Overview

overview

10

Static

static

10

TelegramRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TelegramRAT.exe

  • Size

    119KB

  • Sample

    240511-lh8ctsdh67

  • MD5

    2a158aa6d32bd8151cdfd7b22e10dec7

  • SHA1

    02093169233f0ba62b969cecfca221545ec997e9

  • SHA256

    1367b63812aeb5681a035b816f583936d120a87f7d302082ebc1b49e5bca2a43

  • SHA512

    32fc1a0a28bc8f55ab91b8915dbffb9c68caf031c7a07ba0ce084c66a7579530dfeb912fd12b0d539fc1ba4ac8b9478969329d20b58adbd8e20f9741c6cf18ee

  • SSDEEP

    3072:vC7CSYq7OMmgmm+S/bxqHyQW0zCrAZuEQP:ozmnq/bg9

Score
10/10
toxiceyerattrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot6846719011:AAG0Xm1OwIK5zd_7LBNmOoHmuZ6PH9mc7JY/sendMessage?chat_id=6059920057

Targets

    • Target

      TelegramRAT.exe

    • Size

      119KB

    • MD5

      2a158aa6d32bd8151cdfd7b22e10dec7

    • SHA1

      02093169233f0ba62b969cecfca221545ec997e9

    • SHA256

      1367b63812aeb5681a035b816f583936d120a87f7d302082ebc1b49e5bca2a43

    • SHA512

      32fc1a0a28bc8f55ab91b8915dbffb9c68caf031c7a07ba0ce084c66a7579530dfeb912fd12b0d539fc1ba4ac8b9478969329d20b58adbd8e20f9741c6cf18ee

    • SSDEEP

      3072:vC7CSYq7OMmgmm+S/bxqHyQW0zCrAZuEQP:ozmnq/bg9

    Score
    10/10
    toxiceyerattrojan

    • ToxicEye

      ToxicEye is a trojan written in C#.

      rattrojantoxiceye

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks