Extracted

• • Target

    TelegramRAT.exe

  • Size

    111KB

  • MD5

    9c6f004d573a9660f4201028b795cfad

  • SHA1

    235d54b393067c9ebceaf89c25877f8f310bb037

  • SHA256

    3e37cefc156c265e1b048f8f59caf0e87c9bd097e9a43d4c0eeb2f05999add5b

  • SHA512

    ddc6c0856576611329be1ca108c2d97854a6efef1bc3ad3d4266c562b8ff92a31990dbe4d3cbce57c13f733bdbfd9d3e98a8200929ced2f26b4c63743bb08ef5

  • SSDEEP

    1536:G+bAQAsnqLoM91qQIwxHxZxdyyKDWfibhDqI64QW3zCrAZuP74DS:5bKsnwo0RZxjQbxqH4QW3zCrAZuPoS

  Score

  10^/10

  toxiceyediscoveryevasionratspywarestealertrojan

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates processes with tasklist

    discovery
  behavioral1