Threat Feed
https://brilliant-tanuki-dd87f9.netlify.app
2026-11-11T13:02:30.006
malicious
URL
Close
https://brilliant-tanuki-dd87f9.netlify.app
malicious
SHA256:
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections indicates a phishing website
4/5
Malicious host or URL detected via reputation
4/5
Phishing page detected via Machine Learning
2/5
Page is served from a service commonly used for temporary hosting
1/5
Page contains a form with unusual text spacing
1/5
Logon form detected via Computer Vision
1/5
Resource is loaded from a service commonly used for temporary hosting
1/5
Content is served from a user home directory
1/5
Page presents itself as a logon page
1/5
Page contents are loaded dynamically
Phishing
U8D1S4hVbSpTEQlL.exe
2026-11-11T13:00:51.119
malicious
Windows Exe (x86-32)
Close
U8D1S4hVbSpTEQlL.exe
malicious
SHA256:
34f1679524946a16006ccdef3bb04e7f881b418ce7d1ea6618e23ad5cebc2321
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Makes indirect system calls to hide process injection
4/5
Malicious content matched by YARA rules
4/5
Loads a known vulnerable file
4/5
Malicious file detected via reputation
4/5
Modifies Windows Defender configuration
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Malicious host or URL detected via reputation
3/5
Uninstalls Windows protection features
3/5
Disables a crucial system service
3/5
Executes code with kernel privileges
3/5
Tries to detect the presence of antivirus software
2/5
Queries a host's domain name
2/5
Query Firmware Information
2/5
Sends control codes to a driver
2/5
Delays execution
2/5
Queries OS info via WMI
2/5
Collects hardware properties
2/5
Enumerates running processes
2/5
Creates an unusually large number of processes
2/5
Creates a new process from a system binary
2/5
Sets up server that accepts incoming connections
2/5
Suspicious content matched by YARA rules
2/5
Makes direct system call to possibly evade hooking based monitoring
1/5
Content matched by YARA rules
1/5
Query OS Information
1/5
Performs DNS request
1/5
Enables process privileges
1/5
Creates a page with write and execute permissions
1/5
Modifies operating system directory
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Creates mutex
1/5
Installs system service
1/5
Unusual large memory allocation
1/5
Drops PE file
1/5
Reads system data
1/5
Enumerates running processes
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Reads from memory of another process
1/5
Connects to remote host
1/5
Tries to detect application sandbox
1/5
Tries to connect using an uncommon port
Spyware
PUA
Miner
Injector
dPphLxwURWefZtkZ.exe
2026-11-11T13:00:08.264
malicious
Windows Exe (x86-64)
Close
dPphLxwURWefZtkZ.exe
malicious
SHA256:
ffcba7a4cd5527ce88f67baa7542c6ca59f0c15f74d59c810ec709d2aa4c4837
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Combination of other detections shows configuration discovery
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
3/5
Captures clipboard data
3/5
Takes screenshot
2/5
Suspicious content matched by YARA rules
2/5
Searches for sensitive mail data
2/5
Reads sensitive mail data
2/5
Searches for sensitive application data
2/5
Searches for sensitive VPN configuration data
2/5
Searches for sensitive remote access configuration data
2/5
Searches for sensitive FTP data
2/5
Searches for cryptocurrency wallet locations
2/5
Searches for sensitive browser data
1/5
Creates mutex
1/5
Unusual large memory allocation
1/5
Queries system time
1/5
Query OS Information
1/5
Possibly does reconnaissance
1/5
Peripheral Device Discovery
1/5
Content matched by YARA rules
1/5
Enumerates running processes
1/5
Reads installed applications
1/5
Checks external IP address
1/5
Resolves API functions dynamically
1/5
Overwrites code
1/5
Tries to detect virtual machine
1/5
Kills process
1/5
Creates process with hidden window
1/5
Reads system data
Spyware
RNNQV9hOpzDWF3le.exe
2026-11-11T12:57:48.912
malicious
Windows Exe (x86-64)
Close
RNNQV9hOpzDWF3le.exe
malicious
SHA256:
21fbfdbd1ffd9626032dd6193dd3077d0ec88a6cea2dab0b2e12c8470db5916b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Rename system utilities
4/5
Blocks network connection to security products
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
4/5
Malicious content matched by YARA rules
3/5
Modifies Windows Defender configuration
3/5
Modifies system configuration
3/5
Modifies native system functions
3/5
Tries to detect the presence of antivirus software
2/5
Tries to detect analyzer sandbox
2/5
Reads network configuration
2/5
Reads network adapter information
2/5
Sets up server that accepts incoming connections
2/5
Disables a system tool
2/5
Delays execution
2/5
Collects hardware properties
1/5
Connects to remote host
1/5
Queries system time
1/5
Tries to connect using an uncommon port
1/5
Query OS Information
1/5
Content matched by YARA rules
1/5
Modifies application directory
1/5
Creates process with hidden window
1/5
Reads system data
1/5
Installs system service
1/5
Resolves API functions dynamically
1/5
Modifies operating system directory
1/5
Tries to detect virtual machine
1/5
Enables process privileges
1/5
Drops PE file
1/5
Enumerates running processes
1/5
Executes dropped PE file
1/5
Installs kernel driver
1/5
Unusual large memory allocation
1/5
Performs DNS request
PUA
Miner
credtool.exe
2026-11-11T12:56:31.457
malicious
Windows Exe (x86-64)
Close
credtool.exe
malicious
SHA256:
43b85a44b4008b699bddcd2bc647b15ffcf5b4e2376d967ce740f1c7379bf00f
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Modifies native system functions
1/5
Overwrites code
1/5
Query OS Information
1/5
Queries system time
1/5
Content matched by YARA rules
1/5
Reads system data
1/5
Resolves API functions dynamically
Hacktool