malicious file detected via reputation
3/5
Injects a file into another process
3/5
Monitors keyboard input
3/5
Monitors user input
3/5
Tries to detect the presence of antivirus software
3/5
Tries to detect the presence of firewall software
2/5
Queries OS info via WMI
1/5
Creates process with hidden window
1/5
Query OS Information
1/5
Peripheral Device Discovery
1/5
Content matched by YARA rules
1/5
Obfuscates control flow
1/5
Resolves API functions dynamically
1/5
Enables process privileges
1/5
Creates mutex
1/5
Installs system startup script or application
Spyware
ok.exe
2026-10-20T19:58:13.764
malicious
Windows Exe (x86-64)
Close
ok.exe
malicious
SHA256:
1b14962a4a69aeaaa7b4f97ed2b40e6ad12066311cc26314f7b89fecda245956
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
XMRig configuration was extracted
4/5
Malicious content matched by YARA rules
4/5
Loads a known vulnerable file
3/5
Executes code with kernel privileges
3/5
Suspicious file detected via reputation
2/5
Sends control codes to a driver
2/5
Reads network adapter information
2/5
Creates an unusually large number of processes
2/5
Sets up server that accepts incoming connections
1/5
Content matched by YARA rules
1/5
Connects to remote host
1/5
Performs DNS request
1/5
Reads system data
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Enables process privileges
1/5
Unusual large memory allocation
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Query OS Information
1/5
Queries system time
PUA
Miner