Extracted

• • Target

    2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5.ppam

  • Size

    19KB

  • MD5

    f2c6f5b43d73d91bb9eb0de2812ff7cb

  • SHA1

    d4dbf0af4bfbd0f6ce0aadb9dcbbc30cebf36aad

  • SHA256

    2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5

  • SHA512

    bd2abddb6f66c5f104925d48d6499ed336e52b43829ee42595f00382c69dccb4398822c8df565c31a44ea9fe12dc4fc31c953652a4698bdf6fbfa96df304a82a

  • SSDEEP

    384:dXPWGaYOMHEG4upmXuB44OPJ8GfkXjedXRMx+CI/tQiZlyszuCqo9NRrccG:VPWGNO7kpme64C21Xjc2xXI/XTys6ARk

  Score

  10^/10

  revengeratnyancatrevengetrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2