MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cf91b93dd7a3a6aca9878a5cf252af90000628486161243a086d6477d5d1f04. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cf91b93dd7a3a6aca9878a5cf252af90000628486161243a086d6477d5d1f04
SHA3-384 hash: 7a0aa11ef929999049eac85b5407a2fc02742084a351caf6ce7191cf556478f4e6e6184149fe1a3733b50dfd68da58b3
SHA1 hash: 535e16e9dc3dbcd7802fd87eab41e09dff09df57
MD5 hash: bf5032af20439ef99b036dd2aad6843e
humanhash: vegan-queen-coffee-mirror
File name:bite1c.exe
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:3'005'960 bytes
First seen:2020-05-13 14:04:35 UTC
Last seen:2020-05-13 14:51:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c429a59b75507b3c3fbeaf5b27db9c31 (1 x ParallaxRAT)
ssdeep 49152:/0/fSwGvn6ILu26cep+R0Rg8oLMPUTrNVvh6N8f3o6PsVrxjFO0SLVwzYFyBP:/0jWnpLF6cepy+g8oHhejFO0SLVwzYF4
Threatray 8 similar samples on MalwareBazaar
TLSH 13D56D113D87846EC1230331D9C8F2B6A2ADAE7416374157DEDCBF5A3B32582492B5EB
Reporter James_inthe_box
Tags:exe ParallaxRAT

Code Signing Certificate

Organisation:Symantec Time Stamping Services CA - G2
Issuer:Thawte Timestamping CA
Algorithm:sha1WithRSAEncryption
Valid from:Dec 21 00:00:00 2012 GMT
Valid to:Dec 30 23:59:59 2020 GMT
Serial number: 7E93EBFB7CC64E59EA4B9A77D406FC3B
Intelligence: 85 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 0625FEE1A80D7B897A9712249C2F55FF391D6661DBD8B87F9BE6F252D88CED95
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BackDoor.Rat.275.31957.17356.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Xaparo
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 22:28:40 UTC
File Type:
PE (Exe)
Extracted files:
47
AV detection:
18 of 31 (58.06%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nt4rxe65pi5gvsuypcs46jjk7eaaayueqylbeq5aq3leo7k5d4ca._file
Verdict:
unknown
Similar samples:
08c0f4831d9f0e3d57fbb7290e5fde4a50598b50676f76aaee3db9c079d500bc
ParallaxRAT
5a9afed20307b057f167c195bb0bf01936f2f6f3bfa46381346c8b66fd2fb5ac
ParallaxRAT
5ef0b6ab46bb6853ddf281a6b12ca1b6c9d77a6b25a8db00e5f0771e793357a5
ParallaxRAT
6a18ff52d179fa32975ac72f36ae60abe5f7ac754e5ad616cbd375127b2904c6
ParallaxRAT
730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
ParallaxRAT
766ae308afb49c217831d41fed49685601ceea7ac7a16ccfd23fb33c0fae7cc2
ParallaxRAT
9915a472afbee0c4ff331e06a2c941898be6d548953c025e8894e6059ac141cd
ParallaxRAT
a405ec6b13a3b39b2c33d1709d5826852cbe782874612af9cf790e918be41624
ParallaxRAT
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-2chr8kycpa/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_parallax_w0
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments