Parallax RAT Analysisinfo

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (232)

Timeline

The data in this chart does not reflect real data. It is dummy data, distorted and not usable in any way. You need an additional purchase to unlock this view to get access to more details of real data.

Lang

en	144
zh	16
sv	10
ru	10
ja	8

Country

US: USA	34
SV: El Salvador	10
AR: Argentina	8
DE: Germany	8
PT: Portugal	6

Actors

Remcos	3
Parallax RAT	2
BitRAT	1
Quasar RAT	1
RastaFarEye	1

Activities

Interest

Timeline

Type

Not Defined	96
Operating System	18
Smartphone Operating System	12
Groupware Software	10
Cloud Software	8

Vendor

Not Defined	68
Microsoft	18
Google	10
Mozilla	8
IBM	4

Product

Microsoft Windows	12
Google Android	6
Samba	4
RoundCube Webmail	4
Mozilla Thunderbird	4

Vulnerabilities

#	Vulnerability	Base	Temp	0day	Today	Exp	Rem	EPSS	CTI	CVE
1	CmsEasy language_admin.php getslide_child_action sql injection	7.5	7.3	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00063	0.00	CVE-2024-0523
2	cmseasy cleartext transmission	5.6	5.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00100	0.00	CVE-2020-18406
3	cmseasy Database Configuration information disclosure	5.0	4.8	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.00076	0.00	CVE-2021-42644
4	RoundCube Webmail Config Setting rcube_image.php argument injection	8.5	8.4	$0-$5k	$0-$5k	High	Official Fix	0.12696	0.00	CVE-2020-12641
5	Hitachi Energy UNEM R16A inadequate encryption	6.7	6.6	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00200	0.00	CVE-2021-40342
6	Artifex MuJS jsdate.c MakeDay integer overflow	6.5	6.4	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00133	0.00	CVE-2017-5628
7	Centreon Poller sql injection	4.7	4.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00434	0.04	CVE-2022-41142
8	Compuware ISPW Operations Plugin Configuration authorization	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00054	0.00	CVE-2022-36898
9	openSIS Community Edition index.php sql injection	8.5	8.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.02428	0.06	CVE-2020-6637
10	marscode index.js fs.readFile path traversal	7.4	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00637	0.00	CVE-2020-7681
11	Apple macOS behavioral workflow	5.3	5.1	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00053	0.00	CVE-2024-44255
12	IBM MQ Configuration memory allocation	6.4	6.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00063	0.04	CVE-2024-35116
13	Advanced File Manager Plugin exposure of information through directory listing	5.9	5.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00064	0.00	CVE-2024-5598
14	Blossom Themes BlossomThemes Email Newsletter Plugin server-side request forgery	4.6	4.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.03	CVE-2024-37098
15	Table Addons for Elementor Plugin cross site scripting	5.1	5.1	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.00	CVE-2024-4313
16	Autel MaxiCharger AC Elite Business C50 BLE AppChargingControl stack-based overflow	8.3	8.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00046	0.05	CVE-2024-23959
17	Live Composer Team Page Builder Plugin cross site scripting	4.4	4.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00045	0.00	CVE-2024-35768
18	Trellix EDR UI XConsole cross site scripting	4.3	4.3	$0-$5k	Calculating	Not Defined	Official Fix	0.00045	0.04	CVE-2024-4176
19	Cybozu Garoon Mail Forwarding information disclosure	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00043	0.00	CVE-2024-31400
20	CmsEasy index.php cross-site request forgery	6.5	6.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00165	0.00	CVE-2018-11679

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	IP address	Hostname	Actor	Identified	Type	Confidence
1	5.2.68.94		Parallax RAT	02/06/2022	verified	Medium
2	XX.XXX.XX.XXX	xxxxx.xx-xx-xxx-xx.xx	Xxxxxxxx Xxx	07/18/2021	verified	Low
3	XX.XXX.XX.XXX	xxxxx.xx-xx-xxx-xx.xx	Xxxxxxxx Xxx	11/10/2021	verified	Medium
4	XXX.XXX.XXX.XXX		Xxxxxxxx Xxx	02/16/2024	verified	Very High

TTP - Tactics, Techniques, Procedures (19)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Class	Vulnerabilities	Access Vector	Type	Confidence
1	T1006	CAPEC-126	CWE-21, CWE-22, CWE-36	Path Traversal	predictive	High
2	T1040	CAPEC-102	CWE-319	Authentication Bypass by Capture-replay	predictive	High
3	T1059	CAPEC-137	CWE-88, CWE-94, CWE-1321	Argument Injection	predictive	High
4	T1059.007	CAPEC-209	CWE-79, CWE-80	Cross Site Scripting	predictive	High
5	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
6	TXXXX		CWE-XXX	Xxxx Xxx Xxxxxxxxx Xxxxxxxxxxx Xxxxxxxx	predictive	High
7	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	High
8	TXXXX	CAPEC-XXX	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	High
9	TXXXX		CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	High
10	TXXXX	CAPEC-XXX	CWE-XX	Xxx Xxxxxxxxx	predictive	High
11	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxx Xxxxxxxxxxxxx	predictive	High
12	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
13	TXXXX	CAPEC-XXX	CWE-XXX	Xxxxxxx Xxxxxxxxxx Xx Xxx-xxxxxxxx	predictive	High
14	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	High
15	TXXXX.XXX	CAPEC-XXX	CWE-XXX	Xxxxxxxx	predictive	High
16	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	High
17	TXXXX	CAPEC-XXX	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	High
18	TXXXX.XXX		CWE-XXX	Xxx Xxxxxxxxxx Xxxxx	predictive	High
19	TXXXX.XXX	CAPEC-X	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	High

IOA - Indicator of Attack (89)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Class	Indicator	Type	Confidence
1	File	/action/ipcamSetParamPost	predictive	High
2	File	/admin/?page=orders/view_order	predictive	High
3	File	/admin/add_exercises.php	predictive	High
4	File	/admin/baojia_list.php	predictive	High
5	File	/adminui/history_log.php	predictive	High
6	File	/ajax/remove_sniffer_raw_log/	predictive	High
7	File	/bin/httpd	predictive	Medium
8	File	/dist/index.js	predictive	High
9	File	/goform/AddSysLogRule	predictive	High
10	File	/goform/delDhcpRules/	predictive	High
11	File	/goform/SysToolReboot	predictive	High
12	File	/x/xxxxxx?xxxxxx	predictive	High
13	File	/xxxxx/xxxx/xx.xxx	predictive	High
14	File	/xxxxx.xxx?xxxx=xxxxx&xxx=xxx&xxxxx=xxxxxxx&xxxxx_xxx=xxxxx	predictive	High
15	File	/xxxxx.xxx?xxxxxx=xxxxxxxx/xxxxxxxx	predictive	High
16	File	/xxxxxxxx/xxxxxxxxxxxx.xxx	predictive	High
17	File	xxxxxxx.xxx	predictive	Medium
18	File	xxxxx.xxxx	predictive	Medium
19	File	xxxxx.xxx	predictive	Medium
20	File	xxxxx/xxxxxx.xxx	predictive	High
21	File	xxxx/xxxxxxxxxxxxxxxx.xxx	predictive	High
22	File	xxx/xxxxxxx/xxxxxxxx	predictive	High
23	File	xx_xxxxx_xxxxx.xxx	predictive	High
24	File	xxxxxxxx/xxxxx.xxx	predictive	High
25	File	xxx/xxxxxxx/xxxxxxx	predictive	High
26	File	xxxxxxxxxxx_xxxx	predictive	High
27	File	xxxxxx.xx	predictive	Medium
28	File	xxxx_xxxx.x	predictive	Medium
29	File	xxxxxxx/xxxxx/xxx-xxxx/xxx_xxx.x	predictive	High
30	File	xxxx-xxxxx.xxx	predictive	High
31	File	xxxxxxxxxxxxxxxxx.xxx/xxxxxxxxxxxxxxx.xxx	predictive	High
32	File	xxxxxxx.xxx	predictive	Medium
33	File	xxxxxxxxxxx.xxx	predictive	High
34	File	xxxxx.xx	predictive	Medium
35	File	xxxxx.xxx	predictive	Medium
36	File	xxxxxx.x	predictive	Medium
37	File	xx/xxx.x	predictive	Medium
38	File	xxx/xxxxxxx/xxxxxxxxxxxx	predictive	High
39	File	xxx.xxx	predictive	Low
40	File	xxxx-xxx.xxx	predictive	Medium
41	File	xxxxxxxxxxxxxx.xxx	predictive	High
42	File	xxxxx_xxxxx.xxx	predictive	High
43	File	xxxxx_xxxxxx_xxxxxxxx.xxx	predictive	High
44	File	xxxxx.xxx	predictive	Medium
45	File	xxxxxx.xxx	predictive	Medium
46	File	xxxxxxx.xx	predictive	Medium
47	File	xxxxxx.xxx	predictive	Medium
48	File	xxx_xxxxxxxx.xxx	predictive	High
49	File	xxx/xxxxxxxxx/xxxxx/xxxxxxx/	predictive	High
50	File	xxx/xxxx/xxxxxxxxxxxxxxx.xxxx	predictive	High
51	File	xx-xxxxxxxxx.xxx	predictive	High
52	Library	xxx/xxxxx/xxxxxxxx_xxxxx.xxx	predictive	High
53	Library	xxx/xxxxx/xxxxxxxx_xxxxx.xxx	predictive	High
54	Library	xxx/xxxxxxx/xxx.xx	predictive	High
55	Argument	xxx_xxx	predictive	Low
56	Argument	xxxxxxxx	predictive	Medium
57	Argument	xxxx_xxx	predictive	Medium
58	Argument	xxxx	predictive	Low
59	Argument	xxxx	predictive	Low
60	Argument	xxxxxx_xxxxxxxx	predictive	High
61	Argument	xxxx_xxx	predictive	Medium
62	Argument	xxxxx/xxxxx/xxxxxx	predictive	High
63	Argument	xxxxxxxx_xxxxx	predictive	High
64	Argument	xxxx/xx	predictive	Low
65	Argument	xxxx	predictive	Low
66	Argument	xx	predictive	Low
67	Argument	xxxxxxx	predictive	Low
68	Argument	xxxxx_xxxx	predictive	Medium
69	Argument	xxxx	predictive	Low
70	Argument	xxxx	predictive	Low
71	Argument	xxxxxxxx	predictive	Medium
72	Argument	xxxx	predictive	Low
73	Argument	xxxxx_xxxx_xxxx	predictive	High
74	Argument	xxxxxxxx	predictive	Medium
75	Argument	xxxxxxxxxxxx	predictive	Medium
76	Argument	xxx	predictive	Low
77	Argument	xxxxxxxxxxxxxx	predictive	High
78	Argument	xx_xx	predictive	Low
79	Argument	xxxx_xxxx	predictive	Medium
80	Argument	xxx	predictive	Low
81	Argument	xxxx-xxxxx	predictive	Medium
82	Argument	xxxxxxxx	predictive	Medium
83	Argument	xxxxxxxx	predictive	Medium
84	Argument	xxxxxxxx/xxxx	predictive	High
85	Argument	xxxx_xx	predictive	Low
86	Argument	xxxxx[_xxxxxxxx]	predictive	High
87	Argument	xxxxxxxxxxxxx	predictive	High
88	Argument	_xx	predictive	Low
89	Input Value	%xx	predictive	Low

References (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PreviousOverviewNext ▸

This view requires CTI permissions

Just purchase a CTI license today!