26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac.exe

Summary

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (1)

• C:\argus-vr-agent\quarantine\26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac_extracted\26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac.exe

MITRE ATT&CK

Indicators of Compromise (defanged)

• 235e8d1826b5d6248edec1b51737c155045f4055
• 631222ce7e5d47d35734ba11a15e7eee

IOCs (JSON)Copy

{
  "sha256": "26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac",
  "family": "AsyncRAT",
  "verdict": "suspicious",
  "confidence": 60,
  "signals": [
    "child-processes"
  ],
  "attack": [
    "T1059"
  ],
  "children": [
    "C:\\argus-vr-agent\\quarantine\\26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac_extracted\\26d90f32df1cd821e0995026c4528b22ffacb0e6c6acfb07eec0fcb3eb7a03ac.exe"
  ]
}