Extracted

• • Target

    75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76

  • Size

    2.7MB

  • MD5

    e8750312901386f028ec2e7ba93acdd1

  • SHA1

    8dabf23f1b0732eeae8f371005e392afa3787829

  • SHA256

    75f0b10428471619c2cb34bf7abdef10bb192f238ff09e67a8433ddc6c9e6b76

  • SHA512

    6664206165b2605817492a1dad5b47c9996166c3a9873f9a086d64c3ad87213e89567277c9b7760537efc2e67a5c2b5c4412169eb69f5a31d9f675b7088e429c

  • SSDEEP

    49152:KOmkuWsQFMi4mKH3NmB6JqsG/a5lFHSqLbWKkHs1zfgRAZzgCNP+u+vR9hoU7Uvj:TmbW/MVmKHEB6c0lFHTbWLmbgRWUCh+M

  Score

  10^/10

  toxiceyedefense_evasiondiscoveryrattrojanspywarestealer

  • ToxicEye

    ToxicEye is a trojan written in C#.

    rattrojantoxiceye

  • Toxiceye family

    toxiceye

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2