Overview

overview

10

Static

static

3

FirefoxPor...af.exe

windows11-21h2-x64

10

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FirefoxPortable_124.0_German.paf.exe

  • Size

    128.6MB

  • Sample

    240322-nq735sbd58

  • MD5

    78d73860b8402516a1da03ea38b94de6

  • SHA1

    5acd6fd1db7e8792bd0c5f8c7bbab9e826d6cf1c

  • SHA256

    fbd14a801dfd7473447ff77e13e8a0a0070459ce871b1222ed38faa9c67ef210

  • SHA512

    2f95c4a977569dc5d8272c778aecc595f5317fd6b1531fee181a607b05fad76b4c33760cd3d016955b96c3c6b12de2449ddc59d185c31caf48a57fcb46904c1c

  • SSDEEP

    3145728:XtyKufiNMRj5G306aqKTllYe+T2bfrTAHOi8UIqZ2fj:9yKybfG3RglFTHTAHx8U2j

Score
10/10
parallaxrat

Malware Config

Targets

    • Target

      FirefoxPortable_124.0_German.paf.exe

    • Size

      128.6MB

    • MD5

      78d73860b8402516a1da03ea38b94de6

    • SHA1

      5acd6fd1db7e8792bd0c5f8c7bbab9e826d6cf1c

    • SHA256

      fbd14a801dfd7473447ff77e13e8a0a0070459ce871b1222ed38faa9c67ef210

    • SHA512

      2f95c4a977569dc5d8272c778aecc595f5317fd6b1531fee181a607b05fad76b4c33760cd3d016955b96c3c6b12de2449ddc59d185c31caf48a57fcb46904c1c

    • SSDEEP

      3145728:XtyKufiNMRj5G306aqKTllYe+T2bfrTAHOi8UIqZ2fj:9yKybfG3RglFTHTAHx8U2j

    Score
    10/10
    parallaxrat

    • ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      4add245d4ba34b04f213409bfe504c07

    • SHA1

      ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

    • SHA256

      9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

    • SHA512

      1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

    • SSDEEP

      192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr

    Score
    3/10
    behavioral2

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      1d8f01a83ddd259bc339902c1d33c8f1

    • SHA1

      9f7806af462c94c39e2ec6cc9c7ad05c44eba04e

    • SHA256

      4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed

    • SHA512

      28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567

    • SSDEEP

      96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc

    Score
    3/10
    behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks