Overview

overview

10

Static

static

10

a054833107...8f.exe

windows7_x64

10

a054833107...8f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f

  • Size

    131KB

  • Sample

    220206-n7tbbaabak

  • MD5

    1a4a9f4727863df927b47392049d9c9f

  • SHA1

    d15e4eae9cce74b481b1c5aacdcccacb7ec07a6f

  • SHA256

    a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f

  • SHA512

    71d0274e2d1cccb6ef0870a2518c09801e5ee65fd8b403266100a0892b51682557f0c87bc08f1f16a239ed54d46a2e4ad08c16c2c0a0e5508e3ed246d014f3f3

Score
10/10
parallaxpersistencerat

Malware Config

Targets

    • Target

      a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f

    • Size

      131KB

    • MD5

      1a4a9f4727863df927b47392049d9c9f

    • SHA1

      d15e4eae9cce74b481b1c5aacdcccacb7ec07a6f

    • SHA256

      a054833107078b5825c82c523910d32fa838e8c95d3e9bd66c3123c092be2e8f

    • SHA512

      71d0274e2d1cccb6ef0870a2518c09801e5ee65fd8b403266100a0892b51682557f0c87bc08f1f16a239ed54d46a2e4ad08c16c2c0a0e5508e3ed246d014f3f3

    Score
    10/10
    parallaxpersistencerat

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks