{
  "Name": "Parsec",
  "Category": "RAT",
  "Description": "Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. \n\nRemote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. \nSecure, flexible, effortless access to whatever you do, at any time, from wherever you go.\n\nParsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access.\n",
  "Author": "Luca Di Bartolomeo & Matt Green",
  "Created": "2025-03-16",
  "LastModified": "2025-03-16",
  "Details": {
    "Website": "https://parsec.app/",
    "PEMetadata": {
      "Filename": "parsecd.exe",
      "OriginalFileName": "",
      "Description": "Parsec",
      "Product": "Parsec"
    },
    "Privileges": "Current User",
    "Free": true,
    "Verification": false,
    "SupportedOS": [
      "Windows",
      "Linux",
      "macOS",
      "Android"
    ],
    "Capabilities": [
      "Remote Control",
      "GUI Support"
    ],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files\\Parsec\\*",
      "parsecd.exe",
      "pservice.exe"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "C:\\Program Files\\Parsec\\parsecd.exe",
        "Description": "Main parsec executable",
        "OS": "Windows",
        "Example": [
          "SHA256: 38011E713B4BE8577576062754CAD03E9899859488932AE4C9C83E5FBB5CB7D2"
        ]
      },
      {
        "File": "C:\\Program Files\\Parsec\\pservice.exe",
        "Description": "Background service managing input devices",
        "OS": "Windows",
        "Example": [
          "SHA256: CC62D22BF8A082621FA25FDEEE3150C17B09DBC09C9371E3DCDD6EC83967770C"
        ]
      },
      {
        "File": "C:\\Program Files\\Parsec\\teams.exe",
        "Description": "Parsec for teams collaboration and user session management",
        "OS": "Windows",
        "Example": [
          "SHA256: 6DC71B2E92B770DCFECA4A32C8F1787210311F731F1124754DF193EC22D5D13E"
        ]
      }
    ],
    "EventLog": [
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "parsecvirtualds",
        "ImagePath": "\"\\SystemRoot\\System32\\drivers\\parsecvirtualds.sys\"",
        "ServiceType": "kernel mode driver",
        "StartType": "demand start",
        "AccountName": "System",
        "Description": "Parsec service installation event",
        "Example": "<Event xmlns=\"http://schemas.microsoft.com/win/2004/08/events/event\"><System><Provider Name=\"Service Control Manager\" Guid=\"{555908d1-a6d7-4695-8e1e-26931d2012f4}\"EventSourceName=\"Service Control Manager\" /><EventID Qualifiers=\"16384\">7045</EventID><Version>0</Version><Level>4</Level><Task>0</Task><Opcode>0</Opcode><Keywords>0x8080000000000000</Keywords><TimeCreated SystemTime=\"2025-03-16T23:16:53.5897766Z\" /><EventRecordID>596</EventRecordID><Correlation /><Execution ProcessID=\"804\" ThreadID=\"912\" /><Channel>System</Channel><Computer>Computer</Computer><Security UserID=\"S-1-5-18\" /></System><EventData><Data Name=\"ServiceName\">parsecvirtualds</Data><Data Name=\"ImagePath\">\\SystemRoot\\System32\\drivers\\parsecvirtualds.sys</Data><Data Name=\"ServiceType\">kernel mode driver</Data><Data Name=\"StartType\">demand start</Data><Data Name=\"AccountName\"></Data></EventData></Event>"
      }
    ],
    "Registry": [],
    "Network": [
      {
        "Description": "Known domains used by Parsec",
        "Domains": [
          "parsec.app",
          "parsec.gg",
          "*.parsec.app"
        ],
        "Ports": [
          443,
          3478
        ]
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/parsec_network_sigma.yml",
      "Description": "Detects potential network activity of Parsec RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/parsec_files_sigma.yml",
      "Description": "Detects potential files activity of Parsec RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/parsec_processes_sigma.yml",
      "Description": "Detects potential processes activity of Parsec RMM tool"
    }
  ],
  "References": [
    "https://parsec.app/",
    "https://www.virustotal.com/gui/file/206cd186aaa431d3975eb30f682b83851ef4f81125d2004f53b681117da23ec6/behavior",
    "https://x.com/malmoeb/status/1923255362318196951"
  ],
  "Acknowledgement": [
    {
      "Person": "Luca Di Bartolomeo",
      "Handle": "@LucaInfoSec"
    },
    {
      "Person": "Matt Green",
      "Handle": "@mgreen27"
    }
  ],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Unity Technologies SF",
        "certificate_thumbprint": "B73664F2AF5A8EF4529F03DB4B2CCD8275A6EC91",
        "certificate_der_base64": "MIIHODCCBSCgAwIBAgIUWALYqpad1/yvVG95loCZXx8PEcMwDQYJKoZIhvcNAQELBQAwgYYxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjEgMB4GA1UECxMXU2VjdXJlIFNvZnR3YXJlIE1hbmFnZXIxPDA6BgNVBAMTM0RpZ2lDZXJ0IFByaXZhdGUgU2hhcmVkIENvZGUgU2lnbmluZyBSU0EgSXNzdWluZyBDQTAeFw0yMzA5MjkxODI5MDhaFw0yNjA5MjkxODI5MDhaMIGiMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEOMAwGA1UEERMFOTQxMDMxFjAUBgNVBAkTDTMwIDNyZCBTdHJlZXQxHjAcBgNVBAoTFVVuaXR5IFRlY2hub2xvZ2llcyBTRjEeMBwGA1UEAxMVVW5pdHkgVGVjaG5vbG9naWVzIFNGMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAmLHyeiEWwXxDhzDgWq+uSrFHo5hK75XBEzRmSSPvBCsncAq6/h/5j1qsdtpN8l+unuZ6J8V5vTMiCDYJfiXqUDzWJGL7KtLwXZVVpbHoI9uR06tIluFA0/ii3Z2Db4bQDT5k3xPgHIov/YzyBl1SNb/OE7u6QwIkPaKUVEjoKr37Uo2e4qLX7WWM4dvgLERokWLB8blZbxkvMLNNwVUaFgH1jmSoSUjHFGofj2OO4B+6w2mgzbF8JKs2n/IBBfP/lnwZkpONH1Z8hgNQUzcRvBxFlSTVz84YNQVgqFabvw+wiLXWDgy8USApmomAMV7V+kfWF8EIdi+wF18ykh7uMHrbLdzdoSz8SLwDrRyquijebMbqCd6FEf1x/VkhUBwb/85PwVwPq+t2zDjrKFY/7wqlRPoNsPAOxxkYn8u/VFOMZ9YlGV2g91x353NQpvCdnKoJS/Q745di8wzcEZDoJwEdfTt8wZhW+seccBVlHFciWVkWAjkMxm5MmhA6ksc9M0xMwV8TzgvZSy4/d5+c25H5cVgJUAnkhVUd+NxECOvbYkfo3zDmsMQOZ37314mP3qgpPVD3LE0FYkPFrHpKTGylVZkIFdGvbjIqJooipwp5422Y0C9r82yKQxR0twXt8p/BIKIhM0k1JGribs+qzj3PLTIWJlNPtHVDd0eZGxcCAwEAAaOCAX4wggF6MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFMyGFHiKXauN6Pml6gEwewVzMeghMB8GA1UdIwQYMBaAFCZg4bSPjguYZ6t8Z6L5B4np57qAMA4GA1UdDwEB/wQEAwIF4DAgBgNVHSUBAf8EFjAUBggrBgEFBQcDAwYIKwYBBQUHAwIwgZgGCCsGAQUFBwEBBIGLMIGIMCgGCCsGAQUFBzABhhxodHRwOi8vb2NzcC5vbmUuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5vbmUuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0UHJpdmF0ZVNoYXJlZENvZGVTaWduaW5nUlNBSXNzdWluZ0NBLmNydDBdBgNVHR8EVjBUMFKgUKBOhkxodHRwOi8vY3JsLm9uZS5kaWdpY2VydC5jb20vRGlnaUNlcnRQcml2YXRlU2hhcmVkQ29kZVNpZ25pbmdSU0FJc3N1aW5nQ0EuY3JsMA0GCSqGSIb3DQEBCwUAA4ICAQAxfPCy+QHXvWQ0eu5O/RUV1l21CaraMJojROdql0UOLqp2cMQDqO9QEN8rslily9Jr9fM1iixw0KUEi1R6/ghvNFdmwzeAxO/641MxNpptV1Sx+IdThlVKsMzRdw+NiVXnaGj7twrTYDaK+N0wPXGYjX2TH2+WodC0Wt43+y7Ly/boY3l/8XsnhJ+N3UaRgEWUTGy2RPWvtLgoTSB98H74mSiEcxQSMRFF38fzYWhGrSNoUoLIuk0AKGMYq2NZrGUuUYcy+PPrcGHEyyDl5Od/eMSlK1ZAMWQ1nRwU7BWE/IjaPf7nMpDWODV6vm+7cxAmLjSDHl8XRrWQFaBGqYo0uwiWm23v2tHp42xrwmydZCTFwp0ZEdJBnlpYdAamt/ttzDNxM46DEWyStW7vDk3OBHVsZ7AvgQb+xlNVfk3LuEaCgTn72lGmiU2DWvXel3HI3awNCyf9zd6J2qGB9bQRCXtKFsdor3PZ9gppPl/zOwU3jzBH37TZdZ1ZrdwHqPR/16OY8w9RGsGnqSauVvWcJ03JmqbgzMg6uejuMrBgO6KIKrCi4PTh7F84YMVtwS4mFchAAf58kSTZh39axE9s0zCIALANrf9R/VFCg69KV66dnOcXyLny0F52YXhFTcFfSvMH5Xbac/uTsF7zCOSVSROp/5Se0mQSBickpQeeyw==",
        "src_file_sha256": "cc62d22bf8a082621fa25fdeee3150c17b09dbc09c9371e3dcdd6ec83967770c",
        "src_file_path": "downloaded_files/parsec/cc62d22bf8a082621fa25fdeee3150c17b09dbc09c9371e3dcdd6ec83967770c",
        "src_file_company": "Parsec"
      }
    ]
  }
}