MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ParallaxRAT


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b
SHA3-384 hash: 3cd482020735a05e6aca020ac2c4909c0b18ea0d3d40db462e8c7bd3ad416b82da45ce536b81bf5834eeaaeafe01ade0
SHA1 hash: bb772e658af670d38efe94d075a0c57d312af6b1
MD5 hash: 4abef812fd4cc15769b94ad459d0c5e2
humanhash: pizza-ohio-pasta-may
File name:d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b
Download: download sample
Signature ParallaxRAT
Create hunting rule
File size:2'106'296 bytes
First seen:2021-10-21 10:17:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1694a5ba33cf6c0c1112f62087671cf9 (4 x ParallaxRAT)
ssdeep 49152:KEWzRJhI9v5cQ52BEcZ17xatMGOG9pg4AFOkkO6xVzn:KprhInT52BRZ1xatWG9pg4AEkkO6xVzn
TLSH T13BA58E7136406876C1230F30B90DFB7AF16F69FC0FB661C75294AAB8293D142961DE7A
dhash icon d292b0b2da36bcbe (11 x AsyncRAT, 7 x Metasploit, 6 x CoinMiner)
Reporter JAMESWT_WT
Tags:51.195.57.236 exe ParallaxRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
179
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b
Verdict:
No threats detected
Analysis date:
2021-10-21 10:28:35 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/91e9635c-c0e7-4385-9dc8-ba015b02f30f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/199046/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug anti-vm greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/61713e5ddb358dd15ecd4b08/reports/08a06923-8c61-4e2c-9033-fecc41275d5a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Parallax RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/79468633-98ca-44fb-85cf-08f2f95a0a68
Result
Threat name:
Parallax RAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/874479
Signature
Allocates memory in foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sample uses process hollowing technique
Sigma detected: Copying Sensitive Files with Credential Data
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect virtualization through RDTSC time measurements
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Parallax RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 506908 Sample: rLb8CKRXBn Startdate: 21/10/2021 Architecture: WINDOWS Score: 100 48 strattonprlxmaespm.com 2->48 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 4 other signatures 2->58 8 rLb8CKRXBn.exe 2->8         started        11 rLb8CKRXBn.exe 2->11         started        signatures3 process4 signatures5 64 Multi AV Scanner detection for dropped file 8->64 66 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->66 68 Machine Learning detection for dropped file 8->68 72 3 other signatures 8->72 13 sxstrace.exe 8->13         started        16 cmd.exe 1 8->16         started        18 cmd.exe 1 8->18         started        70 Sample uses process hollowing technique 11->70 20 cmd.exe 1 11->20         started        23 sxstrace.exe 11->23         started        25 cmd.exe 1 11->25         started        process6 dnsIp7 50 strattonprlxmaespm.com 51.195.57.236, 49804, 49839, 8090 OVHFR France 13->50 27 conhost.exe 16->27         started        29 xcopy.exe 1 16->29         started        31 conhost.exe 18->31         started        33 schtasks.exe 1 18->33         started        60 Uses schtasks.exe or at.exe to add and modify task schedules 20->60 35 xcopy.exe 4 20->35         started        38 conhost.exe 20->38         started        62 Tries to detect virtualization through RDTSC time measurements 23->62 40 conhost.exe 25->40         started        42 schtasks.exe 1 25->42         started        signatures8 process9 file10 44 C:\Users\user\AppData\...\rLb8CKRXBn.exe, PE32 35->44 dropped 46 C:\Users\...\rLb8CKRXBn.exe:Zone.Identifier, ASCII 35->46 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2021-05-26 11:20:20 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Result
Malware family:
parallax
Create hunting rule
Score:
  10/10
Tags:
family:parallax rat suricata upx
Link:
https://tria.ge/reports/211021-mby19ababl/
Behaviour
Creates scheduled task(s)
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
UPX packed file
ParallaxRat
ParallaxRat payload
suricata: ET MALWARE Parallax CnC Response Activity M14
Unpacked files
SH256 hash:
d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b
MD5 hash:
4abef812fd4cc15769b94ad459d0c5e2
SHA1 hash:
bb772e658af670d38efe94d075a0c57d312af6b1
Link:
https://www.unpac.me/results/40a16e09-8575-4cbd-8cb7-e89d3bde8a39/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d62d2888067b3dab7d93cba362202c4a17c086c531949b071f9758866b4c9d6b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/199046/

Comments