0xblack .dev
Malware research · ARGUS
← all findings
ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161.js
Published 2026-08-03 06:28 UTC · ARGUS
Summary Verdict
SUSPICIOUS confidence 75% (moderate)
SHA-256
ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161
Signals
executable-drop
Methodology The sample was executed in an isolated, instrumented Windows VM (host-only networking with emulated C2 responses) while process, file-system, registry and network activity were recorded. The verdict is derived by correlating observed runtime behaviour with static indicators. No sample binary was uploaded or redistributed.
Dropped files (1) C:\Users\lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161.js MITRE ATT&CK T1105 Ingress Tool Transfer / staged payload
Indicators of Compromise (defanged) 41c0fef6ce77b79a11ae14cecd30e6e8e5430608 80f7a04d96531b5eb38f8089dc584d9e C:\Users\lab\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161.js IOCs (JSON)Copy {
"sha256": "ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161",
"verdict": "suspicious",
"confidence": 75,
"signals": [
"executable-drop"
],
"attack": [
"T1105"
],
"dropped": [
"C:\\Users\\lab\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ef436a36b3b42525f06b3839d5e3f50f6ff217549c8f25d88dfe6f24385ed161.js"
]
}