Threat Feed | Online Malware Sandbox

URL

https://ipfs.io/ipfs/bafybeigzyr5iszmvgxecicyw5vdmsnwvv75jeytyz4sju4l2oustohyybq#info@alifgift.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Logon form is hosted on a static web hoster

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page is served from a service commonly used for temporary hosting

1/5

Page secured via a Domain Validated SSL certificate

1/5

Page presents itself as a logon page

1/5

Logon form detected via Computer Vision

1/5

URL contains email address

Phishing

QDS6UAbi9hIrTu5G.exe

2026-04-10T16:20:31.130

Windows Exe (x86-32)

QDS6UAbi9hIrTu5G.exe

malicious

SHA256: 1aca998f3336625a6f235b126d862c8b9961a0a1820df1b6d63776d749f4ac51

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Event Triggered Execution

3/5

Modifies native system functions

3/5

Suspicious content matched by YARA rules

1/5

Drops PE file

1/5

Modifies application directory

1/5

Enumerates running processes

1/5

Reloads native system libraries

1/5

Tries to detect debugger

1/5

Resolves API functions dynamically

1/5

Overwrites code

1/5

Enables process privileges

Backdoor

Trojan

T2O9G3NiQIk7kp2W.exe

2026-04-10T16:20:18.183

Windows Exe (x86-32)

T2O9G3NiQIk7kp2W.exe

malicious

SHA256: 270a2a776f493b5274ba55522cf09f9a3b8528878ec740b00fff000907bb09b9

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Hides files

2/5

Searches for sensitive browser data

1/5

Modifies operating system directory

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Creates an unusually large number of files

1/5

Drops PE file

1/5

Creates a page with write and execute permissions

1/5

Drops PE masquerading Filename

1/5

Modifies application directory

1/5

Possibly does reconnaissance

Virus

93501SXgETYtKnYf.exe

2026-04-10T16:20:05.622

Windows Exe (x86-32)

93501SXgETYtKnYf.exe

malicious

SHA256: 59b6ecba5bf9b2833e1f531cb21f62fa64ccaa29115cc8f656877e23e9885896

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Tries to evade debugger

2/5

Hides files

2/5

Tries to detect virtual machine

1/5

Executes dropped PE file

1/5

Detects filename manipulation

1/5

Obfuscates control flow

1/5

Tries to detect debugger

1/5

Drops PE file

Trojan

nvsvc.exe

2026-04-10T16:19:34.499

Windows Exe (x86-64)

nvsvc.exe

malicious

SHA256: eb3158cb96fef3760693eadfeea3e170bf165355abc9f37009318699ae7737a0

VMRay Threat Identifiers

Severity

Operation

5/5

Tries to read cached credentials of various applications

4/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

3/5

Bypasses PowerShell execution policy

2/5

Searches for sensitive browser data

2/5

Hides files

2/5

Tries to detect virtual machine

2/5

Searches for sensitive remote access configuration data

2/5

Searches for sensitive password manager data

2/5

Query OS Information

2/5

Sets up server that accepts incoming connections

2/5

Queries a host's domain name

2/5

Reads network adapter information

2/5

Searches for sensitive application data

2/5

Sends control codes to a driver

1/5

Tries to detect analyzer sandbox

1/5

Accesses volumes directly

1/5

Creates process with hidden window

1/5

Drops PE file

1/5

Tries to detect debugger

1/5

Executes dropped PE file

1/5

Modifies operating system directory

1/5

Installs system startup script or application

1/5

Checks external IP address

1/5

Performs DNS request

1/5

Connects to remote host

Spyware