Threat Feed | Online Malware Sandbox

Windows Exe (x86-64)

file.exe

malicious

SHA256: 8fe83c4ceebaf00bfa977ff415dc067c962f7159c75431a0849d4342e505573c

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections shows multiple input capture behaviors

4/5

Malicious host or URL detected via reputation

4/5

Malicious content matched by YARA rules

3/5

Modifies native system functions

3/5

Uses HTTP to upload a large amount of data

3/5

Takes screenshot

3/5

Tries to detect the presence of antivirus software

3/5

Captures clipboard data

2/5

Query Firmware Information

2/5

Searches for sensitive browser data

2/5

Reads sensitive browser data

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Tries to detect virtual machine

2/5

Suspicious content matched by YARA rules

2/5

Queries a host's domain name

2/5

Makes direct system call to possibly evade hooking based monitoring

1/5

URL contains a TLD highly associated with phishing

1/5

Tries to connect using an uncommon port

1/5

Downloads executable

1/5

Enumerates running processes

1/5

Queries system time

Spyware

Downloader

ubf0NVuIASAIA24X.exe

2026-08-01T20:00:02.158

Windows Exe (x86-32)

ubf0NVuIASAIA24X.exe

malicious

SHA256: 27957a63bb88a66a5b7a9f18ed1a749b6d137b008be8d3ccd629366bc6b73069

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

2/5

Allows invalid SSL certificates

1/5

Drops PE file

1/5

Creates a page with write and execute permissions

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

Ransomware

KHimixgXW3MPiQ6a.exe

2026-08-01T19:58:24.439

Windows Exe (x86-64)

KHimixgXW3MPiQ6a.exe

malicious

SHA256: 19eff9fdfe9d740d5efe5e37fd9152b199acd6e36c1f26b215203074857d065c

VMRay Threat Identifiers

Severity

Operation

5/5

Known malicious mutex name is created

4/5

Malicious file detected via reputation

2/5

Tries to detect virtual machine

1/5

A monitored process crashed

1/5

Resolves API functions dynamically

1/5

Possibly does reconnaissance

1/5

Modifies application directory

1/5

Creates a page with write and execute permissions

Ransomware

XBoul0Rna0M2j1iT.exe

2026-08-01T19:57:38.372

Windows Exe (x86-64)

XBoul0Rna0M2j1iT.exe

malicious

SHA256: 6e2f5ed1031182510ee8a51680f2ac7a92272378bdbbb79888dd13245372b32e

VMRay Threat Identifiers

Severity

Operation

5/5

Known malicious mutex name is created

4/5

Malicious file detected via reputation

2/5

Tries to detect virtual machine

1/5

Possibly does reconnaissance

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

Modifies application directory

1/5

Creates process with hidden window

Ransomware

J7iUafdCzNZLt91Z.exe

2026-08-01T19:57:31.882

Windows Exe (x86-32)

J7iUafdCzNZLt91Z.exe

malicious

SHA256: 71c6a0a8cfb7f15b50b122cac0bb56cbac5af1f324bd03a098f4c5a9c2bbc5f7

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Malicious content matched by YARA rules

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

2/5

Delays execution

2/5

Suspicious content matched by YARA rules

1/5

The binary file was created with a packer

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Queries system time

Trojan

Worm