C:\Users\notfishvr\Downloads\CyberEye-main\TelegramRAT\obj\Debug\TelegramRAT.pdb
Behavioral task
behavioral1
Sample
TelegramRAT.exe
Resource
win7-20240221-en
General
-
Target
TelegramRAT.exe
-
Size
140KB
-
MD5
a7f2f3eb00e6fada6eef7f6d4bad84ac
-
SHA1
7772bf4e931c3ea67e6d1366b10b495618dd6733
-
SHA256
70443d8dd1d0b52f392d95b50a3582f5a2038f66a46faeb635bd7dbe73643bcb
-
SHA512
d133efdaed62350a7fcd05ffd2bd1510a731c6f131a86b54f3e941ffddd450a797bfec205decd7de1b994288fd52ed6f015839b1228720edd0927a3322c7f9d4
-
SSDEEP
3072:9kSfx8i3yykxyofe7UoxsbKm1/QW4aCrAZ54VhgO:KaxRxkxnbZ30
Malware Config
Extracted
toxiceye
https://api.telegram.org/bot7040511851:AAEjBKSxADGWlNtLxaKpotGtf53NUQ1UgAo/sendMessage?chat_id=6226815698
Signatures
-
Toxiceye family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource TelegramRAT.exe
Files
-
TelegramRAT.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ