Threat Feed
zero.x86_64
2026-07-31T19:56:59.321
malicious
Linux ELF Executable (x86-64)
Close
zero.x86_64
malicious
SHA256:
9947fd8089571a9c7747fc9b9a5ba53bb478bdd76cbf441b9bc1aff33cfdc7fe
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
Mirai configuration was extracted
4/5
Malicious host or URL detected via reputation
4/5
Malicious file detected via reputation
2/5
Delays execution
2/5
Enumerates running processes
1/5
Connects to remote host
1/5
Masquerades file extension
1/5
Queries system time
1/5
Tries to connect using an uncommon port
Bot
w.sh
2026-07-31T19:56:23.704
malicious
Shell Script
Close
w.sh
malicious
SHA256:
dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Creates an unusually large number of processes
3/5
A monitored process crashed
2/5
Schedules task with Cron
2/5
Tries to execute downloaded binary of different architecture than the host
2/5
Downloads file
1/5
Content matched by YARA rules
1/5
Connects to remote host
1/5
Creates hidden file or folder
1/5
Reads system data
Bot
fW50sRAwVVEucRaZ.exe
2026-07-31T19:44:43.886
malicious
Windows Exe (x86-32)
Close
fW50sRAwVVEucRaZ.exe
malicious
SHA256:
22577a5217df512c3f81ef9dd1e6cd7028528bbe6c63fbd050ef8ba27f2fc910
VMRay Threat Identifiers
Close
Severity
Operation
5/5
njRAT configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Malicious host or URL detected via reputation
2/5
Modifies Windows Firewall configuration
1/5
Installs system startup script or application
1/5
Queries system time
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Creates process with hidden window
1/5
Creates mutex
1/5
Enables process privileges
1/5
Monitors keyboard input
1/5
Enumerates running processes
Backdoor
file.exe
2026-07-31T19:42:19.154
malicious
Windows Exe (x86-64)
Close
file.exe
malicious
SHA256:
264a6ef8a8853d0e7dac18b0d4e043ab7579b4cc885093128012b34339cee194
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Makes indirect system calls to hide process injection
5/5
Malicious content matched by YARA rules
4/5
Writes into the memory of another process
4/5
Modifies Windows Update configuration
4/5
Loads a known vulnerable file
4/5
Modifies Windows Defender configuration
4/5
Malicious file detected via reputation
4/5
Makes indirect system call to possibly evade hooking based monitoring
4/5
Malicious host or URL detected via reputation
3/5
Executes code with kernel privileges
3/5
Disables a crucial system service
3/5
Modifies native system functions
3/5
SmartContract configuration was extracted
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Adds service dependency
2/5
Disables automatic hibernation
2/5
Uses Alternate Data Stream (ADS) file attributes
2/5
Deletes file after execution
2/5
Delays execution
2/5
Reads network adapter information
2/5
Tries to detect virtual machine
2/5
Creates an unusually large number of processes
2/5
Sets up server that accepts incoming connections
2/5
Schedules task
2/5
Communicates with a Web3 service
1/5
Resolves API functions dynamically
1/5
Overwrites code
1/5
Queries system time
1/5
Performs DNS request
1/5
Creates mutex
1/5
Reads from memory of another process
1/5
Enables process privileges
1/5
Creates a page with write and execute permissions
1/5
Enumerates running processes
1/5
Accesses volumes directly
1/5
Drops PE file
1/5
Query OS Information
1/5
Modifies operating system directory
1/5
Installs system service
1/5
Accesses Microsoft Security Software registry keys
1/5
Creates process with hidden window
1/5
Unusual large memory allocation
1/5
Content matched by YARA rules
1/5
Connects to remote host
PUA
Miner
Injector
ohshit.x86_64
2026-07-31T19:34:27.843
malicious
Linux ELF Executable (x86-64)
Close
ohshit.x86_64
malicious
SHA256:
025ede6dc13255b7b6ba7e597bfe9c41e0218a4450fb45c2dde92240728b307a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Mirai configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
2/5
Enumerates running processes
2/5
Sets up server that accepts incoming connections
1/5
Tries to connect using an uncommon port
1/5
Connects to remote host
1/5
Masquerades file extension
1/5
Queries system time
Bot