Threat Feed
Avast Antivirus Upgrade.exe
2026-10-11T21:24:19.508
malicious
Windows Exe (x86-32)
Close
Avast Antivirus Upgrade.exe
malicious
SHA256:
b7e09ebf0923f8d67efc1c8690962c63fa9c800812d12b02f3b21db3bb86ebe5
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Event Triggered Execution
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Suspicious content matched by YARA rules
3/5
Modifies native system functions
3/5
Tries to detect the presence of antivirus software
2/5
Collects hardware properties
2/5
Schedules task
2/5
Queries OS info via WMI
1/5
Reads system data
1/5
Query OS Information
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Enables process privileges
1/5
Overwrites code
1/5
Tries to detect virtual machine
1/5
Drops PE file
1/5
Loads a dropped DLL
1/5
Creates process with hidden window
1/5
Creates mutex
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Modifies operating system directory
1/5
Installs system startup script or application
Spyware
aULGiLGwjNqwwPqY.exe
2026-10-11T21:08:09.696
malicious
Windows Exe (x86-64)
Close
aULGiLGwjNqwwPqY.exe
malicious
SHA256:
bfe3100cd93c1ca44c27e98dd9d097bd76f4b086bf74be1f49dbfe8d6bf7133e
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Makes indirect system calls to hide process injection
4/5
Writes into the memory of another process
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Malicious file detected via reputation
3/5
Executable modifies its own file
3/5
Modifies native system functions
2/5
Hides files
2/5
Uses Alternate Data Stream (ADS) file attributes
2/5
Delays execution
2/5
Tries to detect virtual machine
2/5
Schedules task
1/5
Queries system time
1/5
Query OS Information
1/5
Creates process with hidden window
1/5
Enumerates running processes
1/5
Accesses volumes directly
1/5
Drops PE file
1/5
Creates a page with write and execute permissions
1/5
Reads system data
1/5
Connects to remote host
1/5
Downloads file
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Reloads native system libraries
1/5
Executes dropped PE file
1/5
Unusual large memory allocation
Downloader
Injector
L394385050.lnk
2026-10-11T20:40:13.251
malicious
Windows Batch File (Shell Link)
Close
L394385050.lnk
malicious
SHA256:
8bcfc54d04d777962546b69f1afb3843fd6b84c2531a2de5427bebc810058b93
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Modifies operating system directory
4/5
Attempts to connect through HTTP
4/5
Malicious file detected via reputation
2/5
Queries a host's domain name
2/5
Uses system binaries to initiate network connections
1/5
Opens mutex
L270612964.lnk
2026-10-11T20:39:50.135
malicious
Windows Batch File (Shell Link)
Close
L270612964.lnk
malicious
SHA256:
2500adfc688df427fdc85192b1bbbdfa9c80cf14dcf6f8c1a47fa575ee0749c2
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Modifies operating system directory
4/5
Attempts to connect through HTTP
4/5
Malicious file detected via reputation
2/5
Queries a host's domain name
2/5
Uses system binaries to initiate network connections
1/5
Opens mutex
payload_ec00d75b.exe
2026-10-11T20:36:32.948
malicious
Windows Exe (x86-32)
Close
payload_ec00d75b.exe
malicious
SHA256:
ec00d75b13137b4a6ee59c42acb2a49bee8b72092de446f0faa0d3ac487af3a4
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Tries to read cached credentials of various applications
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Remcos configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Modifies control flow of another process
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
3/5
Monitors keyboard input
3/5
Captures clipboard data
3/5
Performs DNS request for known DDNS domain
3/5
Suspicious file detected via reputation
3/5
Injects a file into another process
3/5
Monitors user input
2/5
Searches for sensitive browser data
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Suspicious content matched by YARA rules
2/5
Reads sensitive browser data
2/5
Searches for sensitive application data
2/5
Searches for sensitive mail data
2/5
Reads sensitive mail data
2/5
Delays execution
1/5
Tries to detect virtual machine
1/5
Reads system data
1/5
Performs DNS request
1/5
Enumerates running processes
1/5
Possibly does reconnaissance
1/5
Drops PE file
1/5
Queries system time
1/5
Opens mutex
1/5
Creates process with hidden window
1/5
Tries to detect debugger
1/5
Creates mutex
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Query OS Information
1/5
Creates a page with write and execute permissions
1/5
Enables process privileges
1/5
Resolves API functions dynamically
Spyware
Backdoor
Injector