MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43a7ad11c500e6f3338f620a4056ae808ef5b61cd13b621bbf7d2e04122a61ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43a7ad11c500e6f3338f620a4056ae808ef5b61cd13b621bbf7d2e04122a61ec
SHA3-384 hash: 26792e1d9b079672beabaa2bcda887f5eac32f15acaa862ea10c1f987f78f444dc5d947eed72d9526a05638855bb0335
SHA1 hash: 2104874854c6132257abd3babff264c9f7fb8af2
MD5 hash: a69534a2d57ce2b2e0ca6c2e101ada2c
humanhash: mexico-vermont-fanta-high
File name:aps.exe
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:2'136'049 bytes
First seen:2020-07-30 11:21:19 UTC
Last seen:2020-07-30 12:09:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c2c71dfce9a27650634dc8b1ca03bf0 (160 x Loki, 58 x Formbook, 55 x Adware.Generic)
ssdeep 49152:GrlUkgrkqOBMrmrCyG/Fe+F2GjFxZwk2kvymcKGe:GrlUZr+M7Fp2G1r2pw
Threatray 579 similar samples on MalwareBazaar
TLSH F8A5331C3CF8A82BF16154B9A69C13C681C67F39942E2997CDF4BD983509640C79DB4F
Reporter JAMESWT_WT
Tags:ParallaxRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/35526/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

PUA.Win.Adware.Browserio-6725861-0
Create hunting rule

SecuriteInfo.com.Artemis162931E90DCF.4593.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Launching a process
Launching the default Windows debugger (dwwin.exe)
Creating a window
Forced shutdown of a system process
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/403903
Signature
Creates an undocumented autostart registry key
Creates files in alternative data streams (ADS)
Hides threads from debuggers
Hijacks the control flow in another process
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sleep loop found (likely to delay execution)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43a7ad11c500e6f3338f620a4056ae808ef5b61cd13b621bbf7d2e04122a61ec/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-07-30 04:56:32 UTC
File Type:
PE (Exe)
Extracted files:
85
AV detection:
32 of 48 (66.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iot22eofadtpgm4pmifeavvoqchplnq42e5weg57puxaierkmhwa._file
Verdict:
unknown
Similar samples:
20c3e4781ccd8ac11551b0eae31eeffec03bcfac4067d35caa5057c62efb057d
ParallaxRAT
21631a6b344d1340fdb0e27e7f2a637580035c30fe8ddf5cf791813c1e32c7be
ParallaxRAT
7c7cee883042c0641e920036b8f54ce82e61eaa145cd3fffcdf04089d814b5ff
ParallaxRAT
7f6ab9c1ee0cee3b51e076a98ad0b05416e87de438d475a8137d80405f75ac24
ParallaxRAT
9f06ce1718cfa4e73366f82c9488b7a4aad4ddede7d7b3b51d44667607a3961c
ParallaxRAT
cc10c0e3ee3bf9c787d85b3758354c6463b689833f0cafe171ce89b857502f13
ParallaxRAT
d6f98f5291cec1f95f72fdd63d0ad49239f9396de4c297b01929bb7cb0024b7e
ParallaxRAT
d83f380bd1ed387ecadd99204ea1985ed04f2801b5b592a1fb7003ab57052103
ParallaxRAT
dcb0ebc1f45c4de45babb921e77c6f9d3e62c9071fd5713f6ecc064f6784fe6e
ParallaxRAT
f75f2eff7ffa6301ab74cde10a6927d2fd7e4bdc4ff63c70ecafc12360f0a78e
ParallaxRAT
+ 569 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200730-zrsx5cks7e/
Behaviour
NSIS installer
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Remcos
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43a7ad11c500e6f3338f620a4056ae808ef5b61cd13b621bbf7d2e04122a61ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ParallaxRAT

Executable exe 43a7ad11c500e6f3338f620a4056ae808ef5b61cd13b621bbf7d2e04122a61ec

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/35526/
  
URLhaus
https://urlhaus.abuse.ch/url/421251/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/421913/

Comments