Overview

overview

10

Static

static

10

TelegramRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TelegramRAT.exe

  • Size

    146KB

  • MD5

    b60ce934787eabc61c505105aa60e329

  • SHA1

    6e0644631cfcd82f54bffb670af9d372663464a5

  • SHA256

    de026d75eadca1410b2da8bf0ee7f54c6ce4083d843f9493551bfbea2ec8526f

  • SHA512

    9b5e7f76840402b55b8e78fe3de7298cb388450746259a39022a222055806265b3816f6ed4f57b2d56380bb0eb3f17964c659b923589fb6c6573e3e859093ed1

  • SSDEEP

    3072:N0Sv+x28V+cr6Ca5MXtzlfFD1ekW83fbZLQrQWXPCrAZuGF:N0C+xrvd1rW8vbFq

Score
10/10
toxiceye

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot8131231612:AAHcaiAd3V1PfAUCNncfQGVu8o9wYaBwJNw/sendMessage?chat_id=8029727797

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Toxiceye family
    toxiceye
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections