Overview

overview

10

Static

static

111c58e0ff...3c.exe

windows7_x64

10

111c58e0ff...3c.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7625266161.zip

  • Size

    586KB

  • Sample

    220623-vsrmhahad4

  • MD5

    8a2f359877036d26fa7599aceb76de59

  • SHA1

    b01ea262a0f1e6cbc3493637c806f312f84c4113

  • SHA256

    808938c65a8c1b4dfbb762f010ad7401b3ea636e8f0838eb427d3d9ee6247d76

  • SHA512

    3285c36f1473d8401c24426252a3855f2d36006d5f653ace016a2cbed5ede0e3736657d021960e678fbaebe14522a2c1f03d4a855c5260ddce01424c34a0c957

Score
10/10
parallaxrat

Malware Config

Targets

    • Target

      111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c

    • Size

      901KB

    • MD5

      ebbd33c7be8cef4f425574a4c15827db

    • SHA1

      26153e583034fca53f3ec71dd8a7cbb142b93dc3

    • SHA256

      111c58e0ffa7dc51229ca24fce8ad2abc4e4fe935a05a8be64f80e2e18083b3c

    • SHA512

      6902bb542bd0d175a38236821e9cfe3e4f9cf9eaf4b549e8d3eaf71814b521edd49afc04770324edaca3f55ce322b3271a7186219530b2754676155c1da9a03c

    Score
    10/10
    parallaxrat

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks