toxiceye | TelegramRAT[.]exe | Triage

Sharing

General

Target

TelegramRAT.exe
Size

111KB
MD5

122174c5133057a13e9d1aaaadf080d1
SHA1

c07281383bd7755df09c8de90b599938686efeb9
SHA256

55d2ee012d4bc880210a63b0b9e10a31b65d58d2d341a0585806965c8030b519
SHA512

d3899e4e2c369a36d7edfb7f165b441943cde89be6ff7645e83c8638c5d35f65b58b960414eb3ff35c4a119fbe6a37c12d2767db8a270c8b0a854d584f292b9b
SSDEEP

1536:D+bAQACiEXM91qQIwvL9xtCc0Di4OybhDqI64QW4zCrAZuoNoDX:abaCHXELrxp6bxqH4QW4zCrAZuoeX

Score

10^/10

toxiceye

Malware Config

Signatures

Toxiceye family
toxiceye
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

TelegramRAT.exe

Files

TelegramRAT.exe
.exe windows:4 windows x86

Password: 1

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ