Extracted

Extracted

• • Target

    Reserva Detalhes.ppam

  • Size

    12KB

  • MD5

    ccf9ad38175132df46d557052a4189c7

  • SHA1

    cfe31d9d10e6459f7d6c9cad1d7b1a001f049e7d

  • SHA256

    68dd35d8e090d38ce3f32e1cd62cbc8694c1119eda4bdfb27d90a83e31336d92

  • SHA512

    005ff866a2b2c406d3b7be8016d24a21fca21ceb31510accb73cdbca68e0eb76259b97fb6ec504ea397990a85c2b2d5c1a89de6c2245d953e6d97cfd39116347

  • SSDEEP

    384:dXP8BPMpJA8+SC0hUYRknWyGzfisnru6C86:VP4PMpJ3vhJytou6P6

  Score

  10^/10

  revengeratnyancatrevengeexecutionpersistencetrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2