General
-
Target
TelegramRAT.zip
-
Size
180KB
-
Sample
240427-lawdasfe35
-
MD5
cc2bc21c47e62001401a43dd817fb22c
-
SHA1
f072bc2337121f10ff7ecd08cea78bec33be849d
-
SHA256
c5ee6af8e3d3bdf216ce505c98458fb68f13360ad6c0cf50487b6bd3f33c52f8
-
SHA512
68e39b9862865bd181c78f111f7883e1e75e589b23dced21d18f1d9bf00f41464764fe1c0ce4bb9b44186a0ec5a94ae695bad793169ddd789b59ef92f893f96e
-
SSDEEP
3072:MO6+JfRgOj0IzgDTQv7oAixWbun91oilnmIFwI0WRsV1TXXPx7Ekp3:M9+JZ7jxzgvQDovXn964mIdevx7v
Malware Config
Extracted
toxiceye
https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510
Targets
-
-
Target
AudioSwitcher.AudioApi.CoreAudio.dll
-
Size
76KB
-
MD5
1a3571119038a479c298097087635803
-
SHA1
95daf8034c518a52639fb845aad28bec57fd5cd3
-
SHA256
f496f74f48f3dbb499474ef0a06894079087871342b3e3bc254c5903e4aebf91
-
SHA512
d534bc4117a3ed5ce0a14f6658679b75a05453a41522d6307af4e0ab3bbee7049f70671a50db7dc3804fe5f6ccb6a4496f1a316222eab076deb6d39ac93c4c43
-
SSDEEP
1536:QlhKei7+LjzyJmJtJhendwV61ncQmlp/bV:Qo7+3zcndwIncQM/bV
Score1/10 -
-
-
Target
AudioSwitcher.AudioApi.dll
-
Size
40KB
-
MD5
3f88b41942ec020c9b66f464b3d1c899
-
SHA1
a846f0855d5250dc4dda9d3c37f6862e93ebc802
-
SHA256
26ff364fca496ee1093de596645c86731c156d81d026b5d020de46b0df053513
-
SHA512
dffe0b98033258ba3e58c43bf4e17e280ffb44c0d3c7a5b1c58761acc0ec2e4c30a035bae6df220c5ec07c641d494ccb135bc7b75977021dc2059f2e4e735af0
-
SSDEEP
384:iFo07NXH3jI8tRM1sGyfPodV/FU92983yggIwFTIVk1yUsUg43prF7RfrEEJvHQb:iG07NDI2ql8PQVtd83p40VoFtsT5h
Score1/10 -
-
-
Target
Sodium.dll
-
Size
59KB
-
MD5
fa95d735f88e819edc0cef02d3ee4781
-
SHA1
9e3c03ee4b0efeedf59edaca15ea304d2ec4cec7
-
SHA256
bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a
-
SHA512
554cf8906c7e4bc15653685e70e96995bfdf0803fb30ca196d8bc34f9bfb888a7a1de64e8441415155889893ac7769bb643aa87913f5176c80588b1e3a38348b
-
SSDEEP
1536:CjCH26g5fMVJXJO466QZmtQLrG3HbK7HIN8xmZ/zuXohMU6i3HFkdEpy:CmH26gr466HtQMbK7HIN8xmZ/zuXohML
Score1/10 -
-
-
Target
TelegramRAT.exe
-
Size
111KB
-
MD5
8834c1eaf28b3b076df2a0aac5d1148e
-
SHA1
640e70c94c0e01492c4c45cf2b23b65914a94cc5
-
SHA256
49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a
-
SHA512
59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561
-
SSDEEP
1536:p+bvqJIP4M91qQIwzUrxxxdKy2nBfUbhDqI6CsQWVzCrAZuDZ6Dd:sbvqJe4MUlxxDrbxqHBQWVzCrAZuDQd
Score10/10-
ToxicEye
ToxicEye is a trojan written in C#.
-
Renames multiple (265) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-