General

  • Target

    TelegramRAT.exe

  • Size

    111KB

  • Sample

    240816-17a6yszhpg

  • MD5

    3cdefec5518d17dd30d6ae5d2b10a7aa

  • SHA1

    d930c4be3e11056a01d88fc204ede07292b70a38

  • SHA256

    1ee0f288b931c649d0442590346cb778a3706d74322c24e1714cf124e9f23b68

  • SHA512

    1f12b82dba779a72be66d513ce72518f79bc97282211685bc9b42f0f1a8c2dd756cb372c44c917b11afcc6a71d581a6747f3acd5d6b54743f6b7b689a8c32f69

  • SSDEEP

    1536:y+bAQAsnqLoM91qQIwxHxZxdyyKDWfCbhDqI64QWEzCrAZuhN7Dg:VbKsnwo0RZxjQbxqH4QWEzCrAZuhZg

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7302074945:AAGKx5TnjPyRM_fqN4XQLd4uz-PUp4nl8w4/sendMessage?chat_id=6414125020

Targets

    • Target

      TelegramRAT.exe

    • Size

      111KB

    • MD5

      3cdefec5518d17dd30d6ae5d2b10a7aa

    • SHA1

      d930c4be3e11056a01d88fc204ede07292b70a38

    • SHA256

      1ee0f288b931c649d0442590346cb778a3706d74322c24e1714cf124e9f23b68

    • SHA512

      1f12b82dba779a72be66d513ce72518f79bc97282211685bc9b42f0f1a8c2dd756cb372c44c917b11afcc6a71d581a6747f3acd5d6b54743f6b7b689a8c32f69

    • SSDEEP

      1536:y+bAQAsnqLoM91qQIwxHxZxdyyKDWfCbhDqI64QWEzCrAZuhN7Dg:VbKsnwo0RZxjQbxqH4QWEzCrAZuhZg

    • ToxicEye

      ToxicEye is a trojan written in C#.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks