Extracted

• • Target

    detalhes relevantes.ppam

  • Size

    44KB

  • MD5

    ed91c30f5cf1d73f03495f48a09319c5

  • SHA1

    47fe246f4510dafd8f62082c5d5b366ede26f930

  • SHA256

    1a6330ef84d244b1c672deeabcf38b93c1e1f9e31d9b7ac96b5e57adb082189b

  • SHA512

    818003ede5cd189bfc74219bc68ee6533132d5855d1fff09a60115827a5f25ead255fb025b354a0300fb2cac17f84c2990ea7849682fcac392d6b9d6da5ed7f0

  • SSDEEP

    768:VP8LOeNxb+ayeL4nTli1K3D5/jZFKTnZe/wVDQ6Z1sMhRBpjklszWJP8MN1qpk:VELfNxb+ayeuB53D5/VFgLDQad0szW95

  Score

  10^/10

  revengeratnyancatrevengediscoverytrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2