Threat Feed | Online Malware Sandbox

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Branded Logon form detected via Computer Vision

2/5

Page uses exact same title as that of a popular online service

1/5

Branding image detected via Computer Vision

1/5

HTTPS page insecurely loads resources via HTTP

1/5

Content matched by YARA rules

1/5

Page uses exact favicon of a popular online service

1/5

Page presents itself as a logon page

Phishing

8UsA.sh

2026-02-28T20:39:18.669

Shell Script

8UsA.sh

malicious

SHA256: 95cb9542611a439e5e444fc5cfd9f73b85d340be671c18c0b73d70dfee6d8ec1

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Creates an unusually large number of processes

2/5

Downloads file

1/5

Connects to remote host

Bot

5HHDKADxtmfVBXAa.exe

2026-02-28T20:24:57.866

Windows Exe (x86-64)

5HHDKADxtmfVBXAa.exe

malicious

SHA256: e4567ba8f37aa71fa0b0a15f75e5eedfb1c037c954c7c56900bfadd9d19ab526

VMRay Threat Identifiers

Severity

Operation

4/5

Writes into the memory of another process

4/5

Modifies control flow of another process

4/5

Modifies Windows Defender configuration

3/5

Modifies native system functions

2/5

Delays execution

2/5

Schedules task

1/5

Resolves API functions dynamically

1/5

Overwrites code

1/5

Drops PE file

1/5

Creates a page with write and execute permissions

1/5

Executes dropped PE file

1/5

Enumerates running processes

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Creates mutex

1/5

Reads from memory of another process

Injector

hLmfN5PBVMbOHzIL.exe

2026-02-28T20:24:14.132

Windows Exe (x86-64)

hLmfN5PBVMbOHzIL.exe

malicious

SHA256: 070fff141cb4e31878bcbe2d88f214fdb21fa8f59116c6d371650125d87313ee

VMRay Threat Identifiers

Severity

Operation

4/5

Modifies Windows Defender configuration

4/5

Modifies control flow of another process

4/5

Writes into the memory of another process

3/5

Modifies native system functions

2/5

Delays execution

2/5

Schedules task

1/5

Resolves API functions dynamically

1/5

Overwrites code

1/5

Creates mutex

1/5

Enables process privileges

1/5

Creates process with hidden window

1/5

Drops PE file

1/5

Enumerates running processes

1/5

Creates a page with write and execute permissions

1/5

Executes dropped PE file

1/5

Reads from memory of another process

Injector

tmDXn4vZpoywPsk1.exe

2026-02-28T20:23:12.836

Windows Exe (x86-32)

tmDXn4vZpoywPsk1.exe

malicious

SHA256: c2ac2ea41e3f0a8298fb62e4a5c181cb6d66c64452296cc7f437bd21b032ff36

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Combination of other detections shows multiple input capture behaviors

5/5

Remcos configuration was extracted

4/5

Process Hollowing

4/5

Obscures a file's origin

4/5

Monitors clipboard content

4/5

Creates elevated child process

3/5

All network connection attempts failed

3/5

Monitors user input

3/5

Monitors keyboard input

2/5

Deletes file after execution

2/5

Delays execution

2/5

Modifies control flow of a process started from a created or modified executable

2/5

Signed executable failed signature validation

2/5

Searches for sensitive browser data

1/5

Tries to connect using an uncommon port

1/5

Content matched by YARA rules

1/5

Creates a page with write and execute permissions

1/5

Reads from memory of another process

1/5

Enables process privileges

1/5

Drops PE file

1/5

Creates process with hidden window

1/5

Installs system startup script or application

1/5

Executes dropped PE file

1/5

Enumerates running processes

1/5

Query OS Information

1/5

Creates mutex

1/5

Connects to remote host

Spyware

Backdoor

Keylogger

Injector