MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
ParallaxRAT
Vendor detections: 9
| SHA256 hash: | 3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654 |
|---|---|
| SHA3-384 hash: | c53ec0d0b5fba2176cffa084e8576a6aa3e391a929ba53d489b34fb5ac05622ab84750626a1b9666bd164f1e936d7ca7 |
| SHA1 hash: | 063628db0dab74df343232a6670ee477d29e1219 |
| MD5 hash: | 4866d86370233b82ff2b0017221c57e2 |
| humanhash: | angel-florida-diet-ohio |
| File name: | 3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654 |
| Download: | download sample |
| Signature | ParallaxRAT |
| File size: | 7'458'736 bytes |
| First seen: | 2021-10-06 13:12:45 UTC |
| Last seen: | 2021-10-06 13:48:33 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 5a594319a0d69dbc452e748bcf05892e (21 x ParallaxRAT, 20 x Gh0stRAT, 15 x NetSupport) |
| ssdeep | 196608:NNyz8XyEa/pXBG8SzdQTRRG1iGuEs2F+c:NNyzZpXBG8SdQTmAG9F+c |
| Threatray | 190 similar samples on MalwareBazaar |
| TLSH | T11576233FF268A43EC4AA0A3245B3C250597BBA65781A8C1E07FC394DDF765700E3E656 |
| dhash icon | 5050d270cccc82ae (109 x Adware.Generic, 43 x LummaStealer, 42 x OffLoader) |
| Reporter |  JAMESWT_WT |
| Tags: | A & R Maxim s.r.o. A e R Maxim s.r.o. exe ParallaxRAT RAT |
Intelligence
File Origin
# of uploads :
2
# of downloads :
324
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654
Verdict:
Suspicious activity
Analysis date:
2021-10-06 13:19:59 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
overlay packed
Verdict:
Malicious
Threat name:
Win32.Downloader.Penguish
Status:
Malicious
First seen:
2021-09-02 17:14:55 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
3/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 180 additional samples on MalwareBazaar
Result
Malware family:
parallax
Score:
10/10
Tags:
family:parallax rat upx
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Loads dropped DLL
Blocklisted process makes network request
Executes dropped EXE
UPX packed file
ParallaxRat
ParallaxRat payload
Unpacked files
SH256 hash:
4daf3a4d3d7a213e86e667f66ec57fd81d0a833ee161be5db63ce5af48e4a5b7
MD5 hash:
448a6f10fc2629c90d3004cdf9a66615
SHA1 hash:
eec69ae3ddc6af27de19eebf1aca98ef5070dc62
SH256 hash:
ab209544ea6f87e294a705e8e370f015141b53cdf61d3f82779cb8ea3782018c
MD5 hash:
9fce40e0a36054ca80855baa1e57b8b7
SHA1 hash:
fbbed301eb77b2bda312c528df46574ed2af9fb0
SH256 hash:
f9da1dd8f086e5baf900ae2d9f64a408c7a2e97ff18ff0c9ce2d367088663cae
MD5 hash:
96fad8da2c6f71cccebe8f1325e28609
SHA1 hash:
863de78fb4ab87ee87a3635229a6d8aee3b0d058
Detections:
win_houdini_auto
SH256 hash:
71373d1cee2efc6c9857c780dd7232cf6a9fc7d956f9433238b74fab79109c43
MD5 hash:
49196cd6b3699a0d771226f46811d238
SHA1 hash:
48bc92f4da6945240a8456195487fd03fa41391b
SH256 hash:
30098bbeac856f031f26c3fbcc43e579cde33bbde476b798f060987782cd21f3
MD5 hash:
7fc45182667dfce2ae187002f7f6cf90
SHA1 hash:
214e2672ae1082dd699244f68999761c07ed906c
SH256 hash:
3dc57b8c1b003726285ee72400d7d0f841d42d0457febe98eb67215fbc9e2654
MD5 hash:
4866d86370233b82ff2b0017221c57e2
SHA1 hash:
063628db0dab74df343232a6670ee477d29e1219
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.09
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.