Threat Feed
tNqIO0ervu9iJgfv.exe
2026-08-05T22:29:24.744
malicious
Windows Exe (x86-64)
Close
tNqIO0ervu9iJgfv.exe
malicious
SHA256:
3986a607d8e0d7da4ebe6da58fabc6c21df9b8e67060223a4338da71f9d2eec7
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
4/5
Malicious file detected via reputation
2/5
Searches for sensitive application data
2/5
Tries to detect virtual machine
2/5
Delays execution
2/5
Searches for sensitive remote access configuration data
2/5
Searches for sensitive password manager data
1/5
Creates a page with write and execute permissions
1/5
Possibly does reconnaissance
1/5
Resolves API functions dynamically
1/5
Modifies application directory
1/5
Queries system time
Ransomware
ckxohf3yeWZ4Z72q.exe
2026-08-05T22:28:14.769
malicious
Windows Exe (x86-64)
Close
ckxohf3yeWZ4Z72q.exe
malicious
SHA256:
4abcd5fd6e45f0a32145ed8b4066349f56b82505c96c15220b33cf0645ad16c3
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
4/5
Malicious file detected via reputation
2/5
Tries to detect virtual machine
2/5
Sends control codes to a driver
1/5
Creates a page with write and execute permissions
1/5
Resolves API functions dynamically
1/5
Modifies application directory
1/5
Queries system time
1/5
Accesses volumes directly
1/5
Creates mutex
Ransomware
Ur1At2J1F6ZkxHhd.exe
2026-08-05T22:24:38.932
malicious
Windows Exe (x86-64)
Close
Ur1At2J1F6ZkxHhd.exe
malicious
SHA256:
277d56e31cadc938a2aa9adb7a88a1dccf16988460a6c8c760b6347ce2157059
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Writes to Master Boot Record (MBR)
4/5
Disables Windows Recovery Environment
4/5
Writes into the memory of another process
4/5
Malicious file detected via reputation
3/5
Searches for available drives
3/5
All network connection attempts failed
3/5
Tries to open an unusually high number of parallel network connections
3/5
Possibly drops ransom note files
2/5
Sends control codes to a driver
2/5
Changes the desktop wallpaper
2/5
Enables critical process privileges
2/5
Accesses physical drive
1/5
CMD started with ambiguous arguments
1/5
Changes folder appearance
1/5
Accesses volumes directly
1/5
Connects to remote host
1/5
Installs system startup script or application
1/5
Modifies application directory
1/5
Creates process with hidden window
1/5
Modifies operating system directory
1/5
Enumerates running processes
1/5
Reads from memory of another process
1/5
Queries system time
1/5
Enables process privileges
1/5
Creates mutex
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
Injector
SnH4SSjDq7L7iLmj.exe
2026-08-05T22:23:34.820
malicious
Windows Exe (x86-32)
Close
SnH4SSjDq7L7iLmj.exe
malicious
SHA256:
0d1a82028cacb9519a18b0107a2309e970fd42e58ffca4cb448c7e7adf028b66
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
4/5
Event Triggered Execution
3/5
Suspicious content matched by YARA rules
3/5
Modifies native system functions
2/5
Signed executable failed signature validation
2/5
Delays execution
1/5
Queries system time
1/5
Enumerates running processes
1/5
Reloads native system libraries
1/5
Possibly does reconnaissance
1/5
Drops PE file
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Overwrites code
1/5
Creates an unusually large number of files
1/5
Modifies application directory
1/5
Drops PE masquerading Filename
1/5
Enables process privileges
Backdoor
Trojan
iy835oSQ1767GHja.exe
2026-08-05T22:22:13.261
malicious
Windows Exe (x86-32)
Close
iy835oSQ1767GHja.exe
malicious
SHA256:
94a1ac31b4a7d5eed59116d7eab437f22aea04661db4d1078c0335b77ed77ca6
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
1/5
Tries to detect debugger
1/5
Creates a page with write and execute permissions
1/5
Possibly does reconnaissance
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
The binary file was created with a packer
1/5
Creates process with hidden window
1/5
Timestamp manipulation
1/5
Modifies application directory