Overview

overview

10

Static

static

10

TelegramRAT.exe

windows7-x64

10

TelegramRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TelegramRAT.exe

  • Size

    143KB

  • MD5

    74f22ec8451a5d788ee312e2b637519c

  • SHA1

    a7bd09f6f3d7f9b3ec33b5d4c2787223459d1fc0

  • SHA256

    48614dc3fd49968db9c35b840a6609f397f2f1813daa7c56b659036edf82f2e2

  • SHA512

    5b356e4811c58bcede2c3a5a0614e40049ef2a68c63c76fa78f612441d1ca9e1200f7a0544ffbca66ab4e0668fd0ec196bf0cdbff60ff7097c5f476b1675492b

  • SSDEEP

    3072:e0cwsSCbN9bHfhFuZHvE2Rf2p65ddPPHziJsEabvx0hQWf5CrAZuCHd:eEs9Crziy7bpq

Score
10/10
toxiceye

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7040511851:AAEjBKSxADGWlNtLxaKpotGtf53NUQ1UgAo/sendMessage?chat_id=6226815698

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Toxiceye family
    toxiceye
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections