Threat Feed
ZgBaNirMO9yo2cNA.exe
2026-08-16T07:47:48.688
malicious
Windows Exe (x86-64)
Close
ZgBaNirMO9yo2cNA.exe
malicious
SHA256:
a8bdbd72904bedf916b3dc9ac4c5eccd2e042b937618ee3aee0069021cf1d398
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Writes into the memory of another process
4/5
Malicious file detected via reputation
3/5
Monitors user input
3/5
Tries to evade debugger
3/5
Modifies native system functions
2/5
Tries to detect application sandbox
2/5
Tries to detect kernel debugger
2/5
Makes direct system call to possibly evade hooking based monitoring
2/5
Tries to detect virtual machine
2/5
Query Firmware Information
2/5
Queries a host's domain name
2/5
Sets up server that accepts incoming connections
1/5
Enumerates running processes
1/5
Tries to detect application sandbox
1/5
Reads mouse position
1/5
Queries system time
1/5
Connects to remote host
1/5
Tries to detect debugger
1/5
Performs DNS request
1/5
Creates process with hidden window
1/5
URL contains a TLD highly associated with phishing
1/5
Kills process
Hacktool
Injector
CEPDNZrz0Y4tXHpC.exe
2026-08-16T07:24:04.121
malicious
Windows Exe (x86-32)
Close
CEPDNZrz0Y4tXHpC.exe
malicious
SHA256:
7c93581b9eec3225a1edf19c35e7d16ca9cbd2c5f92b5e399dddff5c8bd55569
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
2/5
Allows invalid SSL certificates
1/5
Creates a page with write and execute permissions
1/5
Executes dropped PE file
1/5
Creates process with hidden window
1/5
Resolves API functions dynamically
1/5
Drops PE file
Ransomware
f0cpAzBI9W5NNIac.exe
2026-08-16T07:19:04.809
malicious
Windows Exe (x86-32)
Close
f0cpAzBI9W5NNIac.exe
malicious
SHA256:
4d36e81fe6844152347fe9b324b6bd03dd73511d1d79a1fe218faa53cddf38ce
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Writes into the memory of another process
4/5
Entry point injection
3/5
Creates a subprocess to cleanup tracks
2/5
Creates a new process from a system binary
2/5
Deletes file after execution
1/5
Checks Internet connection
1/5
Drops PE file
1/5
Executes dropped PE file
1/5
Installs system startup script or application
1/5
Creates process with hidden window
1/5
Queries system time
1/5
Creates a page with write and execute permissions
1/5
Enumerates running processes
1/5
Reads from memory of another process
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
A monitored process crashed
Ransomware
Injector
gi5w1wr9iE2Ts9Ef.exe
2026-08-16T07:12:53.271
malicious
Windows Exe (x86-64)
Close
gi5w1wr9iE2Ts9Ef.exe
malicious
SHA256:
d40f8aeca33b8ac54790eba46c57d20d5befb51e7984d0002fda09ab313b636c
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Uses HTTP to upload a large amount of data
3/5
Tries to evade debugger
2/5
Delays execution
1/5
Overwrites code
1/5
Enumerates running processes
1/5
Queries system time
1/5
Tries to detect debugger
1/5
Creates mutex
1/5
Unusual large memory allocation
1/5
Resolves API functions dynamically
Spyware
0J6TVqYpZTzcxjXl.exe
2026-08-16T07:12:26.131
malicious
Windows Exe (x86-64)
Close
0J6TVqYpZTzcxjXl.exe
malicious
SHA256:
f0ea6117189f16692342d435276a4f50765362a821bab6025371f87da357c690
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
2/5
Creates an unusually large number of processes
1/5
Creates process with hidden window
1/5
Resolves API functions dynamically
1/5
Creates an unusually large number of files
1/5
Drops PE file
1/5
Creates mutex
1/5
Executes dropped PE file
1/5
Queries system time
1/5
Modifies operating system directory
PUA
Miner