Threat Feed
00ec5f67f9dcdc880bbbfb31e3993b34.exe
2026-09-21T20:49:25.502
malicious
Windows Exe (x86-32)
Close
00ec5f67f9dcdc880bbbfb31e3993b34.exe
malicious
SHA256:
d89ef5c765be3faf458e7d1673b79c4ad27e99c0ea4f2b84261554487605b651
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Brute-forces user account
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Creates a subprocess to cleanup tracks
2/5
Searches for sensitive password manager data
2/5
Searches for sensitive application data
2/5
Searches for sensitive mail data
2/5
Reads installed applications
2/5
Searches for sensitive FTP data
2/5
Deletes file after execution
2/5
Enables critical process privileges
2/5
Suspicious content matched by YARA rules
2/5
Searches for sensitive browser data
2/5
Searches for sensitive remote access configuration data
1/5
Resolves API functions dynamically
1/5
Enables process privileges
1/5
Possibly does reconnaissance
1/5
Creates process with hidden window
1/5
Performs DNS request
1/5
Connects to remote host
1/5
Queries system time
Spyware
D7DF7432FACECF6777CA95E027A71523.exe
2026-09-21T20:48:53.402
malicious
Windows Exe (x86-32)
Close
D7DF7432FACECF6777CA95E027A71523.exe
malicious
SHA256:
50d17d8b9dcc75d7544d7de6ad80b3325d659521ccd819bb89950aa0ab312d24
VMRay Threat Identifiers
Close
Severity
Operation
5/5
QuasarRAT configuration was extracted
5/5
Combination of other detections shows multiple input capture behaviors
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
4/5
Malicious host or URL detected via reputation
3/5
Performs DNS request for known DDNS domain
3/5
Injects a file into another process
3/5
Monitors keyboard input
3/5
Obscures a file's origin
2/5
Collects BIOS properties
2/5
Queries OS info via WMI
2/5
Collects hardware properties
1/5
Performs DNS request
1/5
Enables process privileges
1/5
Creates mutex
1/5
Queries system time
1/5
Creates process with hidden window
1/5
Query OS Information
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Resolves API functions dynamically
Spyware
Backdoor
8F462114987395654DFF0964032DCBD2.dll
2026-09-21T20:48:32.480
malicious
Windows DLL (x86-32)
Close
8F462114987395654DFF0964032DCBD2.dll
malicious
SHA256:
6a23d35d3cb74dc431d224e82092a737382d5a77764a72ed02fee66a4de1271b
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
ValleyRAT configuration was extracted
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
2/5
Enables critical process privileges
2/5
Signed executable failed signature validation
2/5
Schedules task
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Loads a dropped DLL
1/5
Tries to detect debugger
1/5
Enumerates running processes
1/5
Creates mutex
1/5
Kills process
1/5
Creates process with hidden window
1/5
Writes an unusually large amount of data to the registry
1/5
Enables process privileges
1/5
Performs DNS request
Backdoor
A52C02B1AC57C2ACFCDE614C4CAA6267.dll
2026-09-21T20:48:08.076
malicious
Windows DLL (x86-32)
Close
A52C02B1AC57C2ACFCDE614C4CAA6267.dll
malicious
SHA256:
32d195e50e56edeb303a1c2df2ecb96ef0a71713ccd34745486048c84c8210ce
VMRay Threat Identifiers
Close
Severity
Operation
5/5
ValleyRAT configuration was extracted
5/5
Malicious content matched by YARA rules
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
3/5
Tries to evade debugger
2/5
Schedules task
2/5
Enables critical process privileges
2/5
Signed executable failed signature validation
2/5
Delays execution
1/5
Tries to connect using an uncommon port
1/5
Content matched by YARA rules
1/5
Resolves API functions dynamically
1/5
Drops PE file
1/5
Loads a dropped DLL
1/5
Connects to remote host
1/5
Kills process
1/5
Creates process with hidden window
1/5
Enables process privileges
1/5
Writes an unusually large amount of data to the registry
1/5
Tries to detect debugger
1/5
Enumerates running processes
1/5
Performs DNS request
1/5
Creates mutex
Backdoor
99E800599A55A8C337092FE6A4E4DDCE.dll
2026-09-21T20:47:32.744
malicious
Windows DLL (x86-32)
Close
99E800599A55A8C337092FE6A4E4DDCE.dll
malicious
SHA256:
899f994ad277c633879683a8502002c1ca6a5e4db02b7eb233e552b502c1ea42
VMRay Threat Identifiers
Close
Severity
Operation
5/5
Malicious content matched by YARA rules
5/5
ValleyRAT configuration was extracted
4/5
Malicious file detected via reputation
3/5
Suspicious content matched by YARA rules
2/5
Delays execution
2/5
Suspicious content matched by YARA rules
1/5
Query OS Information
1/5
Writes an unusually large amount of data to the registry
1/5
Collects hardware properties
1/5
Creates mutex
1/5
Enumerates running processes
1/5
Connects to remote host
1/5
Tries to connect using an uncommon port
1/5
Resolves API functions dynamically
Backdoor