day0 ToxicEyeRAT

These YARA rules detect the ToxicEye Remote Access Trojan (RAT), a malicious tool written in C# that leverages the Telegram Bot API for command and control. The rules identify specific hardcoded configuration settings (Telegram bot tokens, addresses for crypto wallets, persistence settings, and file grabber configurations), unique project strings (author attribution, warning messages), and debug logs associated with the malware's functional modules such as keylogging, credential stealing, file exfiltration, and system destructive capabilities like boot sector overwriting.