Threat Feed
install_s.6.06.exe
2026-09-18T08:21:16.997
malicious
Windows Exe (x86-64)
Close
install_s.6.06.exe
malicious
SHA256:
d6476e0acc5f0a01ae87cdf35575cdff16cf6c81dc8237875944c5580d3b720a
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Masks file extension
4/5
Modifies Windows Defender configuration
4/5
Malicious file detected via reputation
3/5
Modifies native system functions
3/5
Executes code with kernel privileges
2/5
Schedules task
2/5
Tries to detect virtual machine
2/5
Masquerades file extension
2/5
Creates an unusually large number of processes
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Sends control codes to a driver
2/5
Signed executable failed signature validation
1/5
Queries system time
1/5
Executes dropped PE file
1/5
Creates mutex
1/5
Enumerates running processes
1/5
Creates a page with write and execute permissions
1/5
Modifies operating system directory
1/5
Installs system startup script or application
1/5
Creates process with hidden window
1/5
Downloads file
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Loads a dropped DLL
Downloader
Sakse.vbs
2026-09-18T08:21:06.919
malicious
VBScript
Close
Sakse.vbs
malicious
SHA256:
34390fbe982d7473554cc51c4b5d44f5157f2037cc36631d37a2d00f85b022eb
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Remcos configuration was extracted
5/5
Tries to read cached credentials of various applications
5/5
Malicious content matched by YARA rules
5/5
GuLoader configuration was extracted
4/5
Malicious file detected via reputation
4/5
Tries to evade debugger
4/5
Makes unaligned API calls to possibly evade hooking based sandboxes
3/5
Reads sensitive mail data
3/5
Reads sensitive browser data
3/5
Modifies native system functions
2/5
Searches for sensitive mail data
2/5
Searches for sensitive browser data
2/5
Enables process privileges
2/5
Searches for sensitive application data
2/5
Possibly does reconnaissance
2/5
Writes an unusually large amount of data to the registry
2/5
Suspicious content matched by YARA rules
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
CMD started with ambiguous arguments
1/5
Accesses Microsoft Security Software registry keys
Spyware
Backdoor
Downloader
x-8.6-.Sakura
2026-09-18T08:15:14.950
malicious
Linux ELF Executable (x86-64)
Close
x-8.6-.Sakura
malicious
SHA256:
b2e247ce007772e6b47aee8602399dfa3c305cd640d8350da80364ab42532fd4
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Gafgyt configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
1/5
Tries to connect using an uncommon port
1/5
Queries system time
1/5
A monitored process crashed
1/5
Masquerades file extension
1/5
Connects to remote host
Trojan
Bot
miQQWJbxuhUM1fPL.exe
2026-09-18T07:56:07
malicious
Windows Exe (x86-64)
Close
miQQWJbxuhUM1fPL.exe
malicious
SHA256:
560663a46f53fcfafaefaf653d12163d64550389d40c535bfe17919519adb19a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Makes indirect system calls to hide process injection
4/5
Modifies Windows Update configuration
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Modifies Windows Defender configuration
3/5
Disables a crucial system service
2/5
Adds service dependency
2/5
Disables automatic hibernation
2/5
Creates an unusually large number of processes
2/5
Uses Alternate Data Stream (ADS) file attributes
2/5
Deletes file after execution
2/5
Tries to detect virtual machine
1/5
Drops PE file
1/5
Accesses Microsoft Security Software registry keys
1/5
Accesses volumes directly
1/5
Creates a page with write and execute permissions
1/5
Creates process with hidden window
1/5
Modifies operating system directory
1/5
Installs system service
1/5
Queries system time
1/5
Creates mutex
1/5
Enumerates running processes
1/5
URL contains a TLD highly associated with phishing
1/5
Content matched by YARA rules
1/5
Creates an unusually large number of files
Injector
file.exe
2026-09-18T07:47:06.783
malicious
Windows Exe (x86-64)
Close
file.exe
malicious
SHA256:
76979cc667f83afbac30839ad3ec7741a4194ff6d939c5f2f0750919ecee57eb
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Tries to read cached credentials of various applications
4/5
Malicious file detected via reputation
3/5
Uses HTTP to upload a large amount of data
3/5
Modifies native system functions
3/5
Captures clipboard data
2/5
Searches for sensitive mail data
2/5
Suspicious content matched by YARA rules
2/5
Searches for sensitive application data
2/5
Searches for sensitive remote access configuration data
2/5
Searches for sensitive password manager data
2/5
Searches for sensitive browser data
2/5
Searches for cryptocurrency wallet locations
2/5
Searches for sensitive FTP data
2/5
Dead Drop Resolver
1/5
Query CPU Properties
1/5
Possibly does reconnaissance
1/5
Enumerates running processes
1/5
Queries system time
1/5
Reads system data
1/5
Unusual large memory allocation
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Drops PE file
Spyware