Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

8hFi5JGu4v1aodGl.exe

malicious

SHA256: 7775d333f0f61b4a6b29d11eb12a28405b74709ef0c4e67eea40e516ba255b05

VMRay Threat Identifiers

Severity

Operation

4/5

Modifies control flow of another process

4/5

Writes into the memory of another process

3/5

Modifies native system functions

2/5

Installs system monitor to detect memory accesses

2/5

Signed executable failed signature validation

1/5

Enables process privileges

1/5

Creates a page with write and execute permissions

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Enumerates running processes

1/5

Reads from memory of another process

Injector

IqQeQRUBReoZx0BG.exe

2026-04-17T03:57:44.135

Windows Exe (x86-64)

IqQeQRUBReoZx0BG.exe

malicious

SHA256: 0dc64da684e15c9aeacb54a33aa7a94e2ca300e55741737d71dc3991c45da56b

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

BlankGrabber configuration was extracted

2/5

Signed executable failed signature validation

1/5

Drops PE file

1/5

Loads a dropped DLL

1/5

Content matched by YARA rules

1/5

Drops PE masquerading Filename

1/5

Resolves API functions dynamically

1/5

Detects filename manipulation

Spyware

http://49.51.43.12/v3/signin/identifier?flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AT1y2_X4cEpSU1b_lm_Ek70Afti_orSMIOKSjvkYnmGP7MbgjRkRhIHB2ooMG7tB-yJf80U7XWUU&dsh=S890758543%3A1776391946056643

2026-04-17T03:28:57.345

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page uses exact same title as that of a popular online service

2/5

Branded Logon form detected via Computer Vision

1/5

Content matched by YARA rules

1/5

HTTPS page insecurely loads resources via HTTP

1/5

Branding image detected via Computer Vision

1/5

Page presents itself as a logon page

Phishing

https://sharepoint2026iissjn-zynb.bolt.host

2026-04-17T03:03:38.132

URL

https://sharepoint2026iissjn-zynb.bolt.host

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Malicious content matched by YARA rules

3/5

Sends data via a Telegram bot

2/5

Suspicious content matched by YARA rules

2/5

Branded Logon form detected via Computer Vision

1/5

Page uses exact favicon of a popular online service

1/5

Loads image resources from another website

1/5

Page secured via a Domain Validated SSL certificate

1/5

Branding image detected via Computer Vision

Phishing

YVjpoOr5AwWJtuBY.exe

2026-04-17T02:50:27.644

Windows Exe (x86-32)

YVjpoOr5AwWJtuBY.exe

malicious

SHA256: 47fc51d2c9aefebcdb539fafe96cd4f7449e007341413803b6f001f500a2986f

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

Known malicious mutex name is created

5/5

Combination of other detections shows configuration discovery

5/5

Tries to read cached credentials of various applications

5/5

SalatStealer configuration was extracted

3/5

Takes screenshot

2/5

Collects hardware properties

2/5

Queries OS info via WMI

2/5

Sets up server that accepts incoming connections

2/5

Suspicious content matched by YARA rules

2/5

Reads sensitive browser data

2/5

Searches for sensitive browser data

2/5

Schedules task

2/5

Searches for sensitive application data

2/5

Reads network adapter information

1/5

A monitored process crashed

1/5

Drops PE file

1/5

Enumerates running processes

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Timestamp manipulation

1/5

Performs DNS request

1/5

Possibly does reconnaissance

1/5

Content matched by YARA rules

1/5

Reads system data

1/5

Modifies application directory

1/5

Resolves API functions dynamically

1/5

Unusual large memory allocation

Spyware