0xblack .dev
Malware research · ARGUS
← all findings
2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe
Published 2026-08-03 06:28 UTC · ARGUS
Summary Verdict
SUSPICIOUS confidence 90% (high)
Family
AsyncRAT
SHA-256
2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311
Signals
executable-drop, child-processes
Methodology The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.
Child processes (2) C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe C:\argus-vr-agent\quarantine\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311_extracted\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe Dropped files (1) C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe.local.bat MITRE ATT&CK T1105 Ingress Tool Transfer / staged payloadT1059 Command and Scripting Interpreter
Indicators of Compromise (defanged) 4116f49a0f39ecb828c34215ea0b3701a380991a bd37be6c711b63c2ef91a37259d4563f C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe.local.bat IOCs (JSON)Copy {
"sha256": "2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311",
"family": "AsyncRAT",
"verdict": "suspicious",
"confidence": 90,
"signals": [
"executable-drop",
"child-processes"
],
"attack": [
"T1105",
"T1059"
],
"dropped": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe.local.bat"
],
"children": [
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\jsc.exe",
"C:\\argus-vr-agent\\quarantine\\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311_extracted\\2945c9a7bdcd541372a883eed3a1e045ff39078c5bfec708aee3e5e1b5b80311.exe"
]
}