Extracted

• • Target

    TelegramRAT.exe

  • Size

    142KB

  • MD5

    6d8b4e6092594fbdbe2c388270a5e005

  • SHA1

    7c7b30444c1d6e6964c9ff8c2b508f63ec0dc257

  • SHA256

    ba8d40a2a20d44a25041fb635bc86e596a41d42d695614f0ff01c0529e820fec

  • SHA512

    a932e9bf57eda27f1274cdfe83e772501a809f59a9df228fbfce207c8f409998bea3a92436ee3ba9c936fed30593faa5f61fc0d16e21c9f1963b73cc9d66bf88

  • SSDEEP

    3072:2KhQM7EchJ+L7y7lU+QHlYIYLfbgb1ZiPrk3I0rbAe0hQW4VCrAZ71+i:D17EchJ+L2m1ZG4XbN1

  Score

  10^/10

  toxiceyerattrojanspywarestealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2