Threat Feed | Online Malware Sandbox

Windows Exe (x86-32)

csjmbg.exe

malicious

SHA256: 169113a2a9dc61ecc8d28a6b26d54486ec06fe7f9af3f6cb32455dd5f358092d

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

QuasarRAT configuration was extracted

3/5

Monitors keyboard input

3/5

Injects a file into another process

3/5

Obscures a file's origin

2/5

Disables a system tool

2/5

Schedules task

1/5

Modifies operating system directory

1/5

Enables process privileges

1/5

Creates mutex

1/5

Creates process with hidden window

1/5

Query OS Information

Backdoor

mko1.exe

2026-05-14T05:01:54.343

Windows Exe (x86-32)

mko1.exe

malicious

SHA256: 8c66c93d00fd52ad2efc773b29e339f3164bca178ea201009ba7d65a21f62e51

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

AsyncRAT configuration was extracted

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Tries to detect application sandbox

2/5

Schedules task

1/5

Downloads file

1/5

Tries to connect using an uncommon port

1/5

Enumerates running processes

1/5

Obfuscates control flow

1/5

Resolves API functions dynamically

1/5

Connects to remote host

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Query OS Information

1/5

Performs DNS request

1/5

Creates mutex

Backdoor

http://49.51.43.12/v3/signin/identifier?flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Patq4tAzRT8O-5vdK-Dqedv1zTRWjPILnevDvUSSFuu8FSs8CKf10yOBjNseKi2woF4QwjqKZg&dsh=S3673153%3A1778731454308458

2026-05-14T05:00:59.596

URL

malicious

SHA256:

VMRay Threat Identifiers

Severity

Operation

5/5

Combination of other detections indicates a phishing website

4/5

Phishing page detected via Machine Learning

2/5

Page uses exact same title as that of a popular online service

2/5

Branded Logon form detected via Computer Vision

1/5

Content matched by YARA rules

1/5

HTTPS page insecurely loads resources via HTTP

1/5

Branding image detected via Computer Vision

1/5

Page presents itself as a logon page

Phishing

iutngan.exe

2026-05-14T04:51:04.031

Windows Exe (x86-32)

iutngan.exe

malicious

SHA256: c52f07795607c12042cdff7cb2a29cdbbac6f40828495eb90659165a330e6ef7

VMRay Threat Identifiers

Severity

Operation

5/5

Malicious content matched by YARA rules

5/5

AsyncRAT configuration was extracted

2/5

Tries to detect application sandbox

2/5

Queries OS info via WMI

2/5

Collects hardware properties

2/5

Schedules task

1/5

Tries to connect using an uncommon port

1/5

Enumerates running processes

1/5

Resolves API functions dynamically

1/5

Possibly does reconnaissance

1/5

Connects to remote host

1/5

Creates process with hidden window

1/5

Enables process privileges

1/5

Executes WMI query

1/5

Performs DNS request

1/5

Creates mutex

Backdoor

New Instruction.pdf output_xjououe4.bat

2026-05-14T04:42:06.037

Windows Batch File

New Instruction.pdf output_xjououe4.bat

malicious

SHA256: 1b9fb328a733320aa7034578f4f3ae4cc2b62f97d0a7a3df9814e6b17af55520

VMRay Threat Identifiers

Severity

Operation

5/5

Sets up server that accepts incoming connections

4/5

Attempts to connect through HTTP

3/5

Bypasses PowerShell execution policy

3/5

A monitored process crashed

2/5

Performs DNS request

2/5

Executes PowerShell without default profile

2/5

Hides files

2/5

Downloads executable

1/5

Connects to remote host

1/5

CMD started with ambiguous arguments

1/5

Query OS Information

1/5

Accesses Microsoft Security Software registry keys

Backdoor

Downloader