MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 002b81b464fe41cfe17a2a59fdcea647ea5af9e8bfcbfc78ae4fc4c076765629. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 002b81b464fe41cfe17a2a59fdcea647ea5af9e8bfcbfc78ae4fc4c076765629
SHA3-384 hash: 89cb4215c2bcd729231f2370e4cc84cae3eece8d1d95897d2721e93d0023392088802ede343776e5168e5ea6d22132ad
SHA1 hash: cd12fe3c3d7fef61e5eb197fc114de69ac2489de
MD5 hash: 12384bb5906bf59d7c253d8ead83c484
humanhash: artist-edward-fruit-nevada
File name:12384bb5906bf59d7c253d8ead83c484.exe
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:668'672 bytes
First seen:2020-05-27 07:15:41 UTC
Last seen:2020-05-27 08:17:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7ff8d03d920509e57b7b49d1f94e35cb (1 x ParallaxRAT)
ssdeep 12288:UNuSeRd0B7stUQK1nsLtUcCZ6lV1aYi/xGUNH7qLhGU:UNBt7WmsLJCEp8xGjLhX
Threatray 378 similar samples on MalwareBazaar
TLSH 96E49E23A2F14933C16716799C5B576C9C3AFE112D38988A6FF81C4C9F39681782E397
Reporter abuse_ch
Tags:exe ParallaxRAT RAT


Avatar
abuse_ch
ParallaxRAT C2:
valiw.cinsxlekp.ml:80 (46.17.96.37)

Intelligence

File Origin
# of uploads :
2
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 22:44:31 UTC
File Type:
PE (Exe)
Extracted files:
42
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0cb94dd180548e55a02a5a8c75e601816746105eb6c8e62cb53b7fa2cddfa9c6
ParallaxRAT
2ae1c7a5828344b803f6c5085ff52866be49fc5ec3c3e868d850283a6e8fce59
ParallaxRAT
4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159
ParallaxRAT
505aa5b6bf77290ec7ccdd2b24b8ff8ef779f01d57ad690f632d8b2736f2a8dd
ParallaxRAT
67bd0297c3cec70aff4d67aef73ca59618baceef4ee5801cefe7682fa2725ca7
ParallaxRAT
76c2929d5ccb9232c3e3b9825bbde0f7fb135a1cdc035297322212b48f1b91c3
ParallaxRAT
95e512f980e10547b613b0ee9fde0e49716e338cdf16e9b50956e0b3a807ad20
ParallaxRAT
bbe2a604c11442ee74adb7fa17910ca8e5665ab463e4a45b478707faa3a284e4
ParallaxRAT
bc2cea17da33c23edbb0c86ab00b3ec3b4a2f4da84fb075922e41b7bf6b654f0
ParallaxRAT
c62e5304821abc306872ea97c88a8d7dc800f7b63380b2cf89153c639de4704c
ParallaxRAT
+ 368 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2lw5rtg16n/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops startup file
Blacklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_parallax_w0
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ParallaxRAT

Executable exe 002b81b464fe41cfe17a2a59fdcea647ea5af9e8bfcbfc78ae4fc4c076765629

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments