Threat Feed
UAsSLXi6gLP9CJQT.exe
2026-11-04T09:13:20.070
malicious
Windows Exe (x86-64)
Close
UAsSLXi6gLP9CJQT.exe
malicious
SHA256:
26a993f6da0f242dc629bf30db0cae2caf3aa100993518230c4e2538ae71ca6f
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Makes indirect system calls to hide process injection
5/5
Malicious content matched by YARA rules
5/5
Combination of other detections shows multiple input capture behaviors
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Writes into the memory of another process
4/5
Modifies control flow of another process
4/5
Malicious file detected via reputation
3/5
Takes screenshot
3/5
Bypasses browser App-Bound Encryption
3/5
Suspicious content matched by YARA rules
3/5
Captures clipboard data
2/5
Searches for sensitive mail data
2/5
Searches for cryptocurrency wallet locations
2/5
Searches for sensitive browser data
2/5
Reads sensitive browser data
2/5
Network configuration discovery
2/5
Suspicious content matched by YARA rules
2/5
Searches for sensitive application data
2/5
Searches for sensitive FTP data
1/5
Resolves API functions dynamically
1/5
Peripheral Device Discovery
1/5
Creates a page with write and execute permissions
1/5
Queries system time
1/5
Drops PE file
1/5
Creates process with hidden window
1/5
Masquerades file extension
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Unusual large memory allocation
1/5
Possibly does reconnaissance
1/5
Reads system data
1/5
Enumerates running processes
1/5
Content matched by YARA rules
1/5
Deletes file after execution
Spyware
Backdoor
Hacktool
Injector
BPO.exe
2026-11-04T09:12:19.272
malicious
Windows Exe (x86-64)
Close
BPO.exe
malicious
SHA256:
5580b68d7e5250cecb17a4d9bc507942846fc0e4cd03ffa7325a68e318a0e90b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
ArechClient2 configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Writes into the memory of another process
4/5
Malicious file detected via reputation
4/5
Process Hollowing
3/5
Suspicious content matched by YARA rules
2/5
Tries to detect debugger
2/5
Collects hardware properties
2/5
Reads network adapter information
1/5
Tries to connect using an uncommon port
1/5
Resolves API functions dynamically
1/5
Connects to remote host
1/5
Enumerates running processes
1/5
Creates process with hidden window
1/5
Creates a page with write and execute permissions
1/5
Query OS Information
1/5
Queries system time
1/5
Performs DNS request
1/5
Enables process privileges
1/5
Peripheral Device Discovery
Spyware
Injector
JRoZugYaMHvx68uO.exe
2026-11-04T09:11:50.432
malicious
Windows Exe (x86-64)
Close
JRoZugYaMHvx68uO.exe
malicious
SHA256:
abe8461fe57e45b9764cef8b58ca0c00d7cf83aeb4123d3284c25956cf0b61ea
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
2/5
Queries a host's domain name
2/5
Sets up server that accepts incoming connections
2/5
Reads network adapter information
2/5
Delays execution
1/5
Content matched by YARA rules
1/5
Tries to detect application sandbox
1/5
Resolves API functions dynamically
1/5
Reads system data
1/5
Queries system time
1/5
Creates a page with write and execute permissions
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
Enables process privileges
1/5
Peripheral Device Discovery
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
Backdoor
b0c608e79f744ce689d901935b4b57d2.exe
2026-11-04T09:08:21.288
malicious
Windows Exe (x86-32)
Close
b0c608e79f744ce689d901935b4b57d2.exe
malicious
SHA256:
ecbc41f173aaaf4086a92fbbf8d51e006824dc11afffd87fee251b5c73a32025
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Modifies Windows Defender configuration
4/5
Process Hollowing
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
4/5
Modifies control flow of another process
4/5
Makes indirect system call to possibly evade hooking based monitoring
3/5
Captures clipboard data
2/5
Delays execution
2/5
Reads sensitive browser data
2/5
Searches for sensitive browser data
2/5
Tries to detect kernel debugger
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Content matched by YARA rules
1/5
Possibly does reconnaissance
1/5
Opens mutex
1/5
Creates mutex
1/5
Enables process privileges
1/5
Enumerates running processes
1/5
Creates process with hidden window
1/5
Reads from memory of another process
1/5
Creates a page with write and execute permissions
1/5
Tries to detect debugger
1/5
Query OS Information
1/5
Peripheral Device Discovery
1/5
Queries system time
Spyware
Injector
7921628584_AWB_STO_GTS_8E4_20261023_160902.exe
2026-11-04T09:02:06.635
malicious
Windows Exe (x86-32)
Close
7921628584_AWB_STO_GTS_8E4_20261023_160902.exe
malicious
SHA256:
eb175a973d117fb34df1c23fa46587c01f68bb014ea192790021be47730661b8
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Process Hollowing
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Modifies Windows Defender configuration
2/5
Modifies control flow of a process started from a created or modified executable
2/5
Tries to detect kernel debugger
1/5
Tries to detect debugger
1/5
Content matched by YARA rules
1/5
A monitored process crashed
1/5
Peripheral Device Discovery
1/5
Queries system time
1/5
Creates process with hidden window
1/5
Reads from memory of another process
1/5
Creates a page with write and execute permissions
1/5
Enables process privileges
1/5
Enumerates running processes
Spyware
Injector