Threat Feed
Tài liệu Văn bản Mới.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
2026-10-25T23:11:43.255
malicious
PowerShell Script (Shell Link)
Close
Tài liệu Văn bản Mới.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
malicious
SHA256:
c7a173ad93f1f0ea6c82ccec2ba92ac3057e44aa44026f90b0255b6e11e300ea
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Sets up server that accepts incoming connections
4/5
Tries to detect virtual machine
4/5
Sends control codes to a driver
4/5
Malicious file detected via reputation
4/5
Attempts to connect through HTTP
3/5
Connects to a URL that contains a TLD highly associated with malicious actions
3/5
Bypasses PowerShell execution policy
3/5
Suspicious content matched by YARA rules
2/5
Performs DNS request
2/5
Drops PE file
2/5
Executes PowerShell with hidden window
2/5
Executes dropped PE file
1/5
Connects to remote host
1/5
Queries system time
1/5
Unusual large memory allocation
1/5
URL contains a TLD highly associated with phishing
1/5
Content matched by YARA rules
1/5
Reads system data
1/5
Query OS Information
1/5
Accesses volumes directly
Backdoor
L437829425.lnk
2026-10-25T23:11:30.044
malicious
Windows Batch File (Shell Link)
Close
L437829425.lnk
malicious
SHA256:
e32d6ddb690d7317216549671c1c0e5a57c5a4b534f9e6cb9328d6715e859f99
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Modifies operating system directory
4/5
Attempts to connect through HTTP
4/5
Malicious file detected via reputation
2/5
Queries a host's domain name
2/5
Uses system binaries to initiate network connections
1/5
Opens mutex
rabaiz-app.exe
2026-10-25T23:11:24.923
malicious
Windows Exe (x86-64)
Close
rabaiz-app.exe
malicious
SHA256:
3cc586252b9eff04207ba6ac36214752fd6e81135f6c28df494bf4aee09b18d4
VMRay Threat Identifiers
Close
Severity
Operation
4/5
Modifies control flow of another process
4/5
Writes into the memory of another process
2/5
Peripheral Device Discovery
2/5
Reads installed applications
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Creates mutex
1/5
Reads system data
1/5
Creates a page with write and execute permissions
1/5
Queries system time
1/5
Peripheral Device Discovery
1/5
Query OS Information
Injector
xoilaclivettbdaa.tv_ransome.exe
2026-10-25T23:10:54.475
malicious
Windows Exe (x86-32)
Close
xoilaclivettbdaa.tv_ransome.exe
malicious
SHA256:
a40cab970fa9b3f01d9f995e22dfa309c57f49e00901243f6e8f24f6b51f74bd
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Modifies Windows automatic backups
5/5
Malicious content matched by YARA rules
5/5
Combination of other detections shows multiple input capture behaviors
4/5
Bypasses Windows User Account Control (UAC)
4/5
Malicious file detected via reputation
4/5
Modifies control flow of another process
4/5
Disables a crucial system tool
4/5
Writes into the memory of another process
3/5
Injects a file into another process
3/5
Takes screenshot
3/5
Suspicious content matched by YARA rules
3/5
Monitors keyboard input
3/5
Captures clipboard data
2/5
Changes the desktop wallpaper
2/5
Schedules task
2/5
Hides files
2/5
Queries OS info via WMI
2/5
Searches for sensitive browser data
2/5
Collects hardware properties
2/5
Modifies network configuration
2/5
Modifies Windows Firewall configuration
2/5
Network configuration discovery
2/5
Creates an unusually large number of processes
1/5
Overwrites code
1/5
Tries to detect virtual machine
1/5
A monitored process crashed
1/5
Creates a page with write and execute permissions
1/5
Creates process with hidden window
1/5
Creates mutex
1/5
Enables process privileges
1/5
Installs system startup script or application
1/5
Query OS Information
1/5
Enumerates running processes
1/5
Peripheral Device Discovery
1/5
Modifies operating system directory
1/5
Possibly does reconnaissance
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Queries system time
Spyware
Ransomware
Injector
FlashUtil.exe
2026-10-25T23:10:31.382
malicious
Windows Exe (x86-32)
Close
FlashUtil.exe
malicious
SHA256:
af81e6004d684665fb3f8b4164081f0ebd830ea28d0759e14d9fd933ca81a910
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Deletes file after execution
1/5
Installs system startup script or application
1/5
Executes dropped PE file
1/5
Drops PE file
1/5
Queries system time