Extracted

• • Target

    c821cfc5e83b96365f4384312fa29e7407a42fb97871e8f1f23ab4a698c1b390.ppam

  • Size

    32KB

  • MD5

    7314737e8dfca524250fcd6508f11d17

  • SHA1

    2d3156b0c3b5f3944abe6c86e7096e07ca53e052

  • SHA256

    c821cfc5e83b96365f4384312fa29e7407a42fb97871e8f1f23ab4a698c1b390

  • SHA512

    72f565623e7890bc5ce6efb3adb217d1602f485c327ca3b2a4e51f48709affa2a0190837031d48f1e4dc16a7ed78029f81b6f092dbc86cff1c675bf66e1c3e72

  • SSDEEP

    768:VP5E4C674aDfgF+So703s1fhrI4dxDpe287hjMWHxN21ah5kZEeW:Vm4B8argYg6rI4dZE3KWn21Q5yEeW

  Score

  10^/10

  revengeratnyancatrevengediscoverytrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2