Extracted

• • Target

    fc0a96e635fa296eedf0e58cd84ec60e267dd5008e6129449ed62993e00c2e38.ppam

  • Size

    23KB

  • MD5

    855e7ea279a05bb5fa3551d56a830a1b

  • SHA1

    a22cda2ccd4a95a8ccd1510d2f2e7f3d7111d0ae

  • SHA256

    fc0a96e635fa296eedf0e58cd84ec60e267dd5008e6129449ed62993e00c2e38

  • SHA512

    0e8e722ff0f703f74712a79cf4d156ebd1cf5c6731c07589965b058641881e75765b324d29cec1b11b07e88e7080b644d030ece1faaa8675607d462cceb63e8f

  • SSDEEP

    384:dXPcqNJ0PQPGKRrznsrD9t9WrXcuikodj6WG6XRV+7AkmgcsdzJY9t9rqrw13rtr:VPc8GK9n49KDcPkmODMw71msfYVrhBV

  Score

  10^/10

  revengeratnyancatrevengediscoverytrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2