Extracted

• • Target

    Documentosrs.ppam

  • Size

    17KB

  • MD5

    640ac4d0699d074c8a7e9a08ee88773e

  • SHA1

    d11670a056e4014f9b7a14719a5d3fd81405c029

  • SHA256

    faae26cbd0ceae86240be0129ce6a9e18236a6db8c321ce37e06966392e78b64

  • SHA512

    bb0f743d16b79d5c4634a786b92bdd1546de5afbaa56bb7a5d47fd8b4dd2e4715ff01a7970849638b4d5a5d3029edf2acd122fbc360868c3f5ea102c68efe3a4

  • SSDEEP

    384:dXPtggC+rvh/t3vzVWnON2ZfrmPaggDI06t2QUVDp:VPtvC+r5lzVLNYjmPabDIgVl

  Score

  10^/10

  discoveryexecutionpersistencerevengeratnyancatrevengetrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2