Threat Feed | Online Malware Sandbox

URL

https://business-meta.farekey.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Malicious host or URL detected via reputation

4/5

Phishing page detected via Machine Learning

2/5

Branded Logon form detected via Computer Vision

1/5

Page secured via a Domain Validated SSL certificate

1/5

Page presents itself as a logon page

1/5

Branding image detected via Computer Vision

1/5

Content matched by YARA rules

1/5

Page contains clickables with luring keywords

Phishing

http://business-meta.iwenyan.com

2026-08-30T04:23:19.057

URL

http://business-meta.iwenyan.com

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Malicious host or URL detected via reputation

4/5

Phishing page detected via Machine Learning

2/5

Branded Logon form detected via Computer Vision

1/5

Page contains clickables with luring keywords

1/5

Page secured via a Domain Validated SSL certificate

1/5

Branding image detected via Computer Vision

1/5

Content matched by YARA rules

1/5

Page presents itself as a logon page

Phishing

db6fc0b9be85dad1cc11daab495cae26f719979f01f491bfb3c71aee2bec39a8.exe

2026-08-30T04:12:46.060

Windows Exe (x86-64)

db6fc0b9be85dad1cc11daab495cae26f719979f01f491bfb3c71aee2bec39a8.exe

malicious

SHA256: db6fc0b9be85dad1cc11daab495cae26f719979f01f491bfb3c71aee2bec39a8

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

3/5

Reads installed applications

2/5

Tries to detect virtual machine

2/5

Searches for sensitive mail data

2/5

Searches for cryptocurrency wallet locations

2/5

Searches for sensitive browser data

1/5

Unusual large memory allocation

1/5

Resolves API functions dynamically

1/5

Queries system time

1/5

Creates mutex

1/5

Enumerates running processes

1/5

Tries to detect application sandbox

1/5

Query CPU Properties

1/5

Query OS Information

Spyware

DF436F62AF38B7A5BCD8A3368A9F110A.exe

2026-08-30T04:11:48.794

Windows Exe (x86-32)

DF436F62AF38B7A5BCD8A3368A9F110A.exe

malicious

SHA256: 1c250ac3db43c8379591c0a1e8e428b972c1adda38eec2fb46376fb905e0a5e1

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

NanoCore configuration was extracted

4/5

Malicious file detected via reputation

4/5

Malicious host or URL detected via reputation

3/5

Monitors user input

3/5

Obscures a file's origin

2/5

Sets up server that accepts incoming connections

1/5

Connects to remote host

1/5

Installs system startup script or application

1/5

Creates mutex

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Enumerates running processes

1/5

Query OS Information

1/5

Reads system data

1/5

Modifies application directory

1/5

Performs DNS request

Backdoor

gsJW0KfHOw4qlrgk.exe

2026-08-30T03:45:28.023

Windows Exe (x86-32)

gsJW0KfHOw4qlrgk.exe

malicious

SHA256: 7540a42149cbb085e9ae084e8375911be734c16ecc2281078f124a4360f2ab50

VMRay Threat Identifiers

Severity

Operation

4/5

Malicious file detected via reputation

4/5

Writes into the memory of another process

4/5

Modifies control flow of another process

2/5

Delays execution

2/5

Schedules task

1/5

Enables process privileges

1/5

Creates a page with write and execute permissions

1/5

Unusual large memory allocation

1/5

Resolves API functions dynamically

1/5

Creates an unusually large number of files

1/5

Drops PE file

1/5

Installs system service

1/5

Queries system time

1/5

Executes dropped PE file

1/5

Tries to detect debugger

1/5

Enumerates running processes

1/5

Creates process with hidden window

1/5

Installs system startup script or application

Injector