Threat Feed
lol.exe
2026-11-04T04:45:35.973
malicious
Windows Exe (x86-32)
Close
lol.exe
malicious
SHA256:
d4a8ce2863d7717a1e5787c8b094098ec4e92e2379d26089bee2e235948a4446
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Metasploit configuration was extracted
3/5
All network connection attempts failed
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
Downloader
Hacktool
32F5F12DC1DC85423F2ADD8052ADFEB6.exe
2026-11-04T04:30:36.916
malicious
Windows Exe (x86-32)
Close
32F5F12DC1DC85423F2ADD8052ADFEB6.exe
malicious
SHA256:
9a02a157acf5643e7ba6bcb422f093f7a681c184fcfa285c568e27803762dc49
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
ValleyRAT configuration was extracted
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
3/5
Executes code with kernel privileges
2/5
Creates an unusually large number of processes
2/5
Schedules task
2/5
Enables critical process privileges
2/5
Makes direct system call to possibly evade hooking based monitoring
1/5
Enumerates running processes
1/5
Writes an unusually large amount of data to the registry
1/5
Creates mutex
1/5
Queries system time
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Installs system service
1/5
Resolves API functions dynamically
1/5
A monitored process crashed
1/5
Installs kernel driver
1/5
Drops PE file
Backdoor
c8RuSWE8v0r9eLiP.exe
2026-11-04T04:27:12.009
malicious
Windows Exe (x86-64)
Close
c8RuSWE8v0r9eLiP.exe
malicious
SHA256:
b9039da04ad9f7825c83b80ba7eb810825233ec62a4c623ecbb34e28acc5d9b7
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Malicious file detected via reputation
3/5
Modifies native system functions
3/5
Suspicious content matched by YARA rules
3/5
Tries to evade debugger
2/5
Modifies Windows Firewall configuration
2/5
Suspicious content matched by YARA rules
2/5
Tries to detect kernel debugger
1/5
Queries system time
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Performs DNS request
1/5
Reads system data
1/5
Tries to detect debugger
1/5
Enumerates running processes
1/5
Peripheral Device Discovery
1/5
Installs system startup script or application
1/5
Query OS Information
1/5
Creates process with hidden window
1/5
Creates a page with write and execute permissions
Spyware
Backdoor
voQnlul4UuQ1XfZr.exe
2026-11-04T04:26:44.496
malicious
Windows Exe (x86-32)
Close
voQnlul4UuQ1XfZr.exe
malicious
SHA256:
5790ec8047b65f17857d088d97bd39f4a44f4b4c122c3d066875a48205905416
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Creates an unusually large number of processes
2/5
Deletes file after execution
1/5
Modifies operating system directory
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Deletes file after execution
1/5
Creates process with hidden window
Bot
a.exe
2026-11-04T04:25:57.311
malicious
Windows Exe (x86-64)
Close
a.exe
malicious
SHA256:
1859bee638ea6cc1081be27301058313e2d1213b517db791d7f89fb012c79c65
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
2/5
Delays execution
2/5
Queries a host's domain name
2/5
Sets up server that accepts incoming connections
2/5
Reads network adapter information
1/5
Connects to remote host
1/5
Tries to detect application sandbox
1/5
Reads system data
1/5
Creates a page with write and execute permissions
1/5
Content matched by YARA rules
1/5
Queries system time
1/5
Resolves API functions dynamically
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
Enables process privileges
1/5
Peripheral Device Discovery
Backdoor