General

  • Target

    TelegramRAT.zip

  • Size

    180KB

  • MD5

    cc2bc21c47e62001401a43dd817fb22c

  • SHA1

    f072bc2337121f10ff7ecd08cea78bec33be849d

  • SHA256

    c5ee6af8e3d3bdf216ce505c98458fb68f13360ad6c0cf50487b6bd3f33c52f8

  • SHA512

    68e39b9862865bd181c78f111f7883e1e75e589b23dced21d18f1d9bf00f41464764fe1c0ce4bb9b44186a0ec5a94ae695bad793169ddd789b59ef92f893f96e

  • SSDEEP

    3072:MO6+JfRgOj0IzgDTQv7oAixWbun91oilnmIFwI0WRsV1TXXPx7Ekp3:M9+JZ7jxzgvQDovXn964mIdevx7v

Score
10/10

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7005624592:AAFT1GroRFjOnavaa8nJipFR-iCuYT3f2xQ/sendMessage?chat_id=6235796510

Signatures

  • Toxiceye family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • TelegramRAT.zip
    .zip
  • AudioSwitcher.AudioApi.CoreAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AudioSwitcher.AudioApi.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Sodium.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TelegramRAT.exe.config
    .xml
  • TelegramRAT.pdb