Overview

overview

10

Static

static

6

feedback.exe

windows7_x64

10

feedback.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    feedback.exe

  • Size

    13.4MB

  • Sample

    210122-24w8zs92ax

  • MD5

    6d2f9dca8d6f824c954a1b850a8ccbc5

  • SHA1

    0bfa4822f81fe83f28274394777aeeb555e32424

  • SHA256

    dbe772e7c809915fed298d93fdb53a6239028790a3b8e02dc07b669536ef3471

  • SHA512

    642536a1bdf26692f4bf9d5c581b69e1616a0c17c32144a4ea250e02c9bbbc48680a00ef62aac8e261e485be32aec7c73162dbd623e789c8caf63f8e84b9d4c3

Score
10/10
parallaxransomwarerat

Malware Config

Targets

    • Target

      feedback.exe

    • Size

      13.4MB

    • MD5

      6d2f9dca8d6f824c954a1b850a8ccbc5

    • SHA1

      0bfa4822f81fe83f28274394777aeeb555e32424

    • SHA256

      dbe772e7c809915fed298d93fdb53a6239028790a3b8e02dc07b669536ef3471

    • SHA512

      642536a1bdf26692f4bf9d5c581b69e1616a0c17c32144a4ea250e02c9bbbc48680a00ef62aac8e261e485be32aec7c73162dbd623e789c8caf63f8e84b9d4c3

    Score
    10/10
    parallaxransomwarerat

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Blocklisted process makes network request

    • Drops startup file

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks