Extracted

• • Target

    AudioSwitcher.AudioApi.CoreAudio.dll

  • Size

    76KB

  • MD5

    1a3571119038a479c298097087635803

  • SHA1

    95daf8034c518a52639fb845aad28bec57fd5cd3

  • SHA256

    f496f74f48f3dbb499474ef0a06894079087871342b3e3bc254c5903e4aebf91

  • SHA512

    d534bc4117a3ed5ce0a14f6658679b75a05453a41522d6307af4e0ab3bbee7049f70671a50db7dc3804fe5f6ccb6a4496f1a316222eab076deb6d39ac93c4c43

  • SSDEEP

    1536:QlhKei7+LjzyJmJtJhendwV61ncQmlp/bV:Qo7+3zcndwIncQM/bV

  Score

  1^/10
  behavioral1behavioral2

• • Target

    AudioSwitcher.AudioApi.dll

  • Size

    40KB

  • MD5

    3f88b41942ec020c9b66f464b3d1c899

  • SHA1

    a846f0855d5250dc4dda9d3c37f6862e93ebc802

  • SHA256

    26ff364fca496ee1093de596645c86731c156d81d026b5d020de46b0df053513

  • SHA512

    dffe0b98033258ba3e58c43bf4e17e280ffb44c0d3c7a5b1c58761acc0ec2e4c30a035bae6df220c5ec07c641d494ccb135bc7b75977021dc2059f2e4e735af0

  • SSDEEP

    384:iFo07NXH3jI8tRM1sGyfPodV/FU92983yggIwFTIVk1yUsUg43prF7RfrEEJvHQb:iG07NDI2ql8PQVtd83p40VoFtsT5h

  Score

  1^/10
  behavioral3behavioral4

• • Target

    Sodium.dll

  • Size

    59KB

  • MD5

    fa95d735f88e819edc0cef02d3ee4781

  • SHA1

    9e3c03ee4b0efeedf59edaca15ea304d2ec4cec7

  • SHA256

    bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a

  • SHA512

    554cf8906c7e4bc15653685e70e96995bfdf0803fb30ca196d8bc34f9bfb888a7a1de64e8441415155889893ac7769bb643aa87913f5176c80588b1e3a38348b

  • SSDEEP

    1536:CjCH26g5fMVJXJO466QZmtQLrG3HbK7HIN8xmZ/zuXohMU6i3HFkdEpy:CmH26gr466HtQMbK7HIN8xmZ/zuXohML

  Score

  1^/10
  behavioral5behavioral6

• • Target

    TelegramRAT.exe

  • Size

    111KB

  • MD5

    8834c1eaf28b3b076df2a0aac5d1148e

  • SHA1

    640e70c94c0e01492c4c45cf2b23b65914a94cc5

  • SHA256

    49f704606ec839fa6867a5f5f67090299b69b02dab7d352e161c8a754165de8a

  • SHA512

    59c6d085818d43607ee2aef904899690a116a34f6e50978c35017d1a546964bcdfc435b7fb09bab998d4d0eacc8b614a58a55c029311d7c33473a501f4f3f561

  • SSDEEP

    1536:p+bvqJIP4M91qQIwzUrxxxdKy2nBfUbhDqI6CsQWVzCrAZuDZ6Dd:sbvqJe4MUlxxDrbxqHBQWVzCrAZuDQd

  Score

  10^/10

  toxiceyeransomwareratspywarestealertrojan

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Renames multiple (254) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral7behavioral8

• • Target

    TelegramRAT.exe.config

  • Size

    161B

  • MD5

    c16b0746faa39818049fe38709a82c62

  • SHA1

    3fa322fe6ed724b1bc4fd52795428a36b7b8c131

  • SHA256

    d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

  • SHA512

    cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

  Score

  1^/10
  behavioral10behavioral9

• • Target

    TelegramRAT.pdb

  • Size

    239KB

  • MD5

    f7a782a1898a88c9e492087bae1d7735

  • SHA1

    647cec65b984f258dcd8cf75eb13fe100e0f8d66

  • SHA256

    391846de21171c6e41bcc667fc53c5028554226b673e402a486cf4b41b9a25d9

  • SHA512

    701e57d1c53ed368d95d4d5aa7379c32f81322bdcf6320a29d6ca690ed3780738aa5dd86797fbbe4f693a3804b89c4124e849e9f146b226aac7df21ea54ee794

  • SSDEEP

    3072:0Uy6brhZ3mXPTVv5p7lanhtOtT99/MxYq8rT5r+ZrNpCZEC4wh1J1j+dyIeyagpH:u99UxYqsTFONkZEC4cs4

  Score

  3^/10
  behavioral11behavioral12