Pierluigi Paganini April 24, 2021

ToxicEye is a new Remote Access Trojan (RAT) that exploits the Telegram service as part of it command and control infrastructure.

ToxicEye RAT is a new malware that leverages the Telegram services for command & control, experts from Check Point already observed iover 130 attacks recorded in the past three months. 

The use of the popular IM service gives to the attackers multiple benefits. Telegram is a legitimate service and enterprise AV engines and security solutions trust its traffic. The service is stable and allows attackers to remain anonymous as only a mobile number is required for the registration process.

Telegram also allows attackers to use their mobile devices to access infected systems.

Threat actors behind ToxicEye spread the RAT via phishing emails containing a malicious .exe file. Upon opening the attachment, ToxicEye installs itself on the victim’s device and performs some operations in background such as:

• stealing data
• deleting or transferring files
• killing processes on the PC
• hijacking the PC’s microphone and camera to record audio and video
• encrypting files for ransom purposes

Attackers manage the ToxicEye RAT over Telegram and use the IM platform to exfiltrate data.

Researchers noticed that that the ToxicEye RAT configuration file includes a Telegram bot that is compiled into an executable file.

“The attacker first creates a Telegram account and a Telegram ‘bot.’ A Telegram bot account is a special remote account with which users can interact by Telegram chat or by adding them to Telegram groups, or by sending requests directly from the input field by typing the bot’s Telegram username and a query.” reads the analysis published by CheckPoint.

“The bot is embedded into the ToxicEye RAT configuration file and compiled into an executable file (an example of a file name we found was ‘paypal checker by saint.exe’). Any victim infected with this malicious payload can be attacked via the Telegram bot, which connects the user’s device back to the attacker’s C&C via Telegram.”

Experts pointed out that the RAT can be also delivered by opening a malicious document (solution.doc) by pressing on “enable content.”

To determine if your system has been infected search for a file called C:\Users\ToxicEye\rat.exe, its presence is an indicator of compromise.

The ToxicEye RAT supports multiple functions including the ability to scan for and steal credentials, computer OS data, browser history, clipboard content, and cookies. The malware allows attackers to transfer and delete files, kill PC processes and take over the task manager. The malware can also deploy keyloggers, hijack the microphone, camera, and the contents of the clipboard. Experts also noticed that the RAT implements Ransomware features such as the ability to encrypt and decrypt victim’s files.

“The developers who publish these tools disguise their true purpose by defining them as “Remote Administration Tool” or “for educational purpose only”, although some of  their characteristics are often found in malicious Trojans.” concludes the report.

“Given that Telegram can be used to distribute malicious files, or as a C&C channel for remotely controlled malware, we fully expect that additional tools that exploit this platform will continue to be developed in the future.”

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ToxicEye RAT)

[adrotate banner=”5″]

[adrotate banner=”13″]