Threat Feed
sjnXflinEcnJaQxO.exe
2026-10-15T21:35:14.386
malicious
Windows Exe (x86-32)
Close
sjnXflinEcnJaQxO.exe
malicious
SHA256:
db7fe16d40f48d9f6a16cbc0371a72e1e4cab918d67fa3dfcf02595fe7af059e
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
2/5
Suspicious content matched by YARA rules
2/5
Allows invalid SSL certificates
2/5
Enables critical process privileges
1/5
Connects to remote host
1/5
URL contains a TLD highly associated with phishing
1/5
Installs system service
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Enables process privileges
1/5
Queries system time
1/5
Enumerates running processes
1/5
Modifies operating system directory
1/5
Creates mutex
1/5
Opens mutex
1/5
Reads system data
1/5
Performs DNS request
Ransomware
JrPoFbieIXT4HghM.exe
2026-10-15T21:34:05.307
malicious
Windows Exe (x86-64)
Close
JrPoFbieIXT4HghM.exe
malicious
SHA256:
e5536bc2a27112ea0aa703382d53ddfcd2c0fbc02f39e97f839c5ce90fa00712
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
4/5
Malicious file detected via reputation
4/5
Malicious content matched by YARA rules
3/5
Bypasses PowerShell execution policy
3/5
Suspicious content matched by YARA rules
2/5
Reads installed applications
2/5
Queries a host's domain name
2/5
Reads network adapter information
2/5
Creates an unusually large number of processes
2/5
Sets up server that accepts incoming connections
2/5
Suspicious content matched by YARA rules
2/5
Executes PowerShell without default profile
2/5
Query OS Information
2/5
Collects hardware properties
2/5
Collects BIOS properties
2/5
Tries to detect virtual machine
2/5
Searches for sensitive browser data
1/5
Tries to detect virtual machine
1/5
Reads from memory of another process
1/5
Queries system time
1/5
Unusual large memory allocation
1/5
Peripheral Device Discovery
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Downloads file
1/5
Reads system data
1/5
Connects to remote host
1/5
Creates process with hidden window
1/5
Resolves API functions dynamically
Downloader
EFpAbQSufWD8tI8w.exe
2026-10-15T21:31:11.544
malicious
Windows Exe (x86-32)
Close
EFpAbQSufWD8tI8w.exe
malicious
SHA256:
f72ba09440fddd7d678b339ccb006b0eceb354cbdf3ce1214ed850f64f7393c8
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Monitors user input
2/5
Delays execution
2/5
Schedules task
2/5
Deletes file after execution
2/5
Searches for sensitive mail data
2/5
Uses Alternate Data Stream (ADS) file attributes
2/5
Searches for sensitive browser data
2/5
Searches for sensitive application data
2/5
Reads sensitive mail data
2/5
Creates an unusually large number of processes
1/5
Queries system time
1/5
Tries to detect debugger
1/5
Creates mutex
1/5
Installs system startup script or application
1/5
Enables process privileges
1/5
Creates process with hidden window
1/5
Reads system data
1/5
Enumerates running processes
1/5
Possibly does reconnaissance
1/5
Content matched by YARA rules
1/5
Executes dropped PE file
1/5
Monitors mouse movements and clicks
1/5
Reads mouse position
Spyware
GlsqSYHRP6Oj3qRZ.exe
2026-10-15T21:30:15.510
malicious
Windows Exe (x86-32)
Close
GlsqSYHRP6Oj3qRZ.exe
malicious
SHA256:
1b577276bcff7f6d90086790a6bff6c0430ee0e448b8b67c19de054d47937723
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
2/5
Allows invalid SSL certificates
1/5
Creates a page with write and execute permissions
1/5
Executes dropped PE file
1/5
Creates process with hidden window
1/5
Resolves API functions dynamically
1/5
Drops PE file
Ransomware
http://49.51.43.12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AQMjQ7QyROPzn0qaqnYvX4_aw7qH8RajahyDV4UI8mo2Mw7SaNi-z6QQG4MH4pDlzJ2gDPTt_nm2&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWt06SR3Hycp-syMzvtotly0XSG4Z0hCXaRSiT9HV6ncztC6IA3G7Wnyd_cXcxz5WjSRnieA8rdL&dsh=S252717598%3A1792092197182571
2026-10-15T21:24:29.395
malicious
URL
Close
http://49.51.43.12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AQMjQ7QyROPzn0qaqnYvX4_aw7qH8RajahyDV4UI8mo2Mw7SaNi-z6QQG4MH4pDlzJ2gDPTt_nm2&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWt06SR3Hycp-syMzvtotly0XSG4Z0hCXaRSiT9HV6ncztC6IA3G7Wnyd_cXcxz5WjSRnieA8rdL&dsh=S252717598%3A1792092197182571
malicious
SHA256:
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections indicates a phishing website
4/5
Malicious host or URL detected via reputation
2/5
Unsecured data
2/5
Branded Logon form detected via Computer Vision
2/5
Page uses exact same title as that of a popular online service
1/5
Branding image detected via Computer Vision
1/5
Page presents itself as a logon page
Phishing