Extracted

• • Target

    Comprovante de pagamento.ppam

  • Size

    21KB

  • MD5

    2f7315fa6a61313b7a1da2ee13771b7b

  • SHA1

    890531e02b962918c7f90932813f4ba806f8096f

  • SHA256

    e66f6e30846e7935869eb4f6107a072f2503a0a84dcae60686e436e2b60b4237

  • SHA512

    bef51100bf82650c502988270e560b2a6cb49d0a6574390c59b65d7ce71f7fcb9ad4734416003e71a94102fb5b293faddfb0689ed4dd1f68ed938dde53707ac6

  Score

  10^/10

  njratnyan cattrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2