toxiceye | TelegramRAT[.]exe | Triage

Sharing

General

Target

TelegramRAT.exe
Size

119KB
MD5

744a6669adfa8bce81e4597c2319e6c7
SHA1

231e577bebe54c02da09d4cc9edaad4788b9ffdd
SHA256

6c6bcda804f70c873780eaa7554011f89240ef5e20eb394ea9adf022d0987382
SHA512

1c2739e9339c82012077a9ca53bacd60c7db24bbec2be3eeea99eff61bc32f0f98364d2f8470de3cad0df4eb0a3f27d9640a5d17fd0394c7203c2f371663df62
SSDEEP

3072:F5LSptv0JOaqSj6O+H/bxqHoQWAzCrAZuSGn:r8eqg6n/bgL

Score

10^/10

toxiceye

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7082907700:AAFNviPXrHpaY6TWoCY2VClJln9DSSJ0vGE/sendMessage?chat_id=5590583541

Signatures

Toxiceye family
toxiceye
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

TelegramRAT.exe

Files

TelegramRAT.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\kokog\Desktop\moje rzeczy\ToxicEye-master\TelegramRAT\TelegramRAT\obj\Debug\TelegramRAT.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ