Threat Feed | Online Malware Sandbox

Windows Exe (x86-64)

TKCyeDiByNHVr7kh.exe

malicious

SHA256: 504ca1a064dd84bf53fbb24d2b5f0512608d1c77bb51aa828bc19a04f052a9a4

VMRay Threat Identifiers

Severity

Operation

4/5

Bypasses Windows User Account Control (UAC)

4/5

Modifies authentication process

4/5

Tries to disable antivirus software

3/5

Modifies system configuration

3/5

Tries to detect the presence of antivirus software

2/5

Reads network adapter information

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Schedules task

1/5

Modifies application directory

1/5

Query OS Information

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Checks external IP address

1/5

Content matched by YARA rules

1/5

Resolves API functions dynamically

1/5

Installs system startup script or application

1/5

Creates process with hidden window

1/5

Enables process privileges

file.exe

2026-06-11T16:54:02.659

Windows Exe (x86-64)

file.exe

malicious

SHA256: 985a2c4839ac4ded904d1d9b354d2fbe9e24c36e963d171d7e21130a4c0f66d4

VMRay Threat Identifiers

Severity

Operation

5/5

Reads a significant portion of browser memory

2/5

Reads sensitive browser data

2/5

Searches for sensitive browser data

1/5

Possibly does reconnaissance

1/5

Enumerates running processes

1/5

Reads system data

1/5

Reads from memory of another process

http://49.51.43.12/v3/signin/identifier?flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvyu52Rypy7OFugmQvoIpY5WRRij8XOIXjKzGkDHQsIbWhD253DBcVoMzJ7auSzA-77cufsE&dsh=S1107417023%3A1781187690119726

2026-06-11T16:52:02.557

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Branded Logon form detected via Computer Vision

2/5

Page uses exact same title as that of a popular online service

1/5

Content matched by YARA rules

1/5

Page presents itself as a logon page

1/5

HTTPS page insecurely loads resources via HTTP

1/5

Branding image detected via Computer Vision

Phishing

c41RizS7Rim7bAv5.exe

2026-06-11T16:51:32.855

Windows Exe (x86-32)

c41RizS7Rim7bAv5.exe

malicious

SHA256: 09385ceca433ea9e0726cbb081ef7b284b18d33d42b2a857ad8a80f3b45aab91

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Allows invalid SSL certificates

2/5

Enables critical process privileges

1/5

Enumerates running processes

1/5

Installs system service

1/5

Performs DNS request

1/5

Connects to remote host

1/5

URL contains a TLD highly associated with phishing

1/5

Drops PE file

1/5

Enables process privileges

1/5

Executes dropped PE file

1/5

Modifies operating system directory

1/5

Creates mutex

Ransomware

eL4XQb2NITpfs84i.exe

2026-06-11T16:49:20.768

Windows Exe (x86-32)

eL4XQb2NITpfs84i.exe

malicious

SHA256: abe2e35e08fbd0afe01dc6500c7ac30c283093c0f400123dc6b2eac16717a058

VMRay Threat Identifiers

Severity

Operation

5/5

Known malicious mutex name is created

5/5

Malicious content matched by YARA rules

4/5

Malicious content matched by YARA rules

2/5

Suspicious content matched by YARA rules

2/5

Deletes file after execution

2/5

Delays execution

1/5

Modifies operating system directory

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Installs system startup script or application

1/5

Creates process with hidden window

1/5

Resolves API functions dynamically

Spyware

Trojan