Extracted

• • Target

    TelegramRAT.exe

  • Size

    111KB

  • MD5

    48956d16278bdeb1f20efa2100a48f77

  • SHA1

    24d9416bf14e6a0d8a9b4970e427adf2bfc8198f

  • SHA256

    214cd570dd081fdde7641308a69ec11f27359e77251e6f21560065336c5b1760

  • SHA512

    0f809d1b3d0495d7247dc150f51a4633652f1aa942983796b0ba785216e334089c1af03e82e16267dad9052ccb576b09dfdd63dee01d834385819f3e7ffcdc88

  • SSDEEP

    3072:Fb5EHVelXr0ZxjQbxqHUVQWJzCrAZuhNdfm9jAbh0:PEHVelbAUbU0D

  Score

  10^/10

  toxiceyediscoveryrattrojan

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Toxiceye family

    toxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Enumerates processes with tasklist

    discovery
  behavioral1