Threat Feed
ddiJFGKWztl3qREG.exe
2026-10-23T15:29:51.857
malicious
Windows Exe (x86-32)
Close
ddiJFGKWztl3qREG.exe
malicious
SHA256:
a7a0e57bd732de2415e0c480e620c933aaa30c8a77868a2872fb00c9f1c49e90
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Queries a host's domain name
2/5
Sets up server that accepts incoming connections
2/5
Reads network adapter information
2/5
Delays execution
1/5
Tries to detect application sandbox
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Reads system data
1/5
Queries system time
1/5
Creates a page with write and execute permissions
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
Enables process privileges
1/5
Peripheral Device Discovery
1/5
Connects to remote host
Backdoor
FlashUtil.exe
2026-10-23T15:28:37.756
malicious
Windows Exe (x86-32)
Close
FlashUtil.exe
malicious
SHA256:
7405aaaa0babc1e01a99075aab3f7558df01a622e007a7e8cf147f82a8aec15a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
1/5
Installs system startup script or application
1/5
Drops PE file
1/5
Queries system time
1/5
Executes dropped PE file
FlashUtil.exe
2026-10-23T15:25:24.746
malicious
Windows Exe (x86-32)
Close
FlashUtil.exe
malicious
SHA256:
e1242b7781d6f5534601bb75ded92f31163e440c0fd63cbae93401f440ba846a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
1/5
Installs system startup script or application
1/5
Executes dropped PE file
1/5
Drops PE file
1/5
Queries system time
FlashUtil.exe
2026-10-23T15:24:53.612
malicious
Windows Exe (x86-32)
Close
FlashUtil.exe
malicious
SHA256:
156663ae707e358f6429657548123c85c85afd001c42d920851ed327c9ee214d
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
1/5
Installs system startup script or application
1/5
Drops PE file
1/5
Queries system time
1/5
Executes dropped PE file
cc95a262d34e3e1f8603751d9a8ed06218e8b5fe13b3a1087b07b7df255d4172.exe
2026-10-23T15:24:18.707
malicious
Windows Exe (x86-32)
Close
cc95a262d34e3e1f8603751d9a8ed06218e8b5fe13b3a1087b07b7df255d4172.exe
malicious
SHA256:
22a1fb5cdafc00b1b2d3a5d7d2bb65d2c9b4ef8cd959335051811cd32dd21160
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Known malicious mutex name is created
5/5
SalatStealer configuration was extracted
5/5
Combination of other detections shows configuration discovery
5/5
Tries to read cached credentials of various applications
4/5
Malicious file detected via reputation
3/5
Takes screenshot
2/5
Reads sensitive browser data
2/5
Searches for sensitive browser data
2/5
Collects hardware properties
2/5
Sets up server that accepts incoming connections
2/5
Queries OS info via WMI
2/5
Suspicious content matched by YARA rules
2/5
Schedules task
2/5
Reads network adapter information
2/5
Searches for sensitive application data
2/5
Searches for cryptocurrency wallet locations
1/5
Drops PE file
1/5
Reads system data
1/5
Executes dropped PE file
1/5
Content matched by YARA rules
1/5
Timestamp manipulation
1/5
Performs DNS request
1/5
Unusual large memory allocation
1/5
Modifies application directory
1/5
Creates process with hidden window
1/5
Possibly does reconnaissance
1/5
Enumerates running processes
1/5
Tries to detect virtual machine
1/5
Resolves API functions dynamically
1/5
A monitored process crashed
1/5
Queries system time
Spyware