Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

rOSquJWwvoLOcMJZ.exe

malicious

SHA256: 79acdc4c9e264c93f226088d227489f7e42917f70b0cd6869515b9bcfc4545b2

VMRay Threat Identifiers

Severity

Operation

5/5

Known malicious mutex name is created

5/5

SalatStealer configuration was extracted

5/5

Malicious content matched by YARA rules

5/5

Combination of other detections shows configuration discovery

5/5

Tries to read cached credentials of various applications

4/5

Creates a Process with redirected Input

3/5

Takes screenshot

2/5

Reads network adapter information

2/5

Collects hardware properties

2/5

Sets up server that accepts incoming connections

2/5

Suspicious content matched by YARA rules

2/5

Searches for sensitive application data

2/5

Queries OS info via WMI

2/5

Schedules task

2/5

Searches for sensitive browser data

2/5

Reads sensitive browser data

1/5

Modifies application directory

1/5

Creates process with hidden window

1/5

Reads system data

1/5

Enumerates running processes

1/5

Possibly does reconnaissance

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

A monitored process crashed

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Timestamp manipulation

1/5

Unusual large memory allocation

Spyware

eGFcomrHUIVHXMPt.exe

2026-03-31T18:02:28.102

Windows Exe (x86-32)

eGFcomrHUIVHXMPt.exe

malicious

SHA256: 1e6720a99ab641005fb8d69cb3dce377ed909b41da6410265952d30292ffc579

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

All network connection attempts failed

2/5

Deletes file after execution

1/5

Modifies operating system directory

1/5

Resolves API functions dynamically

1/5

Creates a page with write and execute permissions

1/5

Creates process with hidden window

1/5

Installs system service

1/5

Creates mutex

1/5

Performs DNS request

Backdoor

SJyVZOmkVmD2EY24.exe

2026-03-31T18:01:09.323

Windows Exe (x86-32)

SJyVZOmkVmD2EY24.exe

malicious

SHA256: c3b74bed9b50160f98b48a242b356ab03ff2cee4a77550a6e492919eeea06deb

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Delays execution

1/5

Installs system startup script or application

1/5

Creates mutex

1/5

Query OS Information

Backdoor

J1vXhC6T3XqYK2IV.exe

2026-03-31T18:00:22.326

Windows Exe (x86-32)

J1vXhC6T3XqYK2IV.exe

malicious

SHA256: 42fcba167e2d7bd5356c6ff8af7e96ad7ddf7eb7a13697157698d0bb3dce12b7

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Allows invalid SSL certificates

1/5

Creates process with hidden window

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Executes dropped PE file

Ransomware

KnUNu32qJCVXXLAo.exe

2026-03-31T17:53:09.606

Windows Exe (x86-32)

KnUNu32qJCVXXLAo.exe

malicious

SHA256: 5acd42f95cc2df2b073a53dfa9b8c8d02f4da99b941f5209c2b38e2c77de042b

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Hides files

1/5

Creates a page with write and execute permissions

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Possibly does reconnaissance

1/5

Modifies application directory

Virus