Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

SwEGurYCwFrJwsnI.exe

malicious

SHA256: 8e5182bb2280d911b1ac376c1470920848d73280c7ccb72d723b291bdcb048d6

VMRay Threat Identifiers

Severity

Operation

5/5

VIPKeylogger configuration was extracted

5/5

Malicious content matched by YARA rules

5/5

Tries to read cached credentials of various applications

5/5

Combination of other detections shows multiple input capture behaviors

4/5

Malicious content matched by YARA rules

3/5

Monitors keyboard input

3/5

Sends data via a Telegram bot

2/5

Suspicious content matched by YARA rules

2/5

Reads sensitive browser data

2/5

Searches for sensitive mail data

2/5

Searches for sensitive browser data

2/5

Searches for sensitive application data

2/5

Delays execution

1/5

Connects to remote host

1/5

Enumerates running processes

1/5

Possibly does reconnaissance

1/5

Checks external IP address

1/5

Query OS Information

1/5

Performs DNS request

1/5

Enables process privileges

Spyware

https://aprovado-acesso.vercel.app/login?placement=Facebook_Mobile_Feed&utm_source=FB&utm_campaign=P27-N08-T1-R25%252FMila+%25E2%2580%2594+C%25C3%25B3pia%257C120242984109330526&utm_medium=CJ%257C120242984109020526&utm_content=AD%257C120242984109040526&utm_term=Facebook_Mobile_Feed&fbclid=IwdGRjcAQKsMpleHRuA2FlbQEwAGFkaWQBqzBeQv2GrnNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHtxoasK6WaSY__yabyjYT-wKvcMA3hBW05u2AEKVfzRxjWxXPWkX_uVX8yIv_aem_zRL-CMb6FSSRtd0GPBHJJw&utm_id=120242984109330526&twrclid=699dd15b3671a46a4c06773a

2026-02-24T20:11:10.453

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

2/5

Page is served from a service commonly used for temporary hosting

1/5

Logon form detected via Computer Vision

1/5

Page secured via a Domain Validated SSL certificate

1/5

Checks external IP address

1/5

Page presents itself as a logon page

1/5

Resource is loaded from a service commonly used for temporary hosting

Phishing

48nosjet5ukJ75L3.exe

2026-02-24T20:00:41.253

Windows Exe (x86-32)

48nosjet5ukJ75L3.exe

malicious

SHA256: 953eff60b85203409d3f995187075bbb4566ce93ec7665cc0253387a7d6d6edb

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Tries to evade debugger

3/5

Modifies native system functions

2/5

Tries to detect kernel debugger

2/5

Tries to detect virtual machine

1/5

Enumerates running processes

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Tries to detect debugger

Trojan

akImdfCFaCaVWmXd.exe

2026-02-24T19:57:40.582

Windows Exe (x86-32)

akImdfCFaCaVWmXd.exe

malicious

SHA256: 10c7e5d5dd8f54afda48a916c661880d585324a0eff6e84cae79dbb1f5250860

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

4/5

Modifies Windows Defender configuration

4/5

Bypasses Windows User Account Control (UAC)

4/5

Makes indirect system call to possibly evade hooking based monitoring

3/5

Executable modifies its own file

2/5

Suspicious content matched by YARA rules

2/5

Schedules task via schtasks

2/5

Makes direct system call to possibly evade hooking based monitoring

2/5

Schedules task

1/5

Creates mutex

1/5

Enables process privileges

1/5

Content matched by YARA rules

1/5

Query OS Information

1/5

Enumerates running processes

1/5

Resolves API functions dynamically

1/5

Drops PE file

1/5

Modifies application directory

1/5

Installs system startup script or application

1/5

Executes dropped PE file

1/5

Creates process with hidden window

Backdoor

gX1d55D9j9OMqFZq.exe

2026-02-24T19:49:46.863

Windows Exe (x86-32)

gX1d55D9j9OMqFZq.exe

malicious

SHA256: 0e1a281de0b848aaf76454b13d1bddc04a1abdb1445b5b73ac52bb652214a592

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Deletes file after execution

1/5

Drops PE file

1/5

Timestamp manipulation

1/5

Drops PE masquerading Filename

1/5

Tries to detect debugger

1/5

Creates a page with write and execute permissions

1/5

Creates process with hidden window

1/5

Possibly does reconnaissance

1/5

Modifies application directory