SYMBOLCOMMON_NAMEaka. SYNONYMS
win.parallax (Back to overview)

Parallax RAT

aka: ParallaxRAT
VTCollection    

Parallax is a Remote Access Trojan used by attackers to gain access to a victim's machine. It was involved in one of the many infamous "coronamalware" campaigns. Basically, the attackers abused the COVID-19 pandemic news to lure victims into opening themed emails spreading parallax.

References
2023-02-28UptycsUptycs Threat Research
Cryptocurrency Entities at Risk: Threat Actor Uses Parallax RAT for Infiltration
Parallax RAT
2022-02-15Threat PostElizabeth Montalbano
TA2541: APT Has Been Shooting RATs at Aviation for Years
AsyncRAT Houdini NetWire RC Parallax RAT
2022-02-15BleepingComputerIonut Ilascu
Unskilled hacker linked to years of attacks on aviation, transport sectors
AsyncRAT Houdini NetWire RC Parallax RAT
2020-03-18MorphisecArnold Osipov
Parallax: The new RAT on the block
Parallax RAT
2020-02-27Vitali Kremez
Let’s Learn: Inside Parallax RAT Malware: Process Hollowing Injection & Process Doppelgänging API Mix: Part I
Parallax RAT
2020-02-13TalosEdmund Brumaghin, Nick Biasini
Threat actors attempt to capitalize on coronavirus outbreak
Emotet Nanocore RAT Parallax RAT
2020-02-13Bleeping ComputerLawrence Abrams
Parallax RAT: Common Malware Payload After Hacker Forums Promotion
Parallax RAT
2020-02-11Twitter (@malwrhunterteam)MalwareHunterTeam
Tweet on Parallax RAT
Parallax RAT
Yara Rules
[TLP:WHITE] win_parallax_auto (20230808 | Detects win.parallax.)
rule win_parallax_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.parallax."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8dbf8c000000 b934000000 f3a4 5e 56 ff7508 }
            // n = 6, score = 200
            //   8dbf8c000000         | lea                 edi, [edi + 0x8c]
            //   b934000000           | mov                 ecx, 0x34
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   5e                   | pop                 esi
            //   56                   | push                esi
            //   ff7508               | push                dword ptr [ebp + 8]

        $sequence_1 = { ff7508 ff9698010000 5e 5d c21400 55 8bec }
            // n = 7, score = 200
            //   ff7508               | push                dword ptr [ebp + 8]
            //   ff9698010000         | call                dword ptr [esi + 0x198]
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   c21400               | ret                 0x14
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_2 = { 8b5234 83c234 8915???????? 83be1801000000 7545 83be1801000000 7401 }
            // n = 7, score = 200
            //   8b5234               | mov                 edx, dword ptr [edx + 0x34]
            //   83c234               | add                 edx, 0x34
            //   8915????????         |                     
            //   83be1801000000       | cmp                 dword ptr [esi + 0x118], 0
            //   7545                 | jne                 0x47
            //   83be1801000000       | cmp                 dword ptr [esi + 0x118], 0
            //   7401                 | je                  3

        $sequence_3 = { ff763c 683c800000 ff35???????? ff92e0010000 6a00 }
            // n = 5, score = 200
            //   ff763c               | push                dword ptr [esi + 0x3c]
            //   683c800000           | push                0x803c
            //   ff35????????         |                     
            //   ff92e0010000         | call                dword ptr [edx + 0x1e0]
            //   6a00                 | push                0

        $sequence_4 = { 7411 8b75ec 8b7de0 8b4de8 f3a4 }
            // n = 5, score = 200
            //   7411                 | je                  0x13
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   8b7de0               | mov                 edi, dword ptr [ebp - 0x20]
            //   8b4de8               | mov                 ecx, dword ptr [ebp - 0x18]
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]

        $sequence_5 = { 85c0 7418 8bf8 8b35???????? b8ffffffff f0874704 50 }
            // n = 7, score = 200
            //   85c0                 | test                eax, eax
            //   7418                 | je                  0x1a
            //   8bf8                 | mov                 edi, eax
            //   8b35????????         |                     
            //   b8ffffffff           | mov                 eax, 0xffffffff
            //   f0874704             | lock xchg           dword ptr [edi + 4], eax
            //   50                   | push                eax

        $sequence_6 = { 6a00 ff9628010000 6a04 68???????? }
            // n = 4, score = 200
            //   6a00                 | push                0
            //   ff9628010000         | call                dword ptr [esi + 0x128]
            //   6a04                 | push                4
            //   68????????           |                     

        $sequence_7 = { e9???????? 3d34800000 750d ff7514 ff7510 e8???????? eb6d }
            // n = 7, score = 200
            //   e9????????           |                     
            //   3d34800000           | cmp                 eax, 0x8034
            //   750d                 | jne                 0xf
            //   ff7514               | push                dword ptr [ebp + 0x14]
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   e8????????           |                     
            //   eb6d                 | jmp                 0x6f

        $sequence_8 = { 8b5634 83c234 52 52 }
            // n = 4, score = 200
            //   8b5634               | mov                 edx, dword ptr [esi + 0x34]
            //   83c234               | add                 edx, 0x34
            //   52                   | push                edx
            //   52                   | push                edx

        $sequence_9 = { 83e934 8b4734 83c034 8b15???????? 50 51 ff92dc000000 }
            // n = 7, score = 200
            //   83e934               | sub                 ecx, 0x34
            //   8b4734               | mov                 eax, dword ptr [edi + 0x34]
            //   83c034               | add                 eax, 0x34
            //   8b15????????         |                     
            //   50                   | push                eax
            //   51                   | push                ecx
            //   ff92dc000000         | call                dword ptr [edx + 0xdc]

    condition:
        7 of them and filesize < 352256
}
[TLP:WHITE] win_parallax_w0   (20200327 | No description)
rule win_parallax_w0 {
    meta:
        author = "jeFF0Falltrades"
        source = "https://github.com/jeFF0Falltrades/IoCs/blob/master/Broadbased/parallax_rat.md"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.parallax"
        malpedia_version = "20200327"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $str_ws = ".DeleteFile(Wscript.ScriptFullName)" wide ascii
        $str_cb_1 = "Clipboard Start" wide ascii
        $str_cb_2 = "Clipboard End" wide ascii
        $str_un = "UN.vbs" wide ascii
        $hex_keylogger = { 64 24 ?? C0 CA FA }

    condition:
        3 of them
}
Download all Yara Rules