Extracted

• • Target

    Sclix.exe

  • Size

    233KB

  • MD5

    c7f1bd7b57edf9520890ee16983502fa

  • SHA1

    fdbc603b4db1c31a9ce8a2fd7a9762058f70bd6e

  • SHA256

    2b2a1cec02d3ceff888429ebd5f4bf95cef7e2a5b09227b54d8f8cbe2b061ecf

  • SHA512

    69f867868238cb297d13f3a40a01d0898de76db3286bc21d745e55f6bde237469d96654f3da1618183250ca991061d041ae75ca9e5e63a2247cbb13286cb78ee

  • SSDEEP

    3072:ebobMsBnwouY8ZbxqH8QWOzCrAZuHqZz6dfx+myknaLtDJrhWCd7LZe+K1OHx6Y:YsBnwoebgNJzOp+e

  Score

  10^/10

  toxiceyeratspywarestealertrojan

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1