Extracted

• • Target

    ComprovanteXdeXreserva.ppam

  • Size

    20KB

  • MD5

    fd0d3e25d88b5c318f4dc543a7770f22

  • SHA1

    94572d313222700a565f2ff161223bb28464636c

  • SHA256

    623027463a2ef70f60ff6a0991019847a3fb24da3b633b52da4a99a77c99f92b

  • SHA512

    48936b4677c10a8466cbaa631a9cbc8ce2b0d995b427fd56c894d98d42abc834bbaeb397401ff131b94f93f05978c8496cf9beaad2f059d8bd04511b40e2e9d8

  Score

  10^/10

  njratnyan cattrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Blocklisted process makes network request

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2