Threat Feed
y5LFKcOMubWm1ydT.exe
2026-10-18T21:13:25.520
malicious
Windows Exe (x86-64)
Close
y5LFKcOMubWm1ydT.exe
malicious
SHA256:
a9b596744c36a8670a775637595f55e4fff00275149775e4d0d8b9cbef3d5e79
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Vidar configuration was extracted
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
2/5
Reads installed applications
2/5
Tries to detect virtual machine
2/5
Signed executable failed signature validation
2/5
Searches for sensitive browser data
2/5
Dead Drop Resolver
2/5
Searches for cryptocurrency wallet locations
2/5
Searches for sensitive mail data
1/5
Query CPU Properties
1/5
Unusual large memory allocation
1/5
Creates mutex
1/5
Queries system time
1/5
Enumerates running processes
1/5
Tries to detect application sandbox
1/5
Query OS Information
1/5
Reads system data
1/5
Peripheral Device Discovery
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
Spyware
uAnPstepOyo7ZBGB.exe
2026-10-18T21:09:27.056
malicious
Windows Exe (x86-64)
Close
uAnPstepOyo7ZBGB.exe
malicious
SHA256:
5e5269d9eee30e84381ae16ac04473bf1c6b115554288b5b602f1839e692164c
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
4/5
Malicious file detected via reputation
2/5
Tries to detect virtual machine
1/5
A monitored process crashed
1/5
Possibly does reconnaissance
1/5
Creates a page with write and execute permissions
1/5
Modifies application directory
1/5
Reads system data
1/5
Resolves API functions dynamically
Ransomware
3z0nzG0ZLUvMcWSu.exe
2026-10-18T21:06:25.079
malicious
Windows Exe (x86-32)
Close
3z0nzG0ZLUvMcWSu.exe
malicious
SHA256:
b1279a52b70e36ba7748e6135116b0e639fa84b61ab29f0e21017b9ff5136495
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
2/5
Delays execution
1/5
Installs system startup script or application
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Modifies operating system directory
1/5
Creates process with hidden window
Spyware
Trojan
pHnNAzqW9Rn0FYOX.exe
2026-10-18T21:05:32.707
malicious
Windows Exe (x86-32)
Close
pHnNAzqW9Rn0FYOX.exe
malicious
SHA256:
26cf5f33b2f9327bfb30b69bfdab517f1d145aaa78ce1728d7d8b288d387d405
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Malicious content matched by YARA rules
5/5
Remcos configuration was extracted
4/5
Known malicious mutex name is opened
4/5
Malicious file detected via reputation
3/5
Captures clipboard data
3/5
Monitors keyboard input
2/5
Delays execution
1/5
Queries system time
1/5
Query OS Information
1/5
Tries to detect virtual machine
1/5
Creates mutex
Spyware
Backdoor
11hNHofDwQ6WjVSn.exe
2026-10-18T21:03:12.026
malicious
Windows Exe (x86-64)
Close
11hNHofDwQ6WjVSn.exe
malicious
SHA256:
7ed303bd2da6a523dd839dcb632c37981977595cca8820161963d041391ea778
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
4/5
Malicious file detected via reputation
2/5
Searches for sensitive password manager data
2/5
Tries to detect virtual machine
2/5
Searches for sensitive browser data
2/5
Searches for sensitive remote access configuration data
2/5
Suspicious content matched by YARA rules
2/5
Delays execution
2/5
Searches for sensitive mail data
1/5
Resolves API functions dynamically
1/5
Reads system data
1/5
Tries to detect debugger
1/5
Creates a page with write and execute permissions
1/5
Content matched by YARA rules
1/5
Possibly does reconnaissance
1/5
Modifies application directory
Ransomware