Overview

overview

10

Static

static

10

P26NP_TelegramRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    P26NP_TelegramRAT.exe

  • Size

    146KB

  • MD5

    406a5cb1b15ae669a9f28fdd7301e2f0

  • SHA1

    13f6bc53753e5be52e53ffc6686b5d2b930a46ac

  • SHA256

    f4897365644f81143f94707c6e0153e3026f83c40c5dd218cf89e110d7d5a724

  • SHA512

    f79272832508808cb145309c378883296058365064fb168fc8856d3634364019aa4790bdb93ed660a18f9dc83337b1f76873a4e5e2c196f3974e753c158fb665

  • SSDEEP

    3072:flp6GWVke8WEhv9cQfYEv1c+68cGPKS2ZbZLQAQWXPCrAZuQcEeZcA/1P:flppWV2Ysq+jcGySmbF7

Score
10/10
toxiceye

Malware Config

Extracted

Family

toxiceye

C2

https://api.telegram.org/bot7582691185:AAFMBoknnYf6nr-rXlzotfzCNnqEPGSYrqc/sendMessage?chat_id=8029727797

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Toxiceye family
    toxiceye
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • P26NP_TelegramRAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections