parallax | 0e8985d60562c67919ccbc064d3082fb4d8e6315906319fc543e4800dacc75e6

General

Target
0e8985d60562c67919ccbc064d3082fb4d8e6315906319fc543e4800dacc75e6.bin
Size 3.3MB
Sample260107-rm1rfagz6f
SHA256 0e8985d60562c67919ccbc064d3082fb4d8e6315906319fc543e4800dacc75e6
MD5 fc29a7a6865f0bf03bff7c532d0fc1bd
SHA1 223d5fa70c10b57bcb46b0c4b2c4fc2ac575f1d0
SHA512 cc6cc653a49d8143dafaae7be38461fb01337d434c05b9b6c8ca99b1c1ab0afe9d2cde7bb20968e996ce766504811bf741e2a2c4d0402fe1750049d397d7d8d2
SSDEEP 49152:pTKX4fsM+A6eZsSSSV75AlfTuX7DVkwWygTBPl6lCB9m4hW:5wK+AxmfTuX7DVkEvCBth
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  0e8985d60562c67919ccbc064d3082fb4d8e6315906319fc543e4800dacc75e6.bin
- Size 3.3MB
- SHA256 0e8985d60562c67919ccbc064d3082fb4d8e6315906319fc543e4800dacc75e6
- MD5 fc29a7a6865f0bf03bff7c532d0fc1bd
- SHA1 223d5fa70c10b57bcb46b0c4b2c4fc2ac575f1d0
- SHA512 cc6cc653a49d8143dafaae7be38461fb01337d434c05b9b6c8ca99b1c1ab0afe9d2cde7bb20968e996ce766504811bf741e2a2c4d0402fe1750049d397d7d8d2
- SSDEEP 49152:pTKX4fsM+A6eZsSSSV75AlfTuX7DVkwWygTBPl6lCB9m4hW:5wK+AxmfTuX7DVkEvCBth
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

collection credential_access discovery parallax rat spyware stealer
- Parallax family
  parallax
- ParallaxRat
  ParallaxRat is a multipurpose RAT written in MASM.
  rat parallax
- ParallaxRat payload
  Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2