Threat Feed
1e40620ada1a6be34e9e3899fa6e2d7b.exe
2026-08-17T01:30:41.476
malicious
Windows Exe (x86-32)
Close
1e40620ada1a6be34e9e3899fa6e2d7b.exe
malicious
SHA256:
aabd2d5eed42d47bfb6a0170acf4bdf9a21be4c3121b262b86a826e0829b7bca
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Tries to read cached credentials of various applications
5/5
Lokibot configuration was extracted
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
2/5
Reads sensitive application data
2/5
Searches for sensitive mail data
2/5
Reads sensitive mail data
2/5
Reads sensitive browser data
2/5
Delays execution
2/5
Searches for sensitive password manager data
2/5
Searches for sensitive browser data
2/5
Suspicious content matched by YARA rules
2/5
Searches for sensitive FTP data
2/5
Searches for sensitive application data
2/5
Reads sensitive FTP data
1/5
Connects to remote host
1/5
Creates mutex
1/5
Possibly does reconnaissance
1/5
Queries system time
1/5
Enables process privileges
1/5
Performs DNS request
1/5
Reads system data
Spyware
Tulv1pLJi7cZH2Ye.exe
2026-08-17T01:28:23.416
malicious
Windows Exe (x86-32)
Close
Tulv1pLJi7cZH2Ye.exe
malicious
SHA256:
8736bfb1e29916e7546813675c6792e5a503c529283f4ca9c9df3802b0ef1cff
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
njRAT configuration was extracted
4/5
Malicious file detected via reputation
2/5
Modifies Windows Firewall configuration
2/5
Hides files
1/5
Creates mutex
1/5
Monitors keyboard input
1/5
Query OS Information
1/5
Enables process privileges
1/5
Creates process with hidden window
1/5
Installs system startup script or application
Backdoor
CzgG69qmt2iTK4CM.exe
2026-08-17T01:23:54.475
malicious
Windows Exe (x86-64)
Close
CzgG69qmt2iTK4CM.exe
malicious
SHA256:
5a2e8cee020ee0758306925647812f4de0318d1f9dda9e225cee4943743f73d1
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Uses HTTP to upload a large amount of data
3/5
Tries to evade debugger
2/5
Delays execution
2/5
Tries to detect analyzer sandbox
1/5
Enumerates running processes
1/5
Resolves API functions dynamically
1/5
Queries system time
1/5
Tries to detect debugger
1/5
Creates mutex
1/5
Unusual large memory allocation
Spyware
a1LDaXAVjiZQPSvu.exe
2026-08-17T00:35:03.475
malicious
Windows Exe (x86-32)
Close
a1LDaXAVjiZQPSvu.exe
malicious
SHA256:
c310d63ae3034484f229f6efb666e597c80472a2a03031af0c6799d8b46ce3ce
VMRay Threat Identifiers
Close
Severity
Operation
5/5
njRAT configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Modifies Windows Firewall configuration
1/5
Enumerates running processes
1/5
Monitors mouse movements and clicks
1/5
Creates mutex
1/5
Query OS Information
1/5
Creates process with hidden window
1/5
Enables process privileges
1/5
Monitors keyboard input
Backdoor
vLBStclKt6pXrYfQ.exe
2026-08-17T00:33:36.831
malicious
Windows Exe (x86-32)
Close
vLBStclKt6pXrYfQ.exe
malicious
SHA256:
fa1c1c0754d806b79e6a390463ba1922556b2b1f0b917e631151a214d1bce6b4
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
3/5
Reads installed applications
3/5
Suspicious file detected via reputation
2/5
Enables critical process privileges
2/5
Reads network adapter information
2/5
Sets up server that accepts incoming connections
2/5
Reads sensitive browser data
2/5
Reads network configuration
2/5
Sends control codes to a driver
2/5
Tries to detect debugger
2/5
Schedules task
2/5
Searches for sensitive browser data
2/5
Delays execution
2/5
Masquerades file extension
2/5
Deletes file after execution
1/5
Creates a page with write and execute permissions
1/5
Reads mouse position
1/5
Accesses volumes directly
1/5
Monitors keyboard input
1/5
Possibly does reconnaissance
1/5
Tries to detect debugger
1/5
Network configuration discovery
1/5
Query CPU Properties
1/5
Installs system startup script or application
1/5
Enumerates running processes
1/5
Queries system time
1/5
Unusual large memory allocation
1/5
Reads system data
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
A monitored process crashed
1/5
Drops PE file
1/5
Loads a dropped DLL
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Tries to detect application sandbox
1/5
Query OS Information
1/5
Creates process with hidden window
1/5
Creates mutex