The PolySwarm Blog

Analyze suspicious files and URLs, at scale, millions of times per day. Get real-time threat intel from a crowdsourced network of security experts and antivirus companies competing to protect you.

Parallax RAT Targeting Crypto

Mar 7, 2023 11:36:09 AM / by The Hivemind

Parallax RAT Targeting Crypto_Blog

Verticals Targeted: Cryptocurrency, DeFi, Finance 

Executive Summary

Uptycs recently reported on activity in which threat actors used Parallax RAT to target entities in the cryptocurrency sector.

Key Takeaways

  • Threat actors recently used Parallax RAT to target cryptocurrency entities. 
  • Parallax is typically distributed via phishing emails and spam campaigns.
  • In this campaign, two stages of payloads are used. 
  • Threat actors used Notepad to communicate with victims.

What is Parallax RAT?

Uptycs recently reported on activity in which threat actors used Parallax RAT to target entities in the cryptocurrency sector. Parallax is a RAT available for purchase on hacker forums since at least 2019. It is typically distributed via spam campaigns and phishing emails. In the recently observed activity, Parallax was targeting cryptocurrency organizations and using injection techniques to hide inside legitimate processes. Parallax’s capabilities include reading login credentials, accessing files, keylogging, remote desktop control, and remote control of victim machines.

The attack uses two stages of payloads. The first payload analyzed by Uptycs was written in Visual C++.  Parallax uses process hollowing to inject the second payload within legitimate processes, making it more difficult to detect. The malware creates a copy of itself in the Windows Startup folder to maintain persistence. 

The second payload is a 32 bit binary executable.This payload is used for gathering system information, for keylogging, and for remote control of the victim machine. Other information gathered includes the computer name, OS version, and data stored on the clipboard. The threat actors can use the malware to interact with the victim via Notepad, instructing them to connect to a Telegram channel. The threat actors can also shutdown or restart the infected system.



PolySwarm has multiple samples associated with Parallax RAT.


You can use the following CLI command to search for all Parallax RAT samples in our portal:
$ polyswarm link list -f Parallax 


Don’t have a PolySwarm account? Go here to sign up for a free Community plan or to subscribe.

Contact us at | Check out our blog | Subscribe to our reports



Topics: Threat Bulletin, Cryptocurrency, RAT, Parallax, ParallaxRat

The Hivemind

Written by The Hivemind

Subscribe to Email Updates

Lists by Topic

see all

Posts by Topic

See all

Recent Posts