Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TelegramRAT.zip

  • Size

    202KB

  • MD5

    f3721674dc5289078094dce5419be741

  • SHA1

    022599bd24dac21fd52f9df2857ae1011daf7346

  • SHA256

    c8bd833b7cad2cb59d6f1334acb3c887185e1b23c2d39002094a288fb22194dc

  • SHA512

    460818017bb23f38865ca7d12830ef63184b891b71032e476fb35397c6a6edda9263f46bc621174b0d10b2739b6ee63108fba52f7373d8587a7cc9f32c83dfa8

  • SSDEEP

    6144:49+JZ7jxfgvQvo+3BH1CWGIaF40xew5ua5o3glLt9yd:8a/xCQvfMWbaFlbVqd

Score
10/10

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7095149991:AAGgD9iFbmtMK0VZiA3cT64Kd_IBHL-HTeQ/sendMessage?chat_id=7362979925

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Toxiceye family
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • TelegramRAT.zip
    .zip
  • AudioSwitcher.AudioApi.CoreAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AudioSwitcher.AudioApi.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Sodium.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TelegramRAT.exe.config
    .xml
  • TelegramRAT.pdb