{"id":123,"date":"2026-05-25T03:27:07","date_gmt":"2026-05-25T03:27:07","guid":{"rendered":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/"},"modified":"2026-05-25T03:27:07","modified_gmt":"2026-05-25T03:27:07","slug":"threatinfo-daily-digest-2026-05-25","status":"publish","type":"post","link":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/","title":{"rendered":"ThreatInfo Detection Digest: May 25, 2026"},"content":{"rendered":"
\n

ThreatInfo research digest<\/p>\n

A concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.<\/p>\n

\n
New report links<\/span>20<\/strong><\/div>\n
Tracked categories<\/span>5<\/strong><\/div>\n
Primary action<\/span>Verify hash<\/strong><\/div>\n<\/div>\n<\/section>\n
\n

Category overview<\/h2>\n
Adware<\/strong>4 new reports<\/span><\/a>PUP\/PUA<\/strong>4 new reports<\/span><\/a>Trojan<\/strong>4 new reports<\/span><\/a>Ransomware<\/strong>4 new reports<\/span><\/a>Virus<\/strong>4 new reports<\/span><\/a><\/div>\n<\/section>\n
\n

Reports worth opening<\/h2>\n
\n
\n

Adware<\/h3>\n

Review browser changes, bundled installers, extensions, and unexpected advertising behavior.<\/p>\n<\/div>\n

\n
\n
File<\/span>\u6309\u9375\u7cbe\u97482014.exe<\/a><\/div>\n
Detection<\/span>Adware.Gen<\/strong><\/div>\n
MD5<\/span>7d4967e51a40062ae97638c25a4c4ae4<\/code><\/div>\n<\/div>\n
\n
File<\/span>video.exe<\/a><\/div>\n
Detection<\/span>Adware.Gen<\/strong><\/div>\n
MD5<\/span>586431b19af2801990efbbb4e93f60d9<\/code><\/div>\n<\/div>\n
\n
File<\/span>A0429170.exe<\/a><\/div>\n
Detection<\/span>PUP.ELEX<\/strong><\/div>\n
MD5<\/span>5cd990681476c1089d3ac89ee2d92ae5<\/code><\/div>\n<\/div>\n
\n
File<\/span>A0432619.dll<\/a><\/div>\n
Detection<\/span>Adware.ELEX<\/strong><\/div>\n
MD5<\/span>77966913e9b938286c440c269225c878<\/code><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

PUP\/PUA<\/h3>\n

Check whether the file came from an installer bundle, optimizer, updater, or optional offer.<\/p>\n<\/div>\n

\n
\n
File<\/span>Uninstall (1).exe#895879AA94E52644<\/a><\/div>\n
Detection<\/span>Adware.SweetIM<\/strong><\/div>\n
MD5<\/span>89b7d9f41453942d50e5dcca70c44fec<\/code><\/div>\n<\/div>\n
\n
File<\/span>icudt (1).dll#46D3B0FF10AC4FD1<\/a><\/div>\n
Detection<\/span>Adware.SweetIM<\/strong><\/div>\n
MD5<\/span>6736b554a4b5f7140180c50ae7b11df2<\/code><\/div>\n<\/div>\n
\n
File<\/span>HostAppServiceInterface (1).exe#675BEF1A81797481<\/a><\/div>\n
Detection<\/span>Adware.SweetIM<\/strong><\/div>\n
MD5<\/span>39b53d508c9ac4ae7bcc0f87a82fb247<\/code><\/div>\n<\/div>\n
\n
File<\/span>WebAppHelper.exe#C0BF33F07971705C<\/a><\/div>\n
Detection<\/span>Adware.SweetIM<\/strong><\/div>\n
MD5<\/span>199c353a3c0830cbb01f19036a8d20fa<\/code><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

Trojan<\/h3>\n

Verify the hash and origin before trusting the filename; trojans often imitate legitimate software.<\/p>\n<\/div>\n

\n
\n
File<\/span>TNod-1.4.2.3.exe<\/a><\/div>\n
Detection<\/span>General Threat<\/strong><\/div>\n
MD5<\/span>57712fe52623737e2313d63494ec5ec5<\/code><\/div>\n<\/div>\n
\n
File<\/span>CryEA(1).dll<\/a><\/div>\n
Detection<\/span>Trojan.Agent<\/strong><\/div>\n
MD5<\/span>f7cd1b54e619e20add6d40148e301e59<\/code><\/div>\n<\/div>\n
\n
File<\/span>NEW (3).exe<\/a><\/div>\n
Detection<\/span>Ransom.Blocker<\/strong><\/div>\n
MD5<\/span>25a283f9dcaa5799876a4ae94a0ca385<\/code><\/div>\n<\/div>\n
\n
File<\/span>patineta.exe<\/a><\/div>\n
Detection<\/span>Spy.Keylogger<\/strong><\/div>\n
MD5<\/span>d03a8e1030a28df3fcf7f7317afd4a38<\/code><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

Ransomware<\/h3>\n

Prioritize isolation and backup checks when this class appears on an endpoint.<\/p>\n<\/div>\n

\n
\n
File<\/span>mongodump.exe<\/a><\/div>\n
Detection<\/span>Ransom.Exp<\/strong><\/div>\n
MD5<\/span>0535f7307efc8a47f99afc4bc0341072<\/code><\/div>\n<\/div>\n
\n
File<\/span>mongorestore.exe<\/a><\/div>\n
Detection<\/span>Ransom.Exp<\/strong><\/div>\n
MD5<\/span>bd078dc4a27c5259b15b1bd463b8b911<\/code><\/div>\n<\/div>\n
\n
File<\/span>maketx.exe<\/a><\/div>\n
Detection<\/span>Ransom.Exp<\/strong><\/div>\n
MD5<\/span>246793998f9f27e061d20498c782c63f<\/code><\/div>\n<\/div>\n
\n
File<\/span>Avengers.exe<\/a><\/div>\n
Detection<\/span>Ransom.Wacatac<\/strong><\/div>\n
MD5<\/span>1784fd66059ff3ee715231c6f775d6fc<\/code><\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n

Virus<\/h3>\n

Look for copied or modified executables and scan related files created around the same time.<\/p>\n<\/div>\n

\n
\n
File<\/span>vcredist_x64.exe<\/a><\/div>\n
Detection<\/span>Virus.Neshta<\/strong><\/div>\n
MD5<\/span>345e1b9c40d30fee0139ca550660a84f<\/code><\/div>\n<\/div>\n
\n
File<\/span>brew-m2upd1.exe<\/a><\/div>\n
Detection<\/span>Virus.Gen<\/strong><\/div>\n
MD5<\/span>8b52d9c37624eb520d1d3fa42cdb6b1c<\/code><\/div>\n<\/div>\n
\n
File<\/span>wininst-7.1.exe<\/a><\/div>\n
Detection<\/span>Virus.Neshta<\/strong><\/div>\n
MD5<\/span>13e7601fd1367266e4cb6af6c0222d28<\/code><\/div>\n<\/div>\n
\n
File<\/span>wininst-9.0-amd64.exe<\/a><\/div>\n
Detection<\/span>General Threat<\/strong><\/div>\n
MD5<\/span>32985605ac65dd7582eabab029cf932a<\/code><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/section>\n
\n

How to use this digest<\/h2>\n

Start with the MD5 hash, not the filename. If the hash or file path matches a system you manage, open the report, review the publisher and detection details, then scan the endpoint with GridinSoft Anti-Malware<\/a>. ThreatInfo reports show whether GridinSoft already detects the file and which detection name is used.<\/p>\n<\/section>\n","protected":false},"excerpt":{"rendered":"

ThreatInfo research digest A concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify … <\/p>\n

Read more<\/a><\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":""},"categories":[50],"tags":[],"yoast_head":"\nThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research<\/title>\n<meta name=\"description\" content=\"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research\" \/>\n<meta property=\"og:description\" content=\"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatInfo Research\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-25T03:27:07+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/threatinfo.net\/articles\/#website\",\"url\":\"https:\/\/threatinfo.net\/articles\/\",\"name\":\"ThreatInfo Research\",\"description\":\"Malware explainers, daily file-report links, hashes, GridinSoft detections, and remediation guidance from ThreatInfo Research\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/threatinfo.net\/articles\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#webpage\",\"url\":\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/\",\"name\":\"ThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research\",\"isPartOf\":{\"@id\":\"https:\/\/threatinfo.net\/articles\/#website\"},\"datePublished\":\"2026-05-25T03:27:07+00:00\",\"dateModified\":\"2026-05-25T03:27:07+00:00\",\"author\":{\"@id\":\"\"},\"description\":\"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.\",\"breadcrumb\":{\"@id\":\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/threatinfo.net\/articles\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ThreatInfo Detection Digest: May 25, 2026\"}]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research","description":"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/","og_locale":"en_US","og_type":"article","og_title":"ThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research","og_description":"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.","og_url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/","og_site_name":"ThreatInfo Research","article_published_time":"2026-05-25T03:27:07+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/threatinfo.net\/articles\/#website","url":"https:\/\/threatinfo.net\/articles\/","name":"ThreatInfo Research","description":"Malware explainers, daily file-report links, hashes, GridinSoft detections, and remediation guidance from ThreatInfo Research","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/threatinfo.net\/articles\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#webpage","url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/","name":"ThreatInfo Detection Digest: May 25, 2026 - ThreatInfo Research","isPartOf":{"@id":"https:\/\/threatinfo.net\/articles\/#website"},"datePublished":"2026-05-25T03:27:07+00:00","dateModified":"2026-05-25T03:27:07+00:00","author":{"@id":""},"description":"ThreatInfo detection digest with new file reports, malware categories, MD5 hashes, and GridinSoft verdict context.","breadcrumb":{"@id":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-25\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/threatinfo.net\/articles\/"},{"@type":"ListItem","position":2,"name":"ThreatInfo Detection Digest: May 25, 2026"}]}]}},"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":110,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-15\/","url_meta":{"origin":123,"position":0},"title":"ThreatInfo Detection Digest: May 15, 2026","date":"May 15, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":114,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-17\/","url_meta":{"origin":123,"position":1},"title":"ThreatInfo Detection Digest: May 17, 2026","date":"May 17, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":109,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-14\/","url_meta":{"origin":123,"position":2},"title":"ThreatInfo Detection Digest: May 14, 2026","date":"May 14, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":113,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-16\/","url_meta":{"origin":123,"position":3},"title":"ThreatInfo Detection Digest: May 16, 2026","date":"May 16, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":103,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-13\/","url_meta":{"origin":123,"position":4},"title":"ThreatInfo Detection Digest: May 13, 2026","date":"May 13, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":116,"url":"https:\/\/threatinfo.net\/articles\/threatinfo-daily-digest-2026-05-19\/","url_meta":{"origin":123,"position":5},"title":"ThreatInfo Detection Digest: May 19, 2026","date":"May 19, 2026","format":false,"excerpt":"ThreatInfo research digestA concise set of new file reports that were not used in recent digests. Each entry includes the detection name, MD5 hash, and a direct report link so analysts can verify the exact sample before taking action.New report links20Tracked categories5Primary actionVerify hashCategory overviewAdware4 new reportsPUP\/PUA4 new reportsTrojan4 new\u2026","rel":"","context":"In "Daily Digest"","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/posts\/123"}],"collection":[{"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/comments?post=123"}],"version-history":[{"count":0,"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/posts\/123\/revisions"}],"wp:attachment":[{"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/media?parent=123"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/categories?post=123"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threatinfo.net\/articles\/wp-json\/wp\/v2\/tags?post=123"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}