Threat Feed | Online Malware Sandbox

Windows Exe (x86-64)

Te5ZdVHTlERaYM2w.exe

malicious

SHA256: 70fd8d4e2d82b15e320d243c48e12dba987812d4fb54a24c786760dc32076e78

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

XWorm configuration was extracted

4/5

Modifies Windows Defender configuration

3/5

Classifies external IP address

3/5

Monitors keyboard input

3/5

Modifies native system functions

3/5

Bypasses PowerShell execution policy

2/5

Collects hardware properties

2/5

Tries to detect application sandbox

2/5

Connects to an image hoster

2/5

Queries OS info via WMI

2/5

Schedules task via schtasks

2/5

Reads network adapter information

2/5

Deletes file after execution

2/5

Schedules task

1/5

Resolves API functions dynamically

1/5

Overwrites code

1/5

Query OS Information

1/5

Creates mutex

1/5

Creates process with hidden window

1/5

Performs DNS request

1/5

Connects to remote host

1/5

Enables process privileges

1/5

Content matched by YARA rules

1/5

Installs system startup script or application

1/5

Enumerates running processes

Spyware

Downloader

7i8eWkwPnxXxQTrI.exe

2026-04-01T16:43:51.004

Windows Exe (x86-32)

7i8eWkwPnxXxQTrI.exe

malicious

SHA256: 1b18df78e58601a7f5f80aadd4a378310fedaa82910bb1e44baaa627969428e1

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Allows invalid SSL certificates

1/5

Drops PE file

1/5

Executes dropped PE file

1/5

Creates process with hidden window

1/5

Resolves API functions dynamically

1/5

Creates a page with write and execute permissions

Ransomware

AQtpuBzKlYDRLWkX.exe

2026-04-01T16:42:24.925

Windows Exe (x86-64)

AQtpuBzKlYDRLWkX.exe

malicious

SHA256: c23c09d2bbaccf70aae9c2a8c998156bd6dad798fda23363679fd38cbbb7e3a8

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

3/5

Suspicious content matched by YARA rules

2/5

Creates an unusually large number of processes

1/5

A monitored process crashed

1/5

Drops PE file

1/5

Creates mutex

1/5

Executes dropped PE file

1/5

Modifies operating system directory

1/5

Creates process with hidden window

PUA

Hacktool

Miner

IRhbbez7eACrHAWK.exe

2026-04-01T16:41:18.604

Windows Exe (x86-32)

IRhbbez7eACrHAWK.exe

malicious

SHA256: 00591d3a01c64d91f137aed04dbd3e00eb7d5b55446ae73246cebab365dce1d8

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

1/5

Drops PE file

1/5

Enables process privileges

1/5

Tries to detect debugger

1/5

Obfuscates control flow

1/5

Resolves API functions dynamically

1/5

Executes dropped PE file

Hacktool

9ltabavau7R6kVxh.exe

2026-04-01T16:39:29.385

Windows Exe (x86-32)

9ltabavau7R6kVxh.exe

malicious

SHA256: 6fa207cf0e901317c7b29b5289dc6f843d6850d6404ce1be343af99dbe54932b

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

2/5

Hides files

2/5

Searches for sensitive browser data

1/5

Modifies operating system directory

1/5

Content matched by YARA rules

1/5

Obfuscates control flow

1/5

Resolves API functions dynamically

1/5

Creates an unusually large number of files

1/5

Creates a page with write and execute permissions

1/5

Drops PE file

1/5

Modifies application directory

1/5

Possibly does reconnaissance

Virus