Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

libGLESv2.exe

malicious

SHA256: a531d233b9580bb61ea73c7c3e6f9e53ec361ef78ae3ec3b9c5f0de68782629c

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Modifies Windows Defender configuration

4/5

Bypasses Windows User Account Control (UAC)

3/5

Executable modifies its own file

3/5

Event Triggered Execution

2/5

Suspicious content matched by YARA rules

2/5

Creates a new process from a system binary

2/5

Schedules task

2/5

Schedules task via schtasks

2/5

Creates an unusually large number of processes

1/5

Modifies operating system directory

1/5

Creates mutex

1/5

Obfuscates control flow

1/5

Query OS Information

1/5

Modifies application directory

1/5

Writes an unusually large amount of data to the registry

1/5

Installs system startup script or application

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Executes dropped PE file

Backdoor

https://pub-e375ad8a4dbc42f4b4b795e227062892.r2.dev/att-login-screen.html

2025-07-19T00:03:05.660

URL

https://pub-e375ad8a4dbc42f4b4b795e227062892.r2.dev/att-login-screen.html

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected

3/5

Suspected phishing site

2/5

Page is served from a service commonly used for temporary hosting

1/5

Page presents itself as a logon page

1/5

Resource is loaded from a service commonly used for temporary hosting

1/5

Page secured via a Domain Validated SSL certificate

Phishing

http://shipment324.vercel.app/?naps

2025-07-19T00:02:46.588

URL

http://shipment324.vercel.app/?naps

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

Malicious content matched by YARA rules

4/5

Phishing page detected

3/5

Suspicious content matched by YARA rules

2/5

Page is served from a service commonly used for temporary hosting

1/5

Loads resources from a public service

1/5

Page secured via a Domain Validated SSL certificate

1/5

Page presents itself as a logon page

Phishing

libGLESv2.exe

2025-07-19T00:02:42.171

Windows Exe (x86-32)

libGLESv2.exe

malicious

SHA256: ab56042f6aa7a48d18e43ed981eab198b78412e7e61849d4f733d6666c5bcc87

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Bypasses Windows User Account Control (UAC)

4/5

Modifies Windows Defender configuration

3/5

Executable modifies its own file

2/5

Schedules task

2/5

Suspicious content matched by YARA rules

2/5

Schedules task via schtasks

1/5

Enumerates running processes

1/5

Query OS Information

1/5

Installs system startup script or application

1/5

Creates process with hidden window

1/5

Resolves API functions dynamically

1/5

Creates mutex

1/5

Enables process privileges

Backdoor

http://shipment324.vercel.app

2025-07-19T00:02:03.091

URL

http://shipment324.vercel.app

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

5/5

Malicious content matched by YARA rules

4/5

Phishing page detected

3/5

Suspicious content matched by YARA rules

2/5

Page is served from a service commonly used for temporary hosting

1/5

Loads resources from a public service

1/5

Page secured via a Domain Validated SSL certificate

1/5

Page presents itself as a logon page

Phishing