Overview

overview

10

Static

static

5

AppvIsvSub...32.dll

windows10-2004-x64

10

AppvIsvSub...32.dll

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    AppvIsvSubsystems32.dll
  • Size 1.1MB
  • Sample261107-ts7s2sd18m
  • SHA256 118b8305ff432328fb0a7bb8a871800913154fd165c87dca0f2c0d555b3f738a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
parallaxdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target
      AppvIsvSubsystems32.dll
    • Size 1.1MB
    • SHA256 118b8305ff432328fb0a7bb8a871800913154fd165c87dca0f2c0d555b3f738a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryparallaxpersistencerat

    • Family: ParallaxRat

      ParallaxRat is a multipurpose RAT written in MASM.

      ratparallax

    • ParallaxRat payload

      Detects payload of Parallax Rat, a small portable Rat usually digitally signed with a Sectigo certificate.

    • Executes dropped EXE

    • Writes a Windows system DLL name to a user directory

      A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

      defense_evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks