Extracted

• • Target

    TelegramRAT.exe

  • Size

    143KB

  • MD5

    d469138477c7462efab75afd4bd13db7

  • SHA1

    daa970c886981f8ae8264fda8fc104dbffac6c66

  • SHA256

    d064c0c5e34236710062931303079f19ec3974327b3800d9fb6ec69fed002100

  • SHA512

    8188e0988a95c4cc1bef475c841c781aa4c3a603cfc15184bd3f4e6103d9631effc722c2f67aee268650254490e89a57a75493f9fccec28b9058108579aea0a8

  • SSDEEP

    3072:GhcmsSrI7vLHvWk4EqvE2Rf2p65dd54f/iaK9N4bve0ZQWf5CrAZuCrM:Gv4v8Ef/iayubWa

  Score

  10^/10

  toxiceyerattrojanspywarestealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2