Threat Feed
Vbkvu1kwZkSQM6f3.exe
2026-11-12T13:08:32.328
malicious
Windows Exe (x86-64)
Close
Vbkvu1kwZkSQM6f3.exe
malicious
SHA256:
7cd2a351bf0f2cb30a144a98c8e903582b83d4ef5116786fb766e221a5d697c2
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Modifies control flow of another process
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
2/5
Peripheral Device Discovery
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Creates mutex
1/5
Queries system time
1/5
Peripheral Device Discovery
1/5
Creates a page with write and execute permissions
1/5
Reads installed applications
1/5
Reads system data
1/5
Content matched by YARA rules
Injector
na
2026-11-12T13:08:09.751
malicious
Linux ELF Executable (x86-64)
Close
na
malicious
SHA256:
bafd5ecf15efa11fabb709ca4aebe4e935e559c03efe17615abd17490bfcced4
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Prometei configuration was extracted
4/5
Malicious file detected via reputation
3/5
All network connection attempts failed
2/5
Modifies network configuration
1/5
Starts a service
1/5
Clones process
Bot
ZwXku3xZHthM5REV.exe
2026-11-12T13:06:55.308
malicious
Windows Exe (x86-32)
Close
ZwXku3xZHthM5REV.exe
malicious
SHA256:
1ad4850899b4d242e02e1c0b2b3fa2e0ef6dca5159638b268c97890aa9616844
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious content matched by YARA rules
4/5
Modifies Windows Defender configuration
3/5
Suspicious content matched by YARA rules
3/5
Bypasses PowerShell execution policy
2/5
Tries to detect virtual machine
2/5
Executes PowerShell with hidden window
2/5
Schedules task
2/5
Collects hardware properties
2/5
Sets up server that accepts incoming connections
2/5
Deletes file after execution
1/5
Creates mutex
1/5
Timestamp manipulation
1/5
Enumerates running processes
1/5
Enables process privileges
1/5
Creates process with hidden window
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
A monitored process crashed
1/5
Drops PE file
1/5
Peripheral Device Discovery
1/5
Loads a dropped DLL
1/5
Queries system time
Spyware
Backdoor
MV_SHINNING_STAR_VESSEL_DETAILS.JS
2026-11-12T12:42:08.650
malicious
JScript
Close
MV_SHINNING_STAR_VESSEL_DETAILS.JS
malicious
SHA256:
9f7e94e416a60164ff66794abe7fdc056f200d4a298f0d414c876f80a78c7364
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Sets up server that accepts incoming connections
5/5
Combination of other detections shows configuration discovery
5/5
Tries to read cached credentials of various applications
5/5
Agent Tesla configuration was extracted
4/5
Uses Alternate Data Stream (ADS) file attributes
4/5
Tries to detect application sandbox
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Reads sensitive browser data
3/5
Reads sensitive mail data
3/5
Suspicious content matched by YARA rules
3/5
Classifies external IP address
2/5
Loads a dropped DLL
2/5
Executes dropped PE file
2/5
Searches for sensitive mail data
2/5
Performs DNS request
2/5
Searches for sensitive browser data
2/5
Suspicious content matched by YARA rules
2/5
Queries OS info via WMI
2/5
Reads network adapter information
2/5
Possibly does reconnaissance
2/5
Collects hardware properties
2/5
Tries to connect using an uncommon port
2/5
Enables process privileges
2/5
Drops PE file
1/5
Reads system data
1/5
Connects to remote host
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
Tries to detect virtual machine
1/5
Timestamp manipulation
1/5
Queries system time
1/5
Query OS Information
1/5
Peripheral Device Discovery
Spyware
Backdoor
Downloader
u2v5.sh
2026-11-12T12:37:43.047
malicious
Shell Script
Close
u2v5.sh
malicious
SHA256:
7598f02268d2311526912a0ea4a3f97590db926c0007de21f597cd68ad78ac74
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Reads ssh keys
4/5
Malicious host or URL detected via reputation
4/5
Malicious content matched by YARA rules
3/5
Creates an unusually large number of processes
3/5
Suspicious file detected via reputation
2/5
Checks for existence of ssh keys
2/5
Performs DNS request
2/5
Enumerates running processes
1/5
Connects to remote host
1/5
Creates hidden file or folder
1/5
Reads system data
PUA
Miner