Extracted

• • Target
    Release/Eagle Monitor RAT Reborn (x32).exe
  • Size 1.7MB
  • SHA256 e91547a11be71a8ddcfede25b00fa479d936af41aa5502f787e5c5dd7df0c4de
  • MD5 19a073cbc3b0d4a21ba69757628ab406
  • SHA1 67a0b77dfd3af40f07db3c7cca955b35c9e1e851
  • SHA512 adf56dca5f5ae6aa393305ac45fe12ad6e1070279a5a7144931a18cbac2068e57f693468a47ce993cba7bc9cd14de614bb5560c77e3d361cee18e652c8c74b70
  • SSDEEP 49152:bFrF7FuliZRy5rEAyboFn7UrbrH1gm475:xBRJF2Ivy
  • TLSH
    T1F585AD2DB7748C38F57A85B4292685D44BB2AF0785ECC2992A4C39CD05F4BC15AF37A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryadwaredefense_evasioneagleratpersistenceransomwareratspyware

  • Family: EagleRat

    An open source modular remote access trojan written in C#.

    rateaglerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    Release/Eagle Monitor RAT Reborn (x64).exe
  • Size 1.7MB
  • SHA256 8dd6faac5e0506611f9c7abb642e8f5039ade9f3e7dab7200066760520f0a4aa
  • MD5 ecc201468da185e4a1077b2365612d69
  • SHA1 19a88f7714540978061783e9ef06216a26bb96d9
  • SHA512 7ef9e631ec76e7cd4270f54624e60ada03ebe6ed6cfd32e20140c6735f5f7758503cd7ae2412b8dd82d0708da7ad18b06572f7a65a74c7938976c4dbc31ac6a0
  • SSDEEP 49152:+FrF7FlliZRy5rEAyboFn7UrbrH1gm4E5:wBRuF2Ivj
  • TLSH
    T14985AD2DB7748C38F57A85B4292685D44BB2AF0785ECC2992A4C39CD05F4BC15AF37A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Release/FastColoredTextBox.dll
  • Size 323KB
  • SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
  • MD5 8610f4d3cdc6cc50022feddced9fdaeb
  • SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
  • SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
  • SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
  • TLSH
    T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Release/Guna.UI2.dll
  • Size 2.0MB
  • SHA256 46eb6373653147054e2e5039093a1783a188bd5483710a25f122b431ef5d4715
  • MD5 bdcc86fe49a37adf6a2f998de18b4487
  • SHA1 53fa4122ee5f2d63239e70b60c33f329fe442901
  • SHA512 31481f24259a503c2539738086a9cf185e9b9b64b1a205b0834384a3ddb67cbf2e1bec57aac618310681a9cc3f7e11df1042961df368ed7004c4cce8c42af069
  • SSDEEP 24576:59QRTBAFp9V3KTA7Ofd5g6cC/AZz+o2+OiMTiZz0CaHG5kyvJZUEY3JNSWuUbsul:5eR+OTA/2fTiZz0HHGGEY5QXCs/le
  • TLSH
    T135A5F4013B819917D56E737AEAE3405D87F3EC50EBA6FB49319073BC0DAB321494266B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    Release/Leaf.xNet.dll
  • Size 129KB
  • SHA256 de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa
  • MD5 ea87f37e78fb9af4bf805f6e958f68f4
  • SHA1 89662fed195d7b9d65ab7ba8605a3cd953f2b06a
  • SHA512 c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a
  • SSDEEP 3072:gE3OJDHIfFLlL3pPiqhcLS/oZhttaMBM2cid:gHWZxJiqO
  • TLSH
    T182D33A357BF94A1EF7FE4778F87151008AB7B9496202EB6D681460EE1553B82C901FB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral10behavioral9
• • Target
    Release/Microsoft.CSharp.dll
  • Size 47KB
  • SHA256 27d5452d27c701d257cce41e330c45974d1d0027a6c890b1e1d59351d46480f1
  • MD5 90c1afef9e40cf0bdeb4518639f0dfa6
  • SHA1 f7b83b9293c2844b0840c0feff536383defa49f6
  • SHA512 66bb72b261f7043d792e7c58fd8bb2e8cf18c302d5702981c17571e7c68e1847b4d469b56d92bf87ba3d553c4276c1d578eac7b19592ab0ce5a109ec13440345
  • SSDEEP 768:iIbkSD7aPt7zp5QSXCg19YyA46kDwMaMu2UbBMyaMzu2WICa1NTqWnO8qxL:pbkE7SJzpPCgLYyA462wHj5B7rCkCkNa
  • TLSH
    T12E233B4ED7E85166E8F30A7062F6D946AF35F7862B21C99E0014C22E2D92F90D737739
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    Release/Microsoft.VisualBasic.dll
  • Size 143KB
  • SHA256 3ab15cec2cb631f62884f1b4af53b50d7a2ea506e60db9c2681dc2c8c77c14e6
  • MD5 321185b69265ef86a83fd072a143cbe1
  • SHA1 843d2f3e1b258aaf4abff945b58a00d8f4bd8e69
  • SHA512 54c9f86509005d79b6a98d7184af20969bf1b229a3ce4cf6cf93e5fae627901a5034f104c891e7a3ee78f5a917ff82201bd7d10c7a92e5f98a2275478ab064be
  • SSDEEP 3072:BvRmLTgMJd3+10bxlFjXtZ9pyxzzC3T+wSkGw7x:BvQLUMJd40b59pyE
  • TLSH
    T181E34B4A73E8911AECFA0F701A36E1519F79F29A2D138B0D304C926F1BA3B575362375
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral13behavioral14
• • Target
    Release/NAudio.dll
  • Size 501KB
  • SHA256 bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780
  • MD5 047bca47d9d12191811fb2e87cded3aa
  • SHA1 afdc5d27fb919d1d813e6a07466f889dbc8c6677
  • SHA512 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f
  • SSDEEP 12288:YnfnRe200wJT4WQ+NOStYVlJHMGwH7fu:ODIrQ+NOS2HMGwHT
  • TLSH
    T1DFB45C2237D4962BD1AF2371E8F0051E97B1E4867227EF4F899467BE1D83B914D10BA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    Release/Newtonsoft.Json.dll
  • Size 685KB
  • SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
  • MD5 081d9558bbb7adce142da153b2d5577a
  • SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
  • SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
  • SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
  • TLSH
    T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    Release/PacketLib.dll
  • Size 79KB
  • SHA256 39dc2885c042dcf15512fd5d87e4cb0e18ca88e068511d7bef028a18fd1bea37
  • MD5 7a3060763e409236b042bdb9a3002462
  • SHA1 7c8bb9ec144822a871ab0ebcb45db4f853964408
  • SHA512 9907ac0ebb9ce817d3d9a37c128cb22d5fdd1892083d233c46cca6467b4450cbfce4f2689fa266bfb4c00808d42220fbc7b5e1bb0c8013cd683d0a1446fef13e
  • SSDEEP 1536:daEDbRCURlIrxyShb6XdgWqQrBhB808aoE:/bRrIrw4b6XTqQ1L808fE
  • TLSH
    T12783A5D10B18D3B5E9CF3177757A4A6A0FED82233D69E7B07704E8ACBA75B0112025B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20
• • Target
    Release/Plugins/Admin.dll
  • Size 10KB
  • SHA256 3afad71ef5b84f9809ce283fb61e51fa9f9ea70bccd72f0e1558bf45768cbb7a
  • MD5 8a5cd059b84b7ec4bed689f7e2a9a4ba
  • SHA1 c886d1110c23d1eaf2dc8018736aedeed61d2873
  • SHA512 30aea74e70ea9c4e59dc8d1e244f5c822f200c643cfa537f78ab842247483836425020c5065c3e910f653346962ab8d8c22f6c31cf6d5b8e35c65e060cc07600
  • SSDEEP 192:fkyT4fM5ZB989wCdv6RQdPVBTYRjmRWCFDbvpvpTN+:fkyT4fMvI9Lv+iPVBcRCRWC9bA
  • TLSH
    T17F22E71677FCC73EC6BE873968A2031006F5FB459652CB5F5D88E09CACA73506B10B65
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    Release/Plugins/AudioRecording.dll
  • Size 244KB
  • SHA256 54f0138ada67ef076d1ac6d6808628fc46fe6813ceab2426cc2096f0b3a74bda
  • MD5 793d4faa8aa292efd32ae3b213b5898f
  • SHA1 f95372dae935406588d306e1905bc7e0ed3444e4
  • SHA512 a3e7928d2483b5826324ebffb2596d6b3e41890483600b460612f37409fb34af71802333f6587f81bf5387c93a176006332112e63aa84857b36b79b080a189d5
  • SSDEEP 6144:7kYtP9C3Bj+UwxPWC9E9YJATn93k7A9KID8YN:JPYj3YnSn93kE9rDN
  • TLSH
    T12634222CFB8F4B6EEC064BB9D744591D8035C2AAE443C3C7A46DE19AC5433EA95F041B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    Release/Plugins/Chat.dll
  • Size 1.5MB
  • SHA256 dd17af21dd914300d2aac3e3ed43bffe63d3a444505220a0dd929c3e33a2fe89
  • MD5 0adad753c6706d6888dbebf3249d0214
  • SHA1 c997c84df8f36ac6172c25ab85e562408d56794f
  • SHA512 53bbb2437d2e45e5e38fd3c2fd683f780c3666e229a2cd1b5d96121816c621bdbc869e2f0058be54d9d3506d351d3f1d6264099f31d4b0dce236d32e2eb22fa4
  • SSDEEP 49152:HFyliZRy5rEAybehujpfHzAoR0jZMjyBhOrMD89:ldFehGEom6nAD89
  • TLSH
    T1017523AECBA8C029DE0BCAF07B15D52412790F4A5B2303601B0ABE6535757EFA9587F0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    Release/Plugins/FileManager.dll
  • Size 15KB
  • SHA256 bf2e27c017d6648c6e0dd66e777561321111312b24e311069f79eaa35e5a4bdf
  • MD5 9b12de6366c800c6335c5b6b9196b44d
  • SHA1 0651fb13d428d4b99d988ac009f8b811c17911fe
  • SHA512 a706b0640948232543aa33cf61dabf532351a5f3aaf7b546c6fe9e336bfed9391df5d8de69e8ad08a7f2ba0b52afb391b71a5a7e216b52f63916ce07df2cf92f
  • SSDEEP 384:LDTbnPUnVbiD7XoRCWIbbcCRWj0nTOBJYSv8WP6wv49S:LPjebi/et0nTOYI6wA9S
  • TLSH
    T1B7622D0E9BB8C76FC9BD433D687185011AB9E5096313EB779E8ED05C2E273D54241EA4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    Release/Plugins/Hardware.dll
  • Size 43KB
  • SHA256 4abf93bc841460c589ed0dea8a7bc02a8be8865dd101aa1cc207f820b890e65c
  • MD5 bf104049e139142ba9ee2ec185271d26
  • SHA1 7eb8dc8c0f55741333ac9cfd2c55261bb7999b27
  • SHA512 3c06e28609146e2d32de7fe845770c843b5fee7feed9c4b25418e8a04da0dc0286d91cc6a4e1e2f0fa461f02aa8d8e9400f215f4047e9738a072161cd8669113
  • SSDEEP 768:cnKZVX3mo7bwu7lGj4Qie8ArmEwanRXCVsev1BtLIBfucEf48Mzzn:cYGibwuYjsDAiENQVseNbIB2Yn
  • TLSH
    T16513D1187B464B48E833DE3EB6931600D2F3A757CFB1CB4B6044A51FC8761C75952BAA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    Release/Plugins/Information.dll
  • Size 401KB
  • SHA256 50db812591e76b056b9344c1f96da99d09923cb2bddfce5c037dfda76e15edbb
  • MD5 e04e2e80dd416736a3523ec3a41f87c8
  • SHA1 f97c34202ab182a52d2e992010997b131ad9d38a
  • SHA512 aca0c2e2697f0ba2537eda9cc3de8e1b817c86b46fa217442f944046f7f26d01da36079b47f668422413d369f90bbf4a24ee555e6892a57cb6dd42f47531a0cd
  • SSDEEP 6144:Kk8qCixgDLws3UXyobRZVLlfh7rZthO+JjkuHEEAt/wz/60LKID8YNRo+T:KKxOwLZdfrXg+JwuKt/S/60LrDNRV
  • TLSH
    T113940205B3584075E21FE57DA4232EF5D2F6F10A87B2E7CB5741192A8F223E25A72732
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32