0xblack.dev Malware research · ARGUS

50acfb7810e0efc90ae24b1c10dda449a253b0583372ccaec0845e8193b7c8db.exe

Published 2026-08-03 06:28 UTC · ARGUS

Summary

Verdict

SUSPICIOUS confidence 65% (moderate)

SHA-256

50acfb7810e0efc90ae24b1c10dda449a253b0583372ccaec0845e8193b7c8db

Packing

Themida/WinLicense (entropy 7.96)

Signals

packed

Methodology

The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.

No high-confidence host or network side effects were captured in this run (payload may be environment-gated or dormant).

MITRE ATT&CK

T1027.002 Obfuscated Files or Information: Software Packing

Indicators of Compromise (defanged)

77a7067be03fc541bbc9156ac8fa377dd578b980
befee43060c7089285d421093d93752f

IOCs (JSON)

{
  "sha256": "50acfb7810e0efc90ae24b1c10dda449a253b0583372ccaec0845e8193b7c8db",
  "verdict": "suspicious",
  "confidence": 65,
  "signals": [
    "packed"
  ],
  "attack": [
    "T1027.002"
  ]
}