MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b
SHA3-384 hash: ca1ef9855c3c0b9b8eab86731540861576818d397f8331c183d145593644edcaec781dd15d1f1f5e01cede1deff1662f
SHA1 hash: 084375103de81a9fce81f3699f4e212f94c34bc1
MD5 hash: 083591e8b186ebb55fe0f0cf222bdcdd
humanhash: uncle-steak-ten-robert
File name:75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:1'041'224 bytes
First seen:2020-11-27 11:06:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 17dc7a1f955942feec39e3ee99388365 (1 x ParallaxRAT)
ssdeep 24576:tLScNIJreqACD/3ClWO0WwXO/U5Xwqt94dn:tLScNoiPg/ClWHWwXO/U5Xw+a
Threatray 23 similar samples on MalwareBazaar
TLSH F8259E67B3D06137D1A31574890B86E9A931BE203D34E84677F91D0C6F786A2BA363D2
Reporter JAMESWT_WT
Tags:MISTO EKONOMSKE STORITVE d.o.o. ParallaxRAT signed

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/105806/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Unauthorized injection to a system process
Sending a TCP request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Parallax RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/549222
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Found potential dummy code loops (likely to delay analysis)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
System process connects to network (likely due to code injection or exploit)
Yara detected Parallax RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-27 02:56:13 UTC
File Type:
PE (Exe)
Extracted files:
56
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oxk72zckhvz5qvglhwrdrx6a6ntvzxxbtlfp246xoo3svvtmmjnq._file
Verdict:
suspicious
Similar samples:
2ae1c7a5828344b803f6c5085ff52866be49fc5ec3c3e868d850283a6e8fce59
ParallaxRAT
4723ab5ed01fb642eb602ff59309d4d698e6011145ca1b757bb223b5a67fe159
ParallaxRAT
505aa5b6bf77290ec7ccdd2b24b8ff8ef779f01d57ad690f632d8b2736f2a8dd
ParallaxRAT
509f5caf90d71205d4e67c01307ac35bffe286e08a3e544f05a38eb72f149a1f
ParallaxRAT
67bd0297c3cec70aff4d67aef73ca59618baceef4ee5801cefe7682fa2725ca7
ParallaxRAT
76c2929d5ccb9232c3e3b9825bbde0f7fb135a1cdc035297322212b48f1b91c3
ParallaxRAT
8f981c2c2a5ec61765f189e952dd76f4e3d375aec7b8bd941d563b01519769e1
ParallaxRAT
9257415575d2a485de9787466a10636a920134f18dd617231373173dc88a6a20
ParallaxRAT
b3550779f1211365321210344de50d32f4e0477c2817919474d0bf49574fcd01
ParallaxRAT
f37f40245387cf924b4692267251875273ef75ad03fa9f92d73ab021f5c9e307
ParallaxRAT
+ 13 additional samples on MalwareBazaar
Result
Malware family:
parallax
Create hunting rule
Score:
  10/10
Tags:
family:parallax rat
Link:
https://tria.ge/reports/201127-1kgt8ep3es/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Drops startup file
Blacklisted process makes network request
ParallaxRat
ParallaxRat payload
Unpacked files
SH256 hash:
75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b
MD5 hash:
083591e8b186ebb55fe0f0cf222bdcdd
SHA1 hash:
084375103de81a9fce81f3699f4e212f94c34bc1
Link:
https://www.unpac.me/results/8ec61874-2c12-4a3a-9b56-e521cb821076/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/75d5fd644a3d73d854cb3da238dfc0f3675cdee19acafd73d773b72ad66c625b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:crime_win32_parralax_load_1
Create hunting rule
Author:@VK_Intel
Description:Detects Parallax loader sequence
Reference:https://twitter.com/VK_Intel/status/1240676463126380545
Rule name:Parallax
Create hunting rule
Author:@bartblaze
Description:Identifies Parallax RAT.
Rule name:parallax_rat_2020
Create hunting rule
Author:jeFF0Falltrades
Rule name:win_parallax_w0
Create hunting rule
Author:jeFF0Falltrades

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/105806/

Comments