TeleSink

Telegram C2 sinkhole for malware analysis — extract the bot token & chat ID without deobfuscating the sample.

A lot of commodity stealers and RATs use Telegram as their C2: they call the Telegram Bot API at https://api.telegram.org/bot<TOKEN>/<method>. The bot token and chat_id are the keys to the whole operation — but they're usually buried behind layers of obfuscation, so pulling them statically can be painful.

TeleSink skips the reversing entirely. It trusts a throwaway certificate, redirects api.telegram.org to localhost, and stands up a fake Telegram Bot API server that answers convincingly enough for the malware to keep talking — while harvesting the token, chat ID, and any data the sample tries to exfiltrate straight from the first request.

⚠️ For authorized malware analysis in an isolated sandbox (e.g. Flare VM) only. Don't point this at networks or systems you don't own.

---

How it works

1. Fresh certificate every run — generates a self-signed TLS cert for api.telegram.org (with SANs for *.telegram.org, core.telegram.org), new RSA key and serial number each time.
2. Trusts it — installs the cert into the Windows Trusted Root store via certutil -addstore -f Root.
3. Hijacks DNS — rewrites the hosts file so api.telegram.org → 127.0.0.1, then flushes the DNS cache.
4. Sinkholes the C2 — runs an HTTPS server on :443 that:
   • parses bot<TOKEN> out of the URL path and chat_id from the query string / JSON body / form body,
   • prints the captured credentials and logs them to disk,
   • replies with realistic Bot API JSON (getMe, getUpdates, sendMessage, sendDocument, …) so the sample believes the C2 is live and continues its check-in / exfil behaviour,
   • saves any uploaded files (sendDocument / sendPhoto exfil).

---

Requirements

• Windows analysis VM (Flare VM recommended), run as Administrator (cert install + hosts edit + binding port 443 require it).
• Python 3.8+
• pip install cryptography

Runs on Linux too for development/testing — it just skips the Windows-only cert/hosts steps and warns you.

---

Usage

# 1. install dependency
pip install cryptography

# 2. set up the sinkhole and start listening (run as Administrator)
python telesink.py

# 3. detonate the malware sample in the VM
#    -> token + chat_id are printed and logged the moment it phones home

# 4. when finished, undo everything this tool changed
python telesink.py --cleanup

Options

Flag	Description
--port PORT	HTTPS listen port (default 443).
--no-setup	Skip cert/hosts setup; just run the server (reuses an existing run).
--cleanup	Remove the hosts entry and the cert this tool added, then exit.
--forward	MITM mode — relay requests to the real Telegram (off by default).

--forward is opt-in on purpose. By default TeleSink keeps everything local, so you never actually exfiltrate the lab's data or alert the C2 operator.

---

Output

Everything lands in a telesink_run/ folder next to the script:

File	Contents
telesink_creds.json	Captured bot tokens, bot IDs, chat IDs, timestamps.
telesink_capture.jsonl	Full request log — method, path, headers, query, body.
uploads/	Files the sample tried to exfil via sendDocument/sendPhoto.
telesink_cert.pem / telesink_key.pem	The cert/key generated for this run.
telesink_state.json	Cert thumbprint/serial, used by --cleanup for surgical removal.

--cleanup removes only the cert this run added (matched by SHA-1 thumbprint) and the hosts lines tagged # TELESINK — it won't touch anything else in your Root store or hosts file. Capture/creds logs are kept.

---

Try it without real malware

test_sample.exe is a benign Telegram-C2 simulator included for testing — it mimics exactly what a real stealer/RAT does (getMe → sendMessage → getUpdates) using a fake, non-existent bot token and chat ID. It never contacts the real Telegram: because the hosts file points api.telegram.org at 127.0.0.1, every request lands on your local TeleSink.

python telesink.py        # terminal 1 — start the sinkhole
test_sample.exe           # terminal 2 — run the benign "malware"

You should see TeleSink capture the fake token (8123456789:AAH-FAKEtoken…) and chat ID (1122334455).

The exe is just a PyInstaller build of the included source — inspect or rebuild it yourself:

build_exe.bat             # -> dist\test_client.exe

🛡️ AV note: test_sample.exe is unsigned, PyInstaller-packed, and talks to api.telegram.org, so some antivirus engines will flag it as suspicious. That's a false positive from the packer + traffic pattern, not real malware — the full source (test_client.py) is right here in the repo so you can verify and rebuild it.

---

Next steps — analysing the captured bot

Once TeleSink has given you the bot token and chat ID, you can take the analysis further with matkap by @0x6rss — a Telegram bot threat-hunting tool that:

• forwards/dumps the bot's historical messages by iterating through message IDs (saved to its captured_messages/ directory), letting you recover what the operator has already exfiltrated from victims;
• hunts for the same leaked bot tokens / chat IDs across the internet via FOFA & URLScan, to pivot to related infrastructure and campaigns.

Prefer not to run it locally? There's also a hosted version at matkap.cti.monster — paste the captured token / chat ID straight into the browser, no setup required.

Typical workflow: TeleSink extracts the token + chat ID from the sample → feed them into matkap (local or the online tool) to pull the bot's message history and pivot on the IOCs.

---

Cleanup

python telesink.py --cleanup

Removes the hosts entries, deletes the trusted cert by its thumbprint, and flushes DNS. The captured creds and logs are preserved.

---

Limitations

• Certificate pinning defeats the trusted-root trick. Commodity Telegram stealers rarely pin; more advanced samples might. (Handshake failures show up in the console as a hint.)
• The fake getUpdates currently returns an empty queue. A command-injection feature (feed operator commands back to the sample to map its full capabilities) is planned.

---

Roadmap

• getUpdates command-injection for capability mapping
• Cert-pinning / handshake-failure detection
• Optional port 80 → 443 catch
• First-class Linux sandbox mode

---

Part of the RedSide Security toolset.