Threat Feed
linux_amd64
2026-09-16T08:04:02.602
malicious
Linux ELF Executable (x86-64)
Close
linux_amd64
malicious
SHA256:
a1cdb7f8862d5ff9abd16757a60f4e1bbaa18a650de89904c94aa351174e405b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
2/5
Enumerates running processes
2/5
Tries to detect virtual machine
2/5
Disables a system tool
2/5
Modifies network configuration
2/5
Installs system service
2/5
Creates an unusually large number of processes
1/5
Connects to remote host
1/5
Masquerades file extension
1/5
Starts a service
1/5
Creates hidden file or folder
1/5
Tries to connect using an uncommon port
1/5
Drops ELF file
Bot
c0045ffea20c3bc643c7b83728d61841c7e9c5019f95ac115e169a569591b728.exe
2026-09-16T08:01:12.205
malicious
Windows Exe (x86-64)
Close
c0045ffea20c3bc643c7b83728d61841c7e9c5019f95ac115e169a569591b728.exe
malicious
SHA256:
c0045ffea20c3bc643c7b83728d61841c7e9c5019f95ac115e169a569591b728
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
2/5
Sets up server that accepts incoming connections
2/5
Queries a host's domain name
2/5
Reads network adapter information
2/5
Delays execution
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Unusual large memory allocation
1/5
Tries to detect application sandbox
1/5
Creates a page with write and execute permissions
1/5
Enumerates running processes
1/5
Enables process privileges
1/5
Queries system time
1/5
Connects to remote host
1/5
Downloads file
Backdoor
Downloader
http://193.233.126.2:8081/a/YmxlemU.1790098882.475fddc06147e94da0857a4af3d771f5
2026-09-16T07:59:03.919
malicious
URL
Close
http://193.233.126.2:8081/a/YmxlemU.1790098882.475fddc06147e94da0857a4af3d771f5
malicious
SHA256:
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
1/5
Tries to connect using an uncommon port
1/5
Downloads executable
1/5
URL does not use standard port
Downloader
install_s.6.05.exe
2026-09-16T07:50:14.415
malicious
Windows Exe (x86-64)
Close
install_s.6.05.exe
malicious
SHA256:
5e9c1511c43e2b9badec815ef2fe094d125cc4a742576c76c4e10e553ee91729
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Modifies Windows Defender configuration
4/5
Malicious file detected via reputation
4/5
Masks file extension
3/5
Executes code with kernel privileges
3/5
Modifies native system functions
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Sends control codes to a driver
2/5
Creates an unusually large number of processes
2/5
Tries to detect virtual machine
2/5
Signed executable failed signature validation
2/5
Schedules task
2/5
Masquerades file extension
1/5
Queries system time
1/5
Executes dropped PE file
1/5
Creates mutex
1/5
Enumerates running processes
1/5
Creates a page with write and execute permissions
1/5
Modifies operating system directory
1/5
Installs system startup script or application
1/5
Creates process with hidden window
1/5
Modifies application directory
1/5
Downloads file
1/5
Resolves API functions dynamically
1/5
Overwrites code
1/5
Drops PE file
1/5
Loads a dropped DLL
Downloader
Hacktool
AAP-260068-1Appointment_Letter-html-doc.jse
2026-09-16T07:48:41.577
malicious
JScript
Close
AAP-260068-1Appointment_Letter-html-doc.jse
malicious
SHA256:
09b1187974490e471cf0f24e8f0a5a28628aea58f9cfc05f348c9e905400d084
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Known malicious mutex name is created
5/5
Malicious content matched by YARA rules
5/5
Remcos configuration was extracted
4/5
Process Hollowing
4/5
Malicious host or URL detected via reputation
4/5
Reads from memory of another process
4/5
Writes into the memory of another process
3/5
Reads sensitive mail data
3/5
Reads installed applications
3/5
Delays execution
3/5
Bypasses PowerShell execution policy
2/5
Tries to connect using an uncommon port
2/5
Searches for sensitive application data
2/5
Possibly does reconnaissance
2/5
Searches for sensitive mail data
2/5
Executes PowerShell without default profile
2/5
Searches for sensitive browser data
1/5
Content matched by YARA rules
1/5
Accesses volumes directly
1/5
Connects to remote host
1/5
Queries system time
1/5
Enumerates running processes
1/5
Accesses Microsoft Security Software registry keys
1/5
Query OS Information
Backdoor
Injector