0xblack .dev
Malware research · ARGUS
← all findings
9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7.js
Published 2026-08-03 06:28 UTC · ARGUS
Summary Verdict
SUSPICIOUS confidence 75% (moderate)
SHA-256
9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7
Signals
executable-drop
Methodology The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.
Dropped files (1) C:\Users\lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7.js MITRE ATT&CK T1105 Ingress Tool Transfer / staged payload
Indicators of Compromise (defanged) 288348b56571068fb11a0579de46e84d3097f2da 9452ccef2ed2f38e61bf4f1838c5fa13 C:\Users\lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7.js IOCs (JSON)Copy {
"sha256": "9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7",
"verdict": "suspicious",
"confidence": 75,
"signals": [
"executable-drop"
],
"attack": [
"T1105"
],
"dropped": [
"C:\\Users\\lab\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7.js"
]
}