Threat Feed
3D639A627186E77730FF2D1294DF49A3.exe
2026-08-25T03:08:25.336
malicious
Windows Exe (x86-32)
Close
3D639A627186E77730FF2D1294DF49A3.exe
malicious
SHA256:
89f6c08fa045d14eb73a0992145a724bc34d531d7af3dcc4901a1b7c7833aede
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Lokibot configuration was extracted
5/5
Malicious content matched by YARA rules
5/5
Tries to read cached credentials of various applications
4/5
Process Hollowing
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
2/5
Searches for sensitive application data
2/5
Searches for sensitive mail data
2/5
Reads sensitive mail data
2/5
Searches for sensitive password manager data
2/5
Searches for sensitive browser data
2/5
Reads sensitive browser data
2/5
Searches for sensitive FTP data
2/5
Reads sensitive FTP data
2/5
Reads sensitive application data
2/5
Tries to detect virtual machine
2/5
Suspicious content matched by YARA rules
2/5
Modifies control flow of a process started from a created or modified executable
2/5
Schedules task
1/5
A monitored process crashed
1/5
Queries system time
1/5
Enumerates running processes
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Enables process privileges
1/5
Creates mutex
1/5
Modifies operating system directory
1/5
Creates process with hidden window
1/5
Possibly does reconnaissance
1/5
Reads from memory of another process
1/5
Creates a page with write and execute permissions
1/5
Overwrites code
1/5
Tries to detect debugger
1/5
Reads system data
Spyware
Injector
6b7a6595e3ba1deab9e3020e9fa535bd2ad83732e643d1e70e85d7c15d563d8e.dll
2026-08-25T03:07:53.105
malicious
Windows DLL (x86-64)
Close
6b7a6595e3ba1deab9e3020e9fa535bd2ad83732e643d1e70e85d7c15d563d8e.dll
malicious
SHA256:
6b7a6595e3ba1deab9e3020e9fa535bd2ad83732e643d1e70e85d7c15d563d8e
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Tries to evade debugger
2/5
Delays execution
2/5
Tries to detect virtual machine
1/5
Content matched by YARA rules
1/5
Enumerates running processes
1/5
Creates mutex
1/5
Tries to detect debugger
1/5
Unusual large memory allocation
1/5
Resolves API functions dynamically
Spyware
chrome
2026-08-25T02:22:49.427
malicious
Linux ELF Executable (x86-64)
Close
chrome
malicious
SHA256:
02ce9b736cd71658c564d56dd15db84a73e81cfe4a22612c183c0c692adf6677
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
2/5
Enumerates running processes
2/5
Sets up server that accepts incoming connections
1/5
Tries to connect using an uncommon port
1/5
Connects to remote host
1/5
Queries system time
Bot
Project FMD2026UOS.JS
2026-08-25T02:22:33.289
malicious
JScript
Close
Project FMD2026UOS.JS
malicious
SHA256:
49b0bef201b6447f392be96f74dec52743540e520dad0242054e1a2109bb0d70
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows configuration discovery
5/5
Sets up server that accepts incoming connections
5/5
Malicious content matched by YARA rules
5/5
Tries to read cached credentials of various applications
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Monitors keyboard input
4/5
Tries to detect the presence of antivirus software
4/5
Monitors clipboard content
4/5
Connects to SMTP server
4/5
Malicious content matched by YARA rules
4/5
Injects a file into another process
3/5
Reads sensitive mail data
3/5
Suspicious content matched by YARA rules
3/5
Suspicious file detected via reputation
2/5
Enables process privileges
2/5
Collects hardware properties
2/5
Performs DNS request
2/5
Suspicious content matched by YARA rules
2/5
Checks external IP address
2/5
Executes dropped PE file
2/5
Reads network adapter information
2/5
Searches for sensitive browser data
2/5
Searches for sensitive mail data
2/5
Possibly does reconnaissance
2/5
Searches for sensitive FTP data
2/5
Queries OS info via WMI
1/5
Unusual large memory allocation
1/5
Enumerates running processes
1/5
Connects to remote host
1/5
Query OS Information
1/5
Queries system time
1/5
Creates mutex
Spyware
Backdoor
Keylogger
Downloader
ee981b6035362e01d50684b36e9db1e4a5cc97abe6414adecc866ffb93313328.exe
2026-08-25T01:59:56.443
malicious
Windows Exe (x86-64)
Close
ee981b6035362e01d50684b36e9db1e4a5cc97abe6414adecc866ffb93313328.exe
malicious
SHA256:
ee981b6035362e01d50684b36e9db1e4a5cc97abe6414adecc866ffb93313328
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Tries to read cached credentials of various applications
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Monitors keyboard input
3/5
SmartContract configuration was extracted
3/5
Modifies native system functions
3/5
Uses HTTP to upload a large amount of data
2/5
Suspicious content matched by YARA rules
2/5
Tries to detect analyzer sandbox
2/5
Searches for cryptocurrency wallet locations
2/5
Delays execution
2/5
Tries to detect virtual machine
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Schedules task
2/5
Communicates with a Web3 service
2/5
Searches for sensitive browser data
1/5
Accesses volumes directly
1/5
Creates mutex
1/5
Creates process with hidden window
1/5
Queries system time
1/5
Content matched by YARA rules
1/5
URL contains a TLD highly associated with phishing
Spyware