Threat Feed | Online Malware Sandbox

URL

https://tryjhytyjctfhdrxtse46ysxfgjxfyjfyjxdthtrterrthfhhhfff.weebly.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Content matched by YARA rules

1/5

Communicates via JSON RPC protocol

1/5

Logon form detected via Computer Vision

Phishing

http://49.51.43.12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&amp%3Bifkv=AQMjQ7QyROPzn0qaqnYvX4_aw7qH8RajahyDV4UI8mo2Mw7SaNi-z6QQG4MH4pDlzJ2gDPTt_nm2&amp%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PavvR6zlQMgkcWL8eqJOHkHUY3s8ArRidLhHXTCi1eJHWErD0lErO9_vb9tNk2ukoGhuxz6stA&dsh=S-532950407%3A1779245769693903

2026-05-20T03:38:46.175

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page uses exact same title as that of a popular online service

2/5

Branded Logon form detected via Computer Vision

1/5

Content matched by YARA rules

1/5

HTTPS page insecurely loads resources via HTTP

1/5

Branding image detected via Computer Vision

1/5

Page presents itself as a logon page

Phishing

CvyjNyIu5ZSA1lCy.exe

2026-05-20T03:25:00.362

Windows Exe (x86-32)

CvyjNyIu5ZSA1lCy.exe

malicious

SHA256: 3a63d9f2509175973b706ef3b06169aec90d8a21bd7ab47d22bd5027c605b719

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Remcos configuration was extracted

3/5

Tries to open an unusually high number of parallel network connections

2/5

Delays execution

1/5

Creates mutex

1/5

Connects to remote host

1/5

Performs DNS request

1/5

Query OS Information

Backdoor

HDwjwkV18RyWjKNy.exe

2026-05-20T03:21:06.241

Windows Exe (x86-32)

HDwjwkV18RyWjKNy.exe

malicious

SHA256: 72d25a2b3831e62dd1323bdb6cfefb2f2196157a03e9fab957588e004cbeadb5

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Remcos configuration was extracted

3/5

Tries to open an unusually high number of parallel network connections

2/5

Delays execution

1/5

Creates mutex

1/5

Connects to remote host

1/5

Performs DNS request

1/5

Query OS Information

Backdoor

PO#. 0764PTTHI15.05.2026.pdf.js

2026-05-20T03:16:32.313

JScript

PO#. 0764PTTHI15.05.2026.pdf.js

malicious

SHA256: 3ff6d45c0b4f55e018238a01ffece0b64375c2ae6e36a5327e22cbd30f34ea8e

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Injected process sets up server that accepts incoming connections

5/5

Tries to read cached credentials of various applications

5/5

PhantomStealer configuration was extracted

4/5

Tries to detect the presence of antivirus software

4/5

Process Hollowing

4/5

Reads from memory of another process

4/5

Malicious content matched by YARA rules

4/5

Writes into the memory of another process

3/5

Suspicious content matched by YARA rules

3/5

Reads sensitive mail data

3/5

Bypasses PowerShell execution policy

2/5

Queries OS info via WMI

2/5

Performs DNS request

2/5

Checks external IP address

2/5

Suspicious content matched by YARA rules

2/5

Enables process privileges

2/5

Collects hardware properties

2/5

Reads network adapter information

2/5

Searches for sensitive mail data

2/5

Possibly does reconnaissance

2/5

Searches for sensitive browser data

2/5

Executes PowerShell without default profile

1/5

Query OS Information

1/5

Connects to remote host

1/5

Accesses Microsoft Security Software registry keys

1/5

Enumerates running processes

1/5

Creates mutex

Spyware

Backdoor

Downloader

Injector