M� J oo�`�����P����#m�������'��[-�_���{��ͫAgxJ�^4ʓ�i$2���g��s&6hl)���i�|��@����3��~��xMq�u4�������N|�n�Ĝ�! �Z�������U�<��{�=����a��-Ĝ�����4�Fn����� YX����������*��m���g��r�Kj��P�$M�Ԅ�����n%�:��F} ���H�g�f���:Z�8y��Ɔ�P�5�GU��{����sxٖPI�T@ k_τ��g��� r�<��'0���z�D.�4O�16�t�X�t��1��EK+wI��L��Ȩ4�Yf���~��|�����q{U�w�L�3�j���r��.�`j��{ߋ�����"mJ2:�̶��ؖ�/$v5��YK�W�VY�� ��r~� '�� Z�s��V3�ʃeW]��x2�:� ������F�E-waȂ7$S���"5�G�� i��ĊyR��FW�5��s;-��e�d� �3T���{6�w��Ј˟7@�&��c5��XW�R"w�N����<�E-L!��?*��aR�����n:��G��)�<E���2iJ����;nφkÅ,T��*2��zY�hflҫ��[I��T���j����z���m�V٣�-�T���s{��@�28y��~���>|]��\]ȱ�cv�!��D&$C=a#����$�k5������C��8U�ېU������D[�1��$��M����eGO�}� ��� DyzW��Ҁ.?�B���8���0�^kŏ��[��9�prX����,X�@�o<~��B��{�(c�Zfv^+x6Լ��I�+th/��o�����Ts�+[%�∿s]e�#��@ݵ`�*^4w��u�fd�0�p�gaզ�?�Y�]DD��|*'�S6�e�g���Ԁ������Ӕ( � R�Dɭ��o\z��������������T~n�~�4b�D���:C� ��x�l�1��~3�Fvy(j�@� �5�TM#E ��'p�x��%�j�} n����p��ϼ�dB>z+i�=נWO��r�m�:f�9����5�b�I�~�p��6/b'a���z��=����Kռ�l�cI����8j��J��žG���i�0�2��d`GMߧ��e=�o¶��E`��;b�� TA���'�p!�������E��'od�i6q��2�v���/@����9",���q�0�J�"�R��m�z6h��[��~ ����O�^M����,IFכ*~��L��� ������[g�^Y�Y=� ��(����B�t��-/j:)j-7!!ż�x�~�wPu���S���m��&jG�0�� �"��gnݩ��"�.�!g ��w �';N�*��C9��XIN��t6�GAq� ����B\|7����Ж��;�'/j��N�wU!Em���Lj2��,~�_|�H�J��EU�*�G�K IE�w�:w#q~1 �˧6���l*�6uqW�s�l.`u���I��z,C��^\�F[Ōg�=1�}T)q��E���>Nt_�YI����T�h����K����X� fX�����GӅ�I貟��&Wi�{�c:GO d�����X>1d�a���˨��%��7�*N�?�S��ׂ���v ���&|��ߵR��E^Uj�^��g��㽖�×t���1�{P �����7�l�$_�^Ak���a�� X4=]"�<�<��G��2x��@����[���1�)Jf��F��}0�Nx+H�t8X�>c� �4�c������X75����B�e��v�I��č-�U:ΠZo�փ9��)�_vPO¦A�i�:�2XE��!s�?�6 E{��u�BNUS5���CAPÜ�� Q$�$�[J��d[5����۟�g�9?���f}j�V,��n���ދ���e�酯��Z�F�Cv�������KY�F`��;k'[=!@�[�14����-���~}�M 0=8��� f���;tYu��*e��&����a��^1K"�T�3ͬc��6Qժ5�������Mv�G��$ Bug��R[�Oi�oq�5W����۠���_$����^&���vK��<9j!�&��Zr�}ɜ\��R��+�}�"R����7�a��<��w�S���և�c�9��k�hjhVZ���E?s�(�>r���XI�<ky?e�N:�ib��i���"h��"�G<ZIyqd�����g.keJw�^Td��9M���2F��͘������A��~�)������������9�:�~�b��2��� ̫��4 4�N=�ӊM�~ nt�:���O��K��ї�&h����z�z���\��9�K2ij���:���23��'�?W����yi���7����� ��+44�,-'�5��� �X��\�qQB����i��]�R�E�����j�!���k���h��cE �t�ke��U��Q�&^f��خ�+�J�\�Tc ���e�ŋz�XGL ��+m�@���s�Y�>7�T�vtW8g�xQ� �22��@��9(C��!�{ڢ]t��/�������%��7Ds��ᤪ�q���I#�T��rYv�S,��|�O9ߖ}y&�������a����+�v����O�f�$��瀱���K�t9 S!�+��7�8�5^H�[%]H���:7Jy����I���U$v�q$�|p��A�t����8�n����O���Q�+��[gS&����I�fN/o�2��>'��*(�-�':��?e�W�Ι�;P>�>��ϡ�5��i��A �����6�B��:_��i�v��>�}$P"��2Xϩ���E������\0U�o,��g�}��OyY?�μP샿oL�`���pF���Y�J�^Q�j\[H#I<l���T����@c~'����=�\%s�=�[pr�=�Y���n�ۀ�bƷ����� �tɘ�L�&V�z�z��0�7T�%PHٗ�ahc��4%]-���q�� ���E�����o3��f%���:b6��z1�,������c,.��>Bᖩ1���s����-�.<�ѿ�o���R[�c��%%��x�K���ԥ�E��"#W���H���� ��n�5rإl[cl�Lj����� �06��jI�� ������l�Z��o ��@�YN � �37U��x��x4Dm��~M?�%�:���U����6�O>�UX�]�U��D����$�b��(AO� ���nઆAwx��??�6���BIv���6�oD,��;m2�ӽ���p��a��yA�j�GV;�1��"+�i�!�����.�7������?���:){��mO����=���O���Wz�d!�h�����D�ț����}�I=���to��[��! ���y�r�M�����T�Bk��1i���m@��CᲫ��.��m��?3$�Z""e�q��r�VHN�U�8]͇�1yϗ��Fۃ�<TG��H%_�w�"���*ȞQl� �Q]*R���
Static task
static1
Behavioral task
behavioral1
Sample
EagleSpy V5.exe
Resource
win10v2004-20241007-en
General
-
Target
EagleSpy V5.exe
-
Size
84.6MB
-
MD5
969c534f3cc8d7aaf63bbc52062717e9
-
SHA1
243832226215efa2dbd3ee64a228681678636682
-
SHA256
a45258ce03bc66831fef62ed8f99189ac210051f87c61e4f253e1da637c9607b
-
SHA512
0358e49946717943d9029aa57d5b62d42cb22b7277b838e8692ed4383f293a55c4353380ef11f22210a44d39f35ea820fa9ac360c9d855f1a5c2049278647de6
-
SSDEEP
1572864:9iQq9bOuLpK5qJj3zI6tOW6c6y1jj4oxlffYehVOHR9NgLS8qthKEqF2z4+LWC3k:9iQ8JjP1IUOHR/MS1thEF0PLV3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EagleSpy V5.exe
Files
-
EagleSpy V5.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
Sections
Size: 82.3MB - Virtual size: 86.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 114KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 202KB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE