Threat Feed | Online Malware Sandbox

Windows Exe (x86-64)

file.exe

malicious

SHA256: bd7245522ba1de1a91f39588b5a9bd7d5fe947accaa0af28af138935b415e36d

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Vidar configuration was extracted

3/5

Uses HTTP to upload a large amount of data

3/5

Tries to evade debugger

3/5

Tries to open an unusually high number of parallel network connections

2/5

Delays execution

2/5

Tries to detect analyzer sandbox

1/5

Creates mutex

1/5

Queries system time

1/5

Tries to detect debugger

1/5

Unusual large memory allocation

1/5

Enumerates running processes

1/5

Resolves API functions dynamically

Spyware

w6xZQ2pYVl2lWqYc.exe

2026-09-01T03:46:48.234

Windows Exe (x86-32)

w6xZQ2pYVl2lWqYc.exe

malicious

SHA256: 47bdb3513d6a5808607e2056cfd21b453fcca5d5beee85fab4f9fcdafdaf64c6

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections shows multiple input capture behaviors

3/5

Injects a file into another process

3/5

Obscures a file's origin

3/5

Performs DNS request for known DDNS domain

3/5

Monitors keyboard input

2/5

Hides files

2/5

Collects BIOS properties

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Schedules task

2/5

Disables a system tool

1/5

Modifies operating system directory

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Creates mutex

1/5

Queries system time

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Tries to connect using an uncommon port

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Query OS Information

Spyware

https://flatmountain.co.za/SpryAssets/upongoal/alldoo.html

2026-09-01T03:38:11.121

URL

https://flatmountain.co.za/SpryAssets/upongoal/alldoo.html

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

TelegramPhishkit configuration was extracted

5/5

Combination of other detections indicates a phishing website

5/5

Malicious content matched by YARA rules

4/5

Malicious host or URL detected via reputation

4/5

Phishing page detected via Machine Learning

4/5

Malicious content matched by YARA rules

3/5

Sends data via a Telegram bot

1/5

Page presents itself as a logon page

1/5

Loads resources from a public service

1/5

Checks external IP address

1/5

Logon form detected via Computer Vision

1/5

Page secured via a Domain Validated SSL certificate

1/5

Page contains a form with unusual text spacing

Phishing

64a9ab0128ae49ec44ce91019fedecd5676372564f84455b9c55215a8f31bbbd.exe

2026-09-01T03:33:32.242

Windows Exe (x86-64)

64a9ab0128ae49ec44ce91019fedecd5676372564f84455b9c55215a8f31bbbd.exe

malicious

SHA256: 64a9ab0128ae49ec44ce91019fedecd5676372564f84455b9c55215a8f31bbbd

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Tries to open an unusually high number of parallel network connections

3/5

Uses HTTP to upload a large amount of data

2/5

Tries to detect analyzer sandbox

2/5

Delays execution

1/5

Resolves API functions dynamically

1/5

Queries system time

1/5

Creates mutex

1/5

Enumerates running processes

1/5

Unusual large memory allocation

Spyware

8c91e9ab5fbeb88473034e12ff9feb159fb367353500bdd471a92dc022ba4c21.exe

2026-09-01T03:29:37.215

Windows Exe (x86-64)

8c91e9ab5fbeb88473034e12ff9feb159fb367353500bdd471a92dc022ba4c21.exe

malicious

SHA256: 8c91e9ab5fbeb88473034e12ff9feb159fb367353500bdd471a92dc022ba4c21

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Tries to open an unusually high number of parallel network connections

3/5

Uses HTTP to upload a large amount of data

2/5

Tries to detect analyzer sandbox

2/5

Delays execution

1/5

Resolves API functions dynamically

1/5

Unusual large memory allocation

1/5

Queries system time

1/5

Creates mutex

1/5

Enumerates running processes

Spyware