0xblack.dev Malware research · ARGUS
← all findings

370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd.exe

Published 2026-08-03 06:28 UTC · ARGUS
Share on X VirusTotal MalwareBazaar

Summary

Verdict
SUSPICIOUS   confidence 90% (high)
SHA-256
370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd
Signals
executable-drop, child-processes

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

Child processes (3)

Dropped files (6)

MITRE ATT&CK

T1105 Ingress Tool Transfer / staged payloadT1059 Command and Scripting Interpreter

Indicators of Compromise (defanged)

IOCs (JSON)

{
  "sha256": "370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd",
  "verdict": "suspicious",
  "confidence": 90,
  "signals": [
    "executable-drop",
    "child-processes"
  ],
  "attack": [
    "T1105",
    "T1059"
  ],
  "dropped": [
    "C:\\ProgramData\\WhiteSeaShell\\FnHotkeyUtility.exe",
    "C:\\ProgramData\\WhiteSeaShell\\ludp.dll",
    "C:\\ProgramData\\WhiteSeaShell\\msvcp140.dll",
    "C:\\ProgramData\\WhiteSeaShell\\spkvol.dll",
    "C:\\ProgramData\\WhiteSeaShell\\vcruntime140.dll",
    "C:\\ProgramData\\WhiteSeaShell\\vcruntime140_1.dll"
  ],
  "children": [
    "C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\is-4E7KHMQVWL.tmp\\370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd.tmp",
    "C:\\Users\\RESEAR~1\\AppData\\Local\\Temp\\is-FQYRDINLLB.tmp\\370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd.tmp",
    "C:\\argus-vr-agent\\quarantine\\370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd_extracted\\370e4d4ffbed3835c515ba94454b3d3002a007bfc7e11eb275081209878146cd.exe"
  ]
}
ARGUS · 0xblack.dev