Overview

overview

10

Static

static

10

TelegramRAT.exe

windows7-x64

10

TelegramRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    borat.zip

  • Size

    50KB

  • Sample

    241210-x825aazrhp

  • MD5

    8da093d8650b11e536166f52859e53fe

  • SHA1

    bd21a84724e22328b320ab73f33a639b94aede6b

  • SHA256

    fb0b0b44a3f9bbbbc8e4adc21d6038b3f1c85e038a849efb74aa78e604b5e8ea

  • SHA512

    b2b2640b9888db71b5075d6b7b562e6d67aafd441cd856a467a79cc8636f57cf6ef85594ecda2840763174521a550e0131399f42a8df0ae64cb7694534169577

  • SSDEEP

    1536:hnMU/JlQwWqVjnuIucgCrr3FaHJHbqcO/Wck6iV/ZELEzE2Oy:dMU/lxfuHKFC5bC/Wh/SLEY27

Score
10/10
toxiceyediscoveryrattrojan

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7677893184:AAE0-PsPfzGgNiPGIk585ulPgzKriWDrM10/sendMessage?chat_id=7494459853

Targets

    • Target

      TelegramRAT.exe

    • Size

      121KB

    • MD5

      117a350a0991d312d62eea33933f4f9b

    • SHA1

      3c4c2b9608bdf3b7e477cef26e12721187fb5558

    • SHA256

      a52f043910c50f8d250162379935316f63db792bf9824afd5dc326e12676a089

    • SHA512

      d09e19366b912189415c3eb8ca427afedbcd3baca280b33bad5e6817ec5ec01f09e4b9d5be32e63694a48c55bd962099182af64a34dbe2615fdb82963c497809

    • SSDEEP

      3072:/ItZ1HOSJAwncZ+5OG3wy+pKbxqHLQWHzCrAZuaNu:Lx+AG3wtKbg3

    Score
    10/10
    toxiceyediscoveryrattrojan

    • ToxicEye

      ToxicEye is a trojan written in C#.

      rattrojantoxiceye

    • Toxiceye family

      toxiceye

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks