Extracted

• • Target
    c821cfc5e83b96365f4384312fa29e7407a42fb97871e8f1f23ab4a698c1b390.ppam
  • Size 32KB
  • SHA256 c821cfc5e83b96365f4384312fa29e7407a42fb97871e8f1f23ab4a698c1b390
  • MD5 7314737e8dfca524250fcd6508f11d17
  • SHA1 2d3156b0c3b5f3944abe6c86e7096e07ca53e052
  • SHA512 72f565623e7890bc5ce6efb3adb217d1602f485c327ca3b2a4e51f48709affa2a0190837031d48f1e4dc16a7ed78029f81b6f092dbc86cff1c675bf66e1c3e72
  • SSDEEP 768:VP5E4C674aDfgF+So703s1fhrI4dxDpe287hjMWHxN21ah5kZEeW:Vm4B8argYg6rI4dZE3KWn21Q5yEeW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  revengeratnyancatrevengediscoverytrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Process spawned suspicious child process

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2