MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ae1c7a5828344b803f6c5085ff52866be49fc5ec3c3e868d850283a6e8fce59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ParallaxRAT

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	2ae1c7a5828344b803f6c5085ff52866be49fc5ec3c3e868d850283a6e8fce59
SHA3-384 hash:	8aad93fb16ca6c0c16baef3b12f899ab15b0d523c09f26c0be24a234d42ea16caf43afed94e9b3bad106acb04043b9d1
SHA1 hash:	39a7634b3d7c62cf2b1e7a19fadeda12962b3468
MD5 hash:	9d60d8928bc0478b3029e59024b5f407
humanhash:	glucose-tennis-stream-vermont
File name:	9d60d8928bc0478b3029e59024b5f407.exe
Download:	download sample
Signature	ParallaxRAT Create hunting rule
File size:	2'263'552 bytes
First seen:	2020-05-13 16:40:15 UTC
Last seen:	2020-05-13 17:06:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	5fd26d3ea5d79c1db427ad41d981266f (2 x ParallaxRAT)
ssdeep	24576:xHzeOnCALSheHkdCmUsJKj0UEAC+FNosg/:xHQ78mdJwfEAAd
Threatray	348 similar samples on MalwareBazaar
TLSH	0CA55A62F2A0C877E8271674ED178AF9752B7F149D74480B26F93E0D7E362413829B1B
Reporter	abuse_ch
Tags:	exe ParallaxRAT RAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/3640/

Detection(s):

SecuriteInfo.com.Generic.mg.9d60d8928bc0478b.13612.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-13 15:15:35 UTC

File Type:

PE (Exe)

Extracted files:

357

AV detection:

23 of 31 (74.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=flq4pjmcqnclqa7wyuef75jim27et7c6ypb6q2gykaudu3upzzmq._file

Verdict:

suspicious

ParallaxRAT

505aa5b6bf77290ec7ccdd2b24b8ff8ef779f01d57ad690f632d8b2736f2a8dd

ParallaxRAT

509f5caf90d71205d4e67c01307ac35bffe286e08a3e544f05a38eb72f149a1f

ParallaxRAT

67bd0297c3cec70aff4d67aef73ca59618baceef4ee5801cefe7682fa2725ca7

ParallaxRAT

8f981c2c2a5ec61765f189e952dd76f4e3d375aec7b8bd941d563b01519769e1

ParallaxRAT

9257415575d2a485de9787466a10636a920134f18dd617231373173dc88a6a20

ParallaxRAT

a0ed7d0e67e9e7ccddf7e41cd11a81effd829ff27421471d7d303ac0776d6571

ParallaxRAT

b3550779f1211365321210344de50d32f4e0477c2817919474d0bf49574fcd01

ParallaxRAT

b51e81e44593c2c42ae412b692c46be3c6b1e4ac46c951e708618da5919403d3

ParallaxRAT

f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307

ParallaxRAT

+ 338 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-7ckabd4cqj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Drops startup file

Blacklisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.