Threat Feed
i2VSf0axiK21mnws.exe
2026-11-03T17:28:51.053
malicious
Windows Exe (x86-64)
Close
i2VSf0axiK21mnws.exe
malicious
SHA256:
9c07457b64e2cd1283fe427869a496e04c3b126b2c17eea05d47f77aac1c229a
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Schedules task
1/5
Enumerates running processes
1/5
Queries system time
1/5
Tries to connect using an uncommon port
1/5
Drops PE file
1/5
Installs system startup script or application
1/5
Reads system data
1/5
Executes dropped PE file
1/5
Creates mutex
1/5
Executes WMI query
Downloader
QveZXPeG5q6LFb5E.exe
2026-11-03T17:28:29.744
malicious
Windows Exe (x86-32)
Close
QveZXPeG5q6LFb5E.exe
malicious
SHA256:
f7c5b041df9e7048375e8b0364ad14d61c17b8876286249a7d85ebfb234d1467
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Tries to read default login credentials
4/5
Malicious file detected via reputation
3/5
All network connection attempts failed
2/5
Sets up server that accepts incoming connections
1/5
Installs system startup script or application
1/5
Modifies operating system directory
1/5
Installs system service
1/5
Modifies application directory
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
The binary file was created with a packer
1/5
Queries system time
1/5
Executes dropped PE file
1/5
Query OS Information
1/5
Enumerates running processes
1/5
Peripheral Device Discovery
gtHF1pg3Q5B8hilU.exe
2026-11-03T17:21:00.699
malicious
Windows Exe (x86-32)
Close
gtHF1pg3Q5B8hilU.exe
malicious
SHA256:
c8a9e5cad60b8018c388596fb84868973b876e088a733792867387209f41caa3
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
2/5
Installs system monitor to detect memory accesses
2/5
Delays execution
2/5
Reads network configuration
2/5
Deletes file after execution
1/5
Enumerates running processes
1/5
Installs system startup script or application
1/5
Creates process with hidden window
1/5
Creates a page with write and execute permissions
1/5
Queries system time
1/5
Changes folder appearance
1/5
Query OS Information
1/5
Modifies application directory
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Timestamp manipulation
1/5
Modifies operating system directory
Backdoor
Trojan
Worm
Injector
052f6c9d69d73621d9e1b5630cff655a.exe
2026-11-03T17:20:28.340
malicious
Windows Exe (x86-64)
Close
052f6c9d69d73621d9e1b5630cff655a.exe
malicious
SHA256:
e37f473e27129e59325a6b55b84e78d3042a02554682d0182a7ff7fdafe196d7
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
1/5
Enumerates running processes
1/5
Queries system time
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Tries to detect application sandbox
1/5
Unusual large memory allocation
1/5
Reads system data
1/5
Creates a page with write and execute permissions
Backdoor
eD527utt5KIZZELS.exe
2026-11-03T17:18:14.495
malicious
Windows Exe (x86-64)
Close
eD527utt5KIZZELS.exe
malicious
SHA256:
1688157bb82cc1383cbe7a837b55f8ee78c4fa84f602a46a2781af386314fe6b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
XMRig configuration was extracted
4/5
Malicious content matched by YARA rules
4/5
Loads a known vulnerable file
3/5
Executes code with kernel privileges
3/5
Suspicious file detected via reputation
2/5
Sends control codes to a driver
2/5
Reads network adapter information
2/5
Creates an unusually large number of processes
2/5
Sets up server that accepts incoming connections
1/5
Content matched by YARA rules
1/5
Connects to remote host
1/5
Performs DNS request
1/5
Reads system data
1/5
Resolves API functions dynamically
1/5
Tries to detect virtual machine
1/5
Enables process privileges
1/5
Unusual large memory allocation
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Query OS Information
1/5
Queries system time
PUA
Miner