toxiceye

General

Target

TelegramRAT.zip
Size

180KB
Sample

240427-k9md1agb6v
MD5

7459e378b1235d22686d4773398bdac4
SHA1

78c588df5d131a4b079616208b1f3e563525ad8b
SHA256

42dc20b705fa79313f49dfc0b04327736a35aa4479bc5b1b5f5600b4cb50e470
SHA512

8a8ada9ca356120aaa231472ad09f889cb7f364b5a27485648ca55d4f7b641c0144813632ac0dc158c80e2896dc8eadfd0eb7c93467a692bd91f473db426e172
SSDEEP

3072:MO6+JfRgOj0IzgDTQv7oSsF9D/JP+aoCoS1205/yVBhhO0JLGCGGezp4uL/Y:M9+JZ7jxzgvQDoHdPpoC1VSruLg

Score

10^/10

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510

Targets

- Target
  
  AudioSwitcher.AudioApi.CoreAudio.dll
- Size
  
  76KB
- MD5
  
  1a3571119038a479c298097087635803
- SHA1
  
  95daf8034c518a52639fb845aad28bec57fd5cd3
- SHA256
  
  f496f74f48f3dbb499474ef0a06894079087871342b3e3bc254c5903e4aebf91
- SHA512
  
  d534bc4117a3ed5ce0a14f6658679b75a05453a41522d6307af4e0ab3bbee7049f70671a50db7dc3804fe5f6ccb6a4496f1a316222eab076deb6d39ac93c4c43
- SSDEEP
  
  1536:QlhKei7+LjzyJmJtJhendwV61ncQmlp/bV:Qo7+3zcndwIncQM/bV
Score

1^/10
behavioral1
- Target
  
  AudioSwitcher.AudioApi.dll
- Size
  
  40KB
- MD5
  
  3f88b41942ec020c9b66f464b3d1c899
- SHA1
  
  a846f0855d5250dc4dda9d3c37f6862e93ebc802
- SHA256
  
  26ff364fca496ee1093de596645c86731c156d81d026b5d020de46b0df053513
- SHA512
  
  dffe0b98033258ba3e58c43bf4e17e280ffb44c0d3c7a5b1c58761acc0ec2e4c30a035bae6df220c5ec07c641d494ccb135bc7b75977021dc2059f2e4e735af0
- SSDEEP
  
  384:iFo07NXH3jI8tRM1sGyfPodV/FU92983yggIwFTIVk1yUsUg43prF7RfrEEJvHQb:iG07NDI2ql8PQVtd83p40VoFtsT5h
Score

1^/10
behavioral2
- Target
  
  Sodium.dll
- Size
  
  59KB
- MD5
  
  fa95d735f88e819edc0cef02d3ee4781
- SHA1
  
  9e3c03ee4b0efeedf59edaca15ea304d2ec4cec7
- SHA256
  
  bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a
- SHA512
  
  554cf8906c7e4bc15653685e70e96995bfdf0803fb30ca196d8bc34f9bfb888a7a1de64e8441415155889893ac7769bb643aa87913f5176c80588b1e3a38348b
- SSDEEP
  
  1536:CjCH26g5fMVJXJO466QZmtQLrG3HbK7HIN8xmZ/zuXohMU6i3HFkdEpy:CmH26gr466HtQMbK7HIN8xmZ/zuXohML
Score

1^/10
behavioral3
- Target
  
  TelegramRAT.exe
- Size
  
  111KB
- MD5
  
  e2953259b8c1b5d0323ef57f90ce1f88
- SHA1
  
  aff7f7352c411ddc0bb4fccd9370e50fdc83a110
- SHA256
  
  651456d2e2a980c763156f177dd9eb5aa6cf3cd4d554164332536184ed980a60
- SHA512
  
  46bb038d7585f3a804ec6e90b8fc4556ee1bfbf6c9200b91c7aeb57cc9ba524240aaf5b968b31d1cab008378e933860b09a765b69b7194efaf09b9bf6c653375
- SSDEEP
  
  3072:vbvqJe4MUPxxjQbxqHBQWVzCrAZuDF8u:eJe4MQUbU7Y
Score

10^/10

toxiceye rat trojan
- ToxicEye
  ToxicEye is a trojan written in C#.
  rat trojan toxiceye
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral4