windows · Index

Karuzip.Karuzip 2d ago windows

016eb05034fe92b5f4c0b53d3749922fce328cc456d2303286ab9a763cca84a0 K₃(LiMcTe)O₉(C₉Er₈As₁₆Al₃Dy₃ILaP₃Pr)H₁₁(Cm₁₇Cr₃Db₁₄DsF₁₇Hf₄Mg₂Os₁₉Po₁₇Ti₂U₅)Md₆(Bi₂₃BkPaPt₂Si)

92% staging/tiny-peinjection/shellcode

DeskRipple.DeskRipple Sep 12 windows

5bac65cd5bc1490243be0a35929f9dfda87bd4df0dbae85a9822ae0814b5f7b3 K₂(AmLi₃)O₄(As₂Dy₂Er₂Pr)H₁₁(Cm₉Cr₂Db₅DsF₁₃Hf₂Mg₃Os₂₀Po₁₅TiU)Md₇(Bi₁₃BkPa₃Si₄V)Th₂

86% AgentTesla infostealer payload embedded

laurentiu021.SysManager v1.88.2 Sep 10 windows

f99e3f6c25ec93830a8a6784ac6130ad3b6748117b94af326e893c3e598df720 K(Li)O₃(Er₃DyPr)H₈(Cm₃Db₆F₆HfMg₃Os₁₄Po₁₂U)Md₅(Bi₁₁PaSi₄)Th

99% AMSI patch, self-extract, evasion

Microsoft.SafetyScanner Sep 5 windows

dc4564d683b0b42e5e5374076316ef95764f454cfbfe0b084bc79b2cdc7087d2 K(Am₃)O₅(Er₆I₃As₄P₃Pr)H₁₀(F₂₁Cm₁₁Cr₅Db₁₁Hf₂Mg₅Os₄₀Po₂₂Ti₂U)Md₇(Bi₉HePaSi₃)

99% Legitimate Microsoft Defender component

strix Sep 5 windows

1f656bc10442bef270ad85e331d74ccaa5355c8c61803dd561861bd391648d35 K₃(Am₃Li₁₆Te₂)O₁₁(C₂Er₇S₂AlAs₄Ca₃Co₂Dy₃Eu₂PrXe)H₁₁(Db₄₆Cm₁₀₀Cr₁₇DsF₄₁Hf₉Mg₆Os₄₃Po₃₉Ti₂U₁₅)Md₈(Bi₁₀Bk₅LiPa₁₀PtSi₄)Th

98% Legitimate AI security testing tool

zeebe Sep 5 windows

d66ba97c01fb494e0b8e271df1a711966dbb90dcc428a20d8a72503e00e9e46a K₂(Am₂Li₄₉)O₉(C₆Eu₂Al₂As₁₁CaCoDyErXe₂)H₁₁(Cm₇₀Cr₁₄Db₅₁Ds₂F₂₉Hf₄Mg₃Os₂₆Po₃₄Ti₃U₁₅)Md₁₁(ArBi₁₀Bk₄HeLiPa₄Pt₂Si₃V)Th

92% CAPE/Nitrogenloaderconfigloader/stage

ErichDonahue.SpinnerforDiscogs Sep 1 windows

3eb076af62b928d4701b6ab479cdf21dbc034fd9c221ce0a18a457568a2ae8e7 K₂(AmLi₄)O₃(CErPr)H₁₁(Cm₃₅Cr₁₂Db₁₃DsF₂₆Hf₅Mg₇Os₁₈Po₂₀Ti₂U₄)Md₆(Bi₁₂Bk₂LiPa₃Si₂)Th

94% Signed malware with RAT capabilities

JasonMeng.rolltape Sep 1 windows

0591ecbb24c912cddaff9342523b4cb13446eb9c24e9548424ac1e12788f9d46 K₂(Am₂Li₁₃)O₈(Al₂AsCCaDyEr₂PPr)H₁₁(Cm₄₅Cr₁₄Db₁₃Ds₄F₂₆Hf₁₆Mg₅Os₃₈Po₃₅TiU₁₂)Md₉(Bi₁₃BkHeInPa₁₄PtSi₆)

55% Keylogger, screen capture, anti-analysis

Drovio.Drovio Aug 31 windows

4eab6feb7c7dfdf1c302606022c81ddf032cb8fc6f1bfe837158d8fcfd0b6e7f K₃(Am₂Li₃Te)O₈(AsC₃Co₂PAlDy₂Er₂Pr₂)H₁₁(Po₂₄Cm₂₄Cr₁₅Db₇Ds₂F₁₆Hf₇Mg₄Os₃₇TiU₇)Md₈(Bi₁₆BkHeLiPaPt₂Si₄)

96% Keylogger, injection, evasion, C2

Mailbird.Mailbird Aug 31 windows

d3bdbbcf0cefbd8da1ad2e3a38a27bc5bb4d6c7074ba4d32d14023b99deea001 O₅(C₂CoEuErXe)H₉(Cm₆DbF₁₀Hf₂MgOs₁₅Po₁₃TiU₃)Md₆(Bi₆BkPaPtSi₂)

97% Legitimate signed Mailbird installer

UrBackup.UrBackup.Server Aug 30 windows

b381551a3cb46e29064319f17e134a0786b1073f61004c68497e954998c51086 K₂(Li₇Te)O₁₀(As₈C₃Er₃Xe₂CaCoDy₂IPPr₂)H₁₁(Cm₄₈Cr₁₀Db₃₅Ds₂F₂₇Hf₄Mg₃Os₃₅Po₃₂Ti₃U₁₀)Md₉(Bi₁₄BkLiPaPdPtSi₄V)

67% Legitimate UrBackup installer

DynamoRIO-Windows 11.91.20692 Aug 30 windows

bd8491967cf56aa8772c595070514c0cbf61faf87d1f8b3afdfab9126450e515 K₂(AmLi₃)O₁₂(As₅C₄Al₅Er₈P₂Pr₂CaCo₂Dy₂I₂S₂Xe)H₁₁(Os₂₃Po₃₂Cm₂₁CrDb₁₉DsF₂₀Hf₅Mg₈Ti₄U₆)Md₇(Bi₁₁Bk₂HePa₂PdSi₄)Th

92% infrastructure/ip-portloader/stage

Unity.TuanjieHub Aug 29 windows

8b3191b2403e41e859d6c6fd0026bc6150603271fc2bb08e93de6bd0e3c24ffb O₄(AsCEr₂I)H₇(CmDbDsF₉Os₇Po₃U)Md₅(Bi₈BkPaSi₂)

98% Signed legitimate NSIS installer

chisel Aug 29 windows

907e1538ab86522fa4b11d7e45192b5f54e74beb88745093f6b2ca5b6e4efbc8 K(Mc)O₄(C₅As₃DyI₂)H₉(Cm₂₂Cr₁₂Db₅F₅HfMgOs₇Po₄U)Md₃(Bi₂Bk)Th₂

92% CNC/ChiselChisel/Strings

YouXiao.YXCalendar Aug 28 windows

fb1eedb4dffa24266bebc3b1e22054abcbb0156238fe4de74c8e9ef7f9d6d5a7 K(Li₃)O₄(Co₂Er₂CI)H₁₁(Cm₂₃Cr₁₃Db₁₅DsF₁₁Hf₈Mg₂Os₂₀Po₁₈Ti₂U₆)Md₄(Bi₁₄Pa₂Si₂)

94% Process injection and C2 backdoor

JumpingBytes.ClipboardMaster Aug 27 windows

2282040b04f2c02543bf2bb9049f9ffd437eb64dac0ddef636fcaa85e13b356a K(Li)O₅(C₂CoEuEr₂Xe)H₁₀(Cm₇CrDb₂F₁₀Hf₂MgOs₁₆Po₁₃TiU₃)Md₆(Bi₆BkPaPtSi₂)

92% screenshot/capturestealer/surveillance

Google.AndroidStudio.Canary Aug 27 windows

6ca987be9ef05463a470de7f2aeec31bd88dff652cb8fae679805391546527d1 K₅(Mc₂Am₄Li₄₀Te₄)O₁₃(C₅Er₁₁Al₂As₆Ca₃I₂P₃Co₂Dy₄EuPr₃S₂Xe₃)H₁₁(F₆₄Mg₈Os₆₄Cm₉₀Cr₁₅Db₅₄Ds₄Hf₁₄Po₈₀Ti₅U₁₄)Md₁₂(ArBi₁₈Bk₅He₂Li₂Pa₁₁Pt₄Si₇)

99% Legitimate Android Studio installer

ollama Aug 27 windows

5065f5c3d9d50c2039e070a637e373dae8310d4e7cdb80443af832568e7b812b K(Am)O(C)H₇(Cr₂DbF₂Mg₂Os₆Po₄U)Md₄(Bi₇PaSi₂)

99% Signed Ollama installer

Microsoft.AdvertisingEditor Aug 26 windows

ee195af52d8532d21cfcb8b8d635f4d249d9b37203d1df22c4fdd26980d828eb K₂(AmLi₂)O₂(AsEr)H₁₀(Cm₃CrDb₂F₆Hf₂Mg₃Os₁₆Po₁₂TiU)Md₇(Bi₁₀BkPaSi₄)Th₂

72% AgentTesla payload, AMSI evasion

laurentiu021.SysManager Aug 25 windows

fdc7f3ac20e5560fb7a96ee06643983680ebf0257c6aa87340724e523552ac98 K(Li)O₃(Er₃DyPr)H₇(Cm₃Db₆F₆Mg₃Os₁₄Po₁₁U)Md₅(Bi₇PaSi)Th

99% AMSI patch, self-extract, evasion

cakhiatvz.vc_hyber.exe Aug 24 windows

006f44f06e64473a1eb971aa71c67fc07f24af3984d12972d082d1dcc8f71fa2 ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

92% Ransomware/Gen1uac-bypass/hijack

file Aug 24 windows

2199808b5669b6d4d316ad5f0f2ec8a29c796f178ee43ce2c1166d2d468cecea ✓ O(C₃)H₄(Cm₆FOs₂Po₅)Md(Bi)

100% Direct-IP dropper with anti-debug

59616120b2be5d3c2f79d8379c9f3fb004adaf01a81742ebd2443e28b7d5e665.exe Aug 24 windows

59616120b2be5d3c2f79d8379c9f3fb004adaf01a81742ebd2443e28b7d5e665 ✓ O₄(CCoDy₂Er₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₄Po₈)Md₃(Bi₂BkPa)Th₆

99% XWorm RAT with C2, keylogger

happytreasure.io_ransome.exe Aug 24 windows

438bc331c5a3fe57acd78fa8c68573052ca8546adb0ec741b0b79fc8052fd761 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% Ransomware with stealer, C2, evasion

5620d27fa1bb9a0b372545490e9abfd7d54c9ac2b50928a7b0718336256c0b66.exe Aug 24 windows

5620d27fa1bb9a0b372545490e9abfd7d54c9ac2b50928a7b0718336256c0b66 ✓ K₃(Mc₂Am₂Li)O₁₁(Ca₈Co₃Er₇I₂PrAl₄C₂P₃Xe₃Dy₅Eu₂)H₉(Hf₇Cm₁₃Cr₅Db₁₁F₉MgOs₂₆Po₂₀U₄)Md₅(Pa₂Bi₅BkPt)Th₄

99% StormKitty infostealer with embedded HVNC RAT

file Aug 24 windows

5e6d5240402036291aff059a205ae94c60b72e45b6faae2f3567d7e7368f5d16 ✓ O₄(C₂Ca₂ILa)H₅(Cm₈DbF₂PoTi)Md(Bi)Th

92% channel/emailransom/extortion

5f6e4a8d17a5d15cc001300ad8373515b8f548c0ab129fe67ef597a59467423f.exe Aug 24 windows

5f6e4a8d17a5d15cc001300ad8373515b8f548c0ab129fe67ef597a59467423f ✓ K₂(McAm)O₇(IAl₃Ca₂P₃AsDyEr₂)H₇(Cm₂Cr₄Db₅F₅HfOs₈Po₇)Md₂(Bi₂Pa)Th₅

99% AsyncRAT with wallet theft

happytreasure.io_chrome.exe Aug 24 windows

7a19174655b0fc6258182530a998cdaa938612c1507103b53b20375ac6f2105e ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

99% Ransomware, keylogger, data exfiltration

hpware-free (1).exe Aug 24 windows

a8ba71e10cda46a459a4a1acb28d2fb7549c2c1f5638acd4e441345dec45500d ✓ K(Ga)O₂(Er₃C)H₉(Cm₃DbDsF₆HfMg₂Os₃Po₁₃U)Md₂(Bi₄)

100% Game cheat injector with AV evasion

3a69743c2e6248b3cfd9ed4b1f24d411aba3a5dc7cd2b787e23e0a77094bfc19.exe Aug 24 windows

3a69743c2e6248b3cfd9ed4b1f24d411aba3a5dc7cd2b787e23e0a77094bfc19 ✓ K(Am)O(As₂)H₂(Db₃Po)Md₄(Bi₄BkPa)

99% CCleaner masquerade, reflective payload

happytreasure.io_nano.exe Aug 24 windows

646434da9a33bec695b5c80c61e1aaa0c22813694bd0abc3e192b0efc3d7ffe1 ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, hollowing

LocationNotificationWindows.exe Aug 24 windows

bedf7004c639d4c848bbdc4a12b7c04fc90bdde9eb55ae1155cdfe42b88e27b2 ✓ O₂(CP)H₇(Cm₅Cr₃DbF₅Hf₃Os₅Po₅)Md₃(Bi₃BkPa)Th₃

93% MasonRAT malware with C2 and persistence

cakhiatvz.vc_chrome.exe Aug 24 windows

b8387caabf3d8bfcad1fab81370021836a6a7aeaa5f6b0e066ec02ed64d48b0b ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

92% Ransomware/Gen1uac-bypass/hijack

cakhiatvz.vc_ransome.exe Aug 24 windows

e1f05f6d6b9721a5ebc1c9bdfea9e629172a6e943ff6570ab8bc79b66dc82b81 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

92% Ransomware/Gen1uac-bypass/hijack

cakhiatvz.vc_nano.exe Aug 24 windows

70d3dff05c0511e092808f4ce15be963de45bde893124da9bdffd857fb62b34e ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

92% Ransomware/Gen1Sample/May18

happytreasure.io_hyber.exe Aug 24 windows

a60c49616847989234825dbcb909d12ed89bf319590b5139b70793a60a5bc6fb ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

92% Ransomware/Gen1uac-bypass/hijack

69daa1a225ee2c4680838016d6ad87e391834c441a9e96f56701e1722dbf7ab6.bin.exe Aug 24 windows

69daa1a225ee2c4680838016d6ad87e391834c441a9e96f56701e1722dbf7ab6 ✓ O₂(Er₂As₂)H₅(Cr₂Db₂MgOs₂Po₂)Md₃(Pt₃Bi₂Si₃)

99% obfuscated Go DLL, memory exec

ea5b61bc8d140124753c3ec265b5542e0dc5323bfc613e365339a4819808360b.exe Aug 24 windows

c20e18f5a2efcdb5a128991570c50bb57236d9b09667cc5cfece1f9ada6e2129 ✓ O₂(AlAs₂)H₂(OsPo)Md(Bi₂)

100% Importless PEB loader, anti-debug, obfuscation

97f5bd9347bb579899de04cd24947af7ea65f9c69fa91cf24435e71205c76a26.exe Aug 24 windows

97f5bd9347bb579899de04cd24947af7ea65f9c69fa91cf24435e71205c76a26 ✓ O(As₂)H(U)Md(Bi₅)

98% packed, obfuscated, unsigned executable

0625595cc9f373c417d09a8fadf6d62f4f678de169c80039c151e1db599e7747.exe Aug 24 windows

0625595cc9f373c417d09a8fadf6d62f4f678de169c80039c151e1db599e7747 ✓ O(As₃)H₂(Db₃Po)Md₃(Bi₃BkPa)Th

100% ConfuserEx obfuscation, bitmap payload

Troubleshoot.ps1 Aug 24 windows

2a2d95fb5b65afd366c31aa8057712c17c3364f34ccd7d52eb7a03ca5c2f060e ✓ O(C₂)H₄(Cm₅F₃Os₂Po₃)

99% Downloads and installs remote MSI

file Aug 24 windows

bfd7b0764cac3148805c3d8d13e8a07b2f3e030a40f52c5796c8cb3c0548750b ✓ O(C₃)H₄(Cm₆FOs₂Po₅)Md(Bi)

100% Direct-IP dropper, anti-debug, unsigned

88i.jp.net_new.exe Aug 24 windows

19358419ec877b39fb7f06bdae80d2e866865de11926154c389bd2651a68f131 ✓ O₄(PrCoErP)H₆(Cm₄F₅Hf₅MgOs₇Po₁₀)Md₃(Pa₂Bi₃Bk)

97% Keylogger, stealer, reverse shell, UAC bypass

doc 20260824_9000001rfq001.exe Aug 24 windows

50d45ea5f67cd018b72fbcced629ce9159a7b914750adc78f6e4f29c866db426 ✓ O₂(As₂Er₂)H₃(Cr₂Db₃Po)Md₃(Bi₄BkPa)Th

100% ConfuserEx obfuscation, reflective payload

051EFD15A1C7D57E40E72E073898F0C4.exe Aug 24 windows

7146aa6b97153b033def7ea490d8a5f24c1f0140855db29311b9e81ba132cb2b ✓ K(Mc)O₃(As₃CEr)H₆(CmCr₄DbF₄OsPo₅)Md(Bi₂)Th₅

92% JPCERT/NanocoreWin/Nanocore

Loader.exe Aug 24 windows

80a6198193bb626394e05d800cf47c5aef38b80c5c596074be236e702b4ce6e3 ✓ K₂(AmLi)O₇(As₂Ca₅Er₄I₃PrAl₃P)H₇(Cm₈Db₆F₇Mg₃Os₁₇Po₁₅U)Md₅(Bi₈BkPaSi₂)Th

100% Credential stealer with evasion and persistence

ScreenWings.exe Aug 24 windows

e4ade0eccfadfcddd5e661ff81df733a961e6d16cd0b154ecf2f93f21259affa ✓ K(Am)O₄(AlCa₂AsPr)H₁₀(Cm₄Cr₃Db₄DsF₉Hf₄Mg₂Os₁₃Po₁₀Ti)Md₃(Bi₂Bk)Th

100% Massive crypto-wallet credential stealer

file Aug 24 windows

ed431c5a762490d667792f40f99766bd1cca355663766332e181ed5396d67def ✓ O₄(C₂Ca₂ILa)H₅(Cm₈DbF₂PoTi)Md(Bi)Th

99% Sextortion malware with SMTP mailer

VeraxCore.exe Aug 24 windows

088133dfeca151a87b20f33e9ce1d4490b524b48c4ee68302e1dd85742c677ba ✓ O₇(Er₆AlC₂CoAsDyP₂)H₁₁(Cm₁₂Cr₄Db₂Ds₂F₁₄Hf₄Mg₂Os₂₄Po₁₅TiU₃)Md₆(Bi₄BkLiPaPt₂)Th

99% AV masquerade, injection, persistence, C2

88i.jp.net_chrome.exe Aug 24 windows

393b8b3ac46fb49dcd6107be7a0721784865ff7dfb00b5890b8ba3bd5c74b4af ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

99% Ransomware, keylogger, exfiltration, AV evasion

XClient.exe Aug 24 windows

53c3b05c1e871ee9aad4cb587e13d930545137bfdda5fc58db5132a422da0503 ✓ O₄(CCoDyEr₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₃Po₈)Md₃(Bi₂BkPa)Th₅

99% XWorm RAT with C2, keylogger, DDoS

88i.jp.net_ransome.exe Aug 24 windows

58fbffa2a0798dc33ddce93c4749c21aff9d89b70c49ce1e394e70465bffbd4b ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% Ransomware with stealer, C2, evasion

88i.jp.net_nano.exe Aug 24 windows

9d29978a66049566ed4cb6d9c9345b6d088758e4ca4e100b4a0ace63164a361b ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, hollowing

88i.jp.net_hyber.exe Aug 24 windows

23c889be21ba3734fd6eb03fd82418de07df4feea8cc1bf7757d207a177bd90a ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, injection

cx-programmer 9.1 free download full.exe Aug 24 windows

1a44bfbdd9f4bbca790207cdd75e4b263922178077d616e1905ae84d55815ea0 ✓ O₂(As₂C)H(Os)Md₂(BiPt)

97% Obfuscated Go dropper, fake name

client.exe Aug 24 windows

3b2e435dc9bea6c2123f9c725543a6140cef01884c9c11ad76a0c2581ee8684d ✓ O₂(AlC)H₆(Cm₂Cr₃DbF₃Os₂Po₂)Md(Bi)

99% C2, sandbox evasion, crypto, process injection

4ff863b60d5d5d4fb86764e6b6bb25677d2a3086c33fc.exe Aug 24 windows

4ff863b60d5d5d4fb86764e6b6bb25677d2a3086c33fccc3f09e707937b8d4a9 ✓ O₂(As₂C)H(Os)Md₂(PtSi₃)

92% obfuscator/garbleexecution/windows-loader

recuva_professional__technician_(2026)_full_español_[mega].exe Aug 24 windows

9dba35a99fdb8ece94c944267dbfd1321101c47c650d41f94ecf7f9f283e9db1 ✓ O₂(As₂C)H(Os)Md₂(BiPt)

97% Obfuscated Go malware masquerading as Recuva

file Aug 24 windows

0191133b622f9729ebd313976e44e311a9c17e5fd9f8600ba3c9dea0f649a809 ✓ O₃(AsErP)H₅(Cm₄Db₂MgOs₄Po₃)Md₂(Bi₄Pa)

74% Signed masquerade, packed, C2, persistence

socolivesa.io_chrome.exe Aug 24 windows

0a149162b0be4633819cbe3d7161f4e78f30d0ad76d105b1be3a81f981968d05 ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

99% Ransomware, keylogger, stealer, AV evasion

client(4).exe Aug 24 windows

0cf09b6b6bd0161ab1c53e333379ff7c9dac4dde29fcdd44112e45dd0d5cbb2b ✓ O₂(ErXe)H₈(Cm₉Cr₇Db₂DsF₂Hf₂Os₆Po₆)Md(Pt)Th

100% SparkRAT backdoor detected

FLStudio2025_v131_Win.exe Aug 24 windows

0f5e6fbd1e12c2653146c7c18cb55c7e4f9d7e241f299d323a3caf12c13c7727 ✓ O(As₄)H₃(Cr₂Db₃Po₂)Md₃(Bi₄BkPa)Th

100% Obfuscated .NET dropper with reflective execution

xem-socolive.com_ransome.exe Aug 24 windows

15f821663f1590aa66706e1c3b6cd16929288f5b77aad3359a618a019d036ff8 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% Ransomware with stealer, C2, evasion

arcane.exe Aug 24 windows

199535206fa0f9d8f2af53440d9c7d3051d1227236a53fba46a5391f7f732134 ✓ O₂(AlC)H₆(Cm₂Cr₃DbF₃Os₂Po₂)Md(Bi)

99% C2, sandbox evasion, crypto, process injection

hay88.exe Aug 24 windows

1f06cbd93cb31b48af388fc81d33c19810e5ef31a3720a248bc63f8f7ed76d57 ✓ K(Mc)O₆(IAl₃P₃AsDyEr₂)H₆(Cm₂Cr₄Db₅F₂Os₈Po₅)Md₂(Bi₃Pa)Th₅

99% AsyncRAT malware payload

incesto.nl_chrome.exe Aug 24 windows

213523e6ad2ca74a9aae710e9dc76ecc313907966d75b47c9e4f479a4a979d32 ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

99% Ransomware, keylogger, data exfiltration

Server.exe Aug 24 windows

2cbfc9f447f6338b365dfd5a9fe5962e1b8f0a8d73ae715128221d9e9939eacb ✓ K(Mc)O₄(CCoErI)H₇(Hf₂Cm₂CrDb₂F₄Os₃Po₆)Md₃(BiBk)Th₆

100% NjRAT malware with C2, persistence, evasion

3dd9f794833b29db94173ee707a300162e388cf75357e494e328954b5d61c650.exe Aug 24 windows

3dd9f794833b29db94173ee707a300162e388cf75357e494e328954b5d61c650 ✓ O₄(CCoDy₂Er₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₄Po₈)Md₃(Bi₂BkPa)Th₆

99% XWorm RAT with C2, keylogger

Download_Movie_Maker_2.6_For_Windows_7.exe Aug 24 windows

482fa07dd6635918997e856854b64285e1a631f873cee83b9c7f92c78cb4caca ✓ O₂(As₂C)H(Os)Md₂(PtSi₃)

97% Obfuscated Go dropper, C2, self-signed

Loader.exe Aug 24 windows

5c8e45cbc43e5e7b15d41c0e4bf245e9b904b4d316db90448ecf10e6eb080ece ✓ K(Li)O₂(AlCa₂)H₁₀(Cm₅Cr₃Db₃DsF₈Hf₄MgOs₁₀Po₇Ti)Md₃(Bi₄BkPa)

97% Browser credential stealer with anti-debug

8d1ce2c612537f4537df7192715a8be98312cd9c6cd60757c294493c7fc180ac.exe Aug 24 windows

8d1ce2c612537f4537df7192715a8be98312cd9c6cd60757c294493c7fc180ac ✓ K(Mc)O₆(IAl₃P₃AsDyEr₂)H₆(Cm₂Cr₄Db₅F₂Os₈Po₅)Md₂(Bi₂Pa)Th₅

99% AsyncRAT malware payload

lolo.exe Aug 24 windows

933cf20cc75ff8400c6d70b3901f7f0e16b883611871e08cb2f2987494469f2c ✓ O₅(CCoIDyEr₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₄Po₈)Md₃(Bi₂BkPa)Th₄

92% Backdoor/AsyncratCAPE/Xworm

incesto.nl_hyber.exe Aug 24 windows

9e30a9a2bf5d75136074234a5a86b8f056f0d9792cff6833828df049402c32be ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, injection

incesto.nl_nano.exe Aug 24 windows

aebf37ebb0fb1336be1da2de9f8cd24620ecafc681623987e1a32d7fbc7e34c1 ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, hollowing

incesto.nl_ransome.exe Aug 24 windows

d31431db6b0f28937b858fb8772700cf1f596973b4db80c984bf348a16d1d675 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% Ransomware with stealer, C2, evasion

socolivesa.io_new.exe Aug 24 windows

d8af3c83bd5e5b801ef62344a85e1622d57e2f39569dfaca950a16bea07a91ab ✓ O₄(PrCoErP)H₆(Cm₄F₅Hf₅MgOs₇Po₁₀)Md₃(Pa₂Bi₃Bk)

97% Keylogger, stealer, reverse shell, UAC bypass

xem-socolive.com_nano.exe Aug 24 windows

efb99ef957a7e9d5b39ec6bac90eb169635f1271326d6ec1fb41678319aecde1 ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, hollowing

MasonClient.exe Aug 24 windows

02b9d5e936a3a5a0ac3fcd28832810a633e725018394173c3f5ff56938c74573 ✓ O₃(CEr₂Xe)H₅(Cm₃Cr₂Mg₂Os₂Po₉)Md₄(Bi₄BkPaPt)

97% Masquerades as svchost, reverse shell, C2

EAX Setting.exe Aug 24 windows

13eb9ca67fc7a57e34e5f19462bee5454231966c7bee0c6d2d8fe6f6048d34f9 ✓ O₄(CEr₃P₃Xe)H₆(Cm₃Cr₂F₂Mg₂Os₈Po₉)Md₄(Bi₃BkPaPt)

99% Reverse shell, persistence, AV evasion

socolivesa.io_hyber.exe Aug 24 windows

20db868ea283a1f2d41547ec4eabc9b1e1a963ca315eb5abdd7e9ebc057001fa ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, injection

xem-socolive.com_new.exe Aug 24 windows

311e814ba2b5bd3e949935626dcf3fa538467ee93f22b44b53b055187bd20139 ✓ O₄(PrCoErP)H₆(Cm₄F₅Hf₅MgOs₇Po₁₀)Md₃(Pa₂Bi₃Bk)

97% Keylogger, stealer, reverse shell, UAC bypass

xem-socolive.com_chrome.exe Aug 24 windows

37cf7d6f8964a08a2edd194407309c5924e9ad2103aa3a1ae22e134d44daa59f ✓ K(Am)O₇(Er₄I₅PrAl₂LaP₂Xe)H₉(Cm₄CrDb₂F₈Hf₄MgOs₇Po₁₀U₂)Md₃(Bi₂BkPa)Th

99% Ransomware, keylogger, stealer, AV evasion

ratio_ghost.exe Aug 24 windows

4793b362747bd9cdfdb8a10bcfb6955f5a57dac1b71c5e1700df1af1b76b4468 ✓ O₃(AsC₂Er)H₇(Cm₂Db₃FMgOs₅PoU)Md₂(Bi₇Pa)

100% Packed dropper with privilege escalation

incesto.nl_new.exe Aug 24 windows

4a77cbbddedc441421afdae4954a30f7d1d0e91de7844d1f30abf71c4651779f ✓ O₄(PrCoErP)H₆(Cm₄F₅Hf₅MgOs₇Po₁₀)Md₃(Pa₂Bi₃Bk)

97% Keylogger, stealer, reverse shell, persistence

8437f141b392c50cb27717fef260b9bc0509178eb7919afe96b637b30cdca5d8.exe Aug 24 windows

8437f141b392c50cb27717fef260b9bc0509178eb7919afe96b637b30cdca5d8 ✓ K(Mc)O₆(IAl₃P₃AsDyEr₂)H₈(Cm₂Cr₄Db₆F₂HfOs₉Po₆U)Md₃(Bi₂Pa)Th₄

99% AsyncRAT payload with C2 and persistence

XClient.exe Aug 24 windows

c4c0c4bbdb2fc07f1e96c340cd4845955eac969b5a757fa9f7eac33d195dd66e ✓ O₅(CCoIDyEr₂)H₇(Cm₄Cr₃Db₃F₂Hf₃Os₄Po₈)Md₃(Bi₂BkPa)Th₄

99% XWorm RAT with C2, keylogger, DDoS

xem-socolive.com_hyber.exe Aug 24 windows

d2a8b4929e4d6630839a0e052a7e821b4eb3a5ef34685fe590e6e2c4e331d1da ✓ K(Am)O₈(CI₅PrAl₂Er₃LaPXe)H₉(Cm₆CrDbF₇Hf₂MgOs₇Po₁₀U)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, injection

socolivesa.io_ransome.exe Aug 24 windows

d4aadd5056ea8ee265bf0cbcb39c80020a02b1583e61adfa902e45894126bbf3 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% Ransomware with encryption and evasion

rrrrrrrr.exe Aug 24 windows

39c878aa7230e728f17b34f2d6670bcb7ac3cae13537b1b890594d5ba79c02ad ✓ K(Mc)O₄(CCoErI)H₇(Hf₂Cm₂CrDb₂F₄Os₃Po₆)Md₃(BiBk)Th₆

100% trojan/njratJPCERT/Njrat

socolivesa.io_nano.exe Aug 24 windows

95d2082afbfcdc1e484c8a0bc3e3232d6f136b1c80a3e0d91dfd9bb6a96dd5b3 ✓ K₂(AmTe)O₉(Er₅I₄PrAl₂CCaDyP₂Xe)H₉(Cm₅Cr₃Db₂F₁₀Hf₄MgOs₁₂Po₁₂U₂)Md₃(Bi₂BkPa)Th

99% Ransomware with C2, keylogger, hollowing

cc900a5a94804cc09fa2009055e3ef4aca1e3b18b32358e8d9884da4d374712b.exe Aug 24 windows

cc900a5a94804cc09fa2009055e3ef4aca1e3b18b32358e8d9884da4d374712b ✓ K(Mc)O₆(IAl₃P₃AsDyEr₂)H₆(Cm₂Cr₄Db₅F₂Os₈Po₅)Md₂(Bi₂Pa)Th₅

99% AsyncRAT payload with C2 and evasion

Proforma48846599458494_____pdf.pif.exe Aug 24 windows

e0a61a28a03edb731c78d4a3f98aa2d3c39e4087d314f55694ae78112a099d86 ✓ O₂(As₄Er)H₃(CmDb₃Po₂)Md₃(Bi₄BkPa)Th

100% Obfuscated .NET, reflective bitmap payload

file.exe Aug 24 windows

250b1960593c2f18862ab5579c4830c26edec0a7b3238cf76db83337723cc431 ✓ O₄(C₂Ca₂ILa)H₅(Cm₈DbF₂PoTi)Md(Bi)Th

99% Sextortion malware with C2 and ransom

file.exe Aug 24 windows

d90d1bd6eb379fa5e2e910be754d95c5f395e804bd00799f5fcf74e02eeff972 ✓ O₄(C₂Ca₂ILa)H₅(Cm₈DbF₂PoTi)Md(Bi)Th

99% Sextortion malware with C2 and ransom

bleh.ps1 Aug 24 windows

d7066697d8e7c6b4b5e7724bd52ecf2ff44a7797502fa1e7c9f969397180275e ✓ O(As)H₃(Cm₂Db₂Os₃)Th

100% Obfuscated PowerShell downloader

a9b140ffc2de43182aa2dc35cf325eebdf5f0571a72a58ec85635ae10c266a6e.exe Aug 24 windows

a9b140ffc2de43182aa2dc35cf325eebdf5f0571a72a58ec85635ae10c266a6e ✓ O(As₂)H(U)Md(Bi₅)

98% packed, obfuscated, evasive PE

Client.exe Aug 24 windows

f4e46db8c10eaf3f40fa64f35732e7fd9d00b709e31e1a9458ffe80bb27a0786 ✓ O₂(CEr)H₇(Cm₂CrDb₄F₄HfOs₄Po₆)Md₄(Bi₄BkPa)

92% masquerade/binarydelivery/download-execute

mediabutler.io_ransome.exe Aug 24 windows

3420bf7dc8722e4fd1c93f7d5a65ec353a427f87e5c4303e1934bd12cd1d8c24 ✓ O₆(Er₂PrCoI₂AlP)H₉(Cm₄CrDbF₉Hf₆MgOs₉Po₁₀U₂)Md₃(Pa₂Bi₃Bk)Th

99% ransomware with stealer and reverse shell

tx_1787549142555.exe Aug 24 windows

e664a3cd0f9138b2b86cec56bf438849e45ec00117ef0bd19465eec1af19c92c ✓ O₂(Er₂As)H₄(Cm₂Mg₂Os₂Po₄)Md(Bi₅)

92% Process hollowing and injection APIs

c73cb93ad9ad6d003b505ce2b960d75467ad612786e0559c74dca18426fb9400.exe Aug 24 windows

c73cb93ad9ad6d003b505ce2b960d75467ad612786e0559c74dca18426fb9400 ✓ K(Li)O₃(PIEu)H₇(Cm₇Cr₁₀F₆HfOs₁₁Po₇Ti)Md₃(Bi₂Pt)Th₄

98% STOP ransomware with encryption and persistence