Extracted

• • Target

    TelegramRAT.exe

  • Size

    141KB

  • MD5

    3f348796bd487827ac9e566dc082d5ce

  • SHA1

    54fd77ca70dfcb9dfa092ff5f5cc911eca27e39d

  • SHA256

    05784dc21b94b6c838f1d979fcf7107fc7c1be31c026eccc9259c7878a52ba92

  • SHA512

    bc5292d8a45e10fd59d4661bdb189f595407b5c3f5fbe2f6a3153e129d75a1d8e868ada144504640c2e1504cba8c717a365fab145ad04b7c179f2829f17309c8

  • SSDEEP

    3072:Txx7ZFDCfyVRHpy756OtAVIqOYiibKmCPQW4eCrAZrRen1:FZZFDCfyVRJchDebZos

  Score

  10^/10

  toxiceyerattrojanspywarestealer

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2