MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e
SHA3-384 hash: 539930be4d77b7ea2ad91d1b20fc3280ee67366225c154fe0377f8c21954e63760795b0e8820fef06846ed763fc20afe
SHA1 hash: 8cc75d0cdb1cad30ec6600b1333a97f57e8d6874
MD5 hash: 90c094f1c7846c5b55fba50b70b74425
humanhash: william-october-vermont-stairway
File name:9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e.bin
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:6'861'784 bytes
First seen:2021-07-27 09:13:42 UTC
Last seen:2021-10-21 10:18:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 11b3821451b56399e6339116f98b9cbf (1 x ParallaxRAT)
ssdeep 98304:rRjgEH86xAn/vk01SduC5z1YBM8NOiVKnp3bfXhvq8:aANG3kaSduC5z16AiVKn5Rvq8
Threatray 2'973 similar samples on MalwareBazaar
TLSH T132667C217344943ED8AF0A3B957BAA20893DBB757913CD6657F49CCC8F355803A3A24B
dhash icon e9d5f0d5ddd5dde9 (3 x ParallaxRAT, 3 x Rhadamanthys, 1 x CoinMiner)
Reporter JAMESWT_WT
Tags:51.195.57.229 A-LINE PIPE TOOLS INC. exe ParallaxRAT signed

Code Signing Certificate

Organisation:A-LINE PIPE TOOLS INC.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-05-19T00:00:00Z
Valid to:2022-05-19T23:59:59Z
Serial number: be8e91ba93724ac74b5a862afcd34077
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 61e568a29b27db36f7af948c3470acdd0834bacc975b0d514a36e9de6ac5416f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
3
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Error-Screenshot-Payneteasy.pif
Verdict:
Malicious activity
Analysis date:
2021-07-05 10:24:13 UTC
Tags:
trojan parallax
Link:
https://app.any.run/tasks/8bfb62a7-1b77-4d23-8b9c-8f1c2505bc92

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/174306/
Detection(s):
PUA.Win.Packer.BorlandCpp-9
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/75193cfc-b4ce-45b0-8270-edef64ec2da9
Result
Threat name:
Parallax RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/822243
Signature
Allocates memory in foreign processes
Hijacks the control flow in another process
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Writes to foreign memory regions
Yara detected Parallax RAT
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Downloader.Penguish
Create hunting rule
Status:
Malicious
First seen:
2021-07-05 16:38:23 UTC
File Type:
PE (Exe)
Extracted files:
48
AV detection:
22 of 46 (47.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ttgomu6lm2bt5e4wcupvxrs7nqtujwkvvhvo3lmb5tgt3issqa7a._file
Verdict:
malicious
Similar samples:
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
ParallaxRAT
525d3b180847b425e376157caabbf860b421078903228d919d1e5e0fcce5741c
ParallaxRAT
6f8fc539952555b057adf7810aca782a29f8f624e1d46a0f4732db3763130725
ParallaxRAT
93f79e179e242b4b2cb0edfc4499597b0ba9ba7f0f8c7126100ff82fc58175d2
ParallaxRAT
9e9ad2a3d696f2327d702b58c5f0329caddce1571d842ecc9ca02f3f23677ae3
ParallaxRAT
c5f1d96b75d6ed0846fac4d2ddfada97927dbcebc6fbd015cc08ac78387b28fd
ParallaxRAT
d8eb5792d969c21c364da69eca1322ab5f63e0a39b0e542bad4ee95be873c296
ParallaxRAT
df3dabd031184b67bab7043baaae17061c21939d725e751c0a6f6b7867d0cf34
ParallaxRAT
+ 2'963 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210727-pwy5m32vn6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e
MD5 hash:
90c094f1c7846c5b55fba50b70b74425
SHA1 hash:
8cc75d0cdb1cad30ec6600b1333a97f57e8d6874
Link:
https://www.unpac.me/results/635e98b7-a6ab-458f-adc6-ef6c319824ac/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Parallax RAT
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9ccce653cb66833e9396151f5bc65f6c2744d955a9eaedad81eccd3da252803e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Adsterra_Adware_DOM
Create hunting rule
Author:IlluminatiFish
Description:Detects Adsterra adware script being loaded without the user's consent
Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:Ping_Del_method_bin_mem
Create hunting rule
Author:James_inthe_box
Description:cmd ping IP nul del
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/174306/

Comments