Eagle RAT v1.2.7z
- SHA256 af993ebb56394cf61191991532afe0f63044ba36f93bd24b97cfa43278d16f34
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Eagle RAT v1.2/EagleRAT.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Eagle RAT v1.2/EagleRAT.exe
Resource
win11-20260513-en
windows11-21h2-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
Eagle RAT v1.2/Stub.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Eagle RAT v1.2/Stub.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Eagle RAT v1.2.7z
- Size 2.7MB
- Sample260720-btevjsbv4m
- SHA256 af993ebb56394cf61191991532afe0f63044ba36f93bd24b97cfa43278d16f34
- MD5 412a49afffc4da814b7402eef54ee551
- SHA1 0a10caf60c19c5f3c52cceb75794b6ca90876be0
- SHA512 f57e22a20fc7421c1b826f5327a0c6d904c3f14104f6a0333ba8a0df53c0912fd31f38d9e858afa48ad53ef9b6075054f5d731129964665f032fe6a6746ee296
- SSDEEP 49152:kzi6JRxW1pbKqDDUd4K8UxcWdRt6NjGJjTIoWpytOiotzX7W4Ve5PCc1MyPwmCeC:kzi6Zc0WK8U246pG1T8pJt3lMZOyMnp
- TLSH T166D5334E4C27EBBD2FA5936860DB84442AD58DFEE638BD31C1946192E14181EFECF2D4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
resource yara_rule static1/unpack001/Eagle RAT v1.2/Stub.exe SmartAssembly - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Eagle RAT v1.2/EagleRAT.exe unpack001/Eagle RAT v1.2/Stub.exe
File Explorer
-
Eagle RAT v1.2.7z.7z 2.7MB
-
Eagle RAT v1.2/EagleRAT.exe.exe 5.9MB
-
Eagle RAT v1.2/Red Me @.txt54B
-
Eagle RAT v1.2/Stub.exe.exe 135KB
Eagle RAT v1.2/EagleRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ea498ded7ae2820e119202371df16e884a861ff1c6f5e79706f051815ee49b76
- MD5 c1aa7445df8f7239f23377483d11cccd
- SHA1 941ba0989580754c6efab324d21a7cde2160dbce
- SHA512 dd31f4fac6f245d5dfaae4978987936130676aa7606d137d74f23bbe3671b9491878b12a164bb471bb038a69512d2343bc667e5d324d394138672769926014ec
- SSDEEP 98304:clAFHYyBp+F3pLqLcf98ob/RMDoMu2JUeA0Y+a5Xfo:c6K0p+FLjLnLO
- TLSH T1A956BE52BA8489A6C4B633F14C61C5B00375BD59AA91C78B39F53E4F7973283EE5320E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
6052734
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\MaMosta_Gyan\Desktop\Code\Client\RDP\obj\Debug\EagleRAT.pdb
mscoree
_CorExeMain
Name
.text
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
103KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Eagle RAT v1.2/Red Me @.txt
- SHA256 5056d96212ea9da55ade4111d3c5880598dec93a96f8520d517912aaa66108a9
- MD5 90c4a45b6e69f7dfb4bf6538356c9aeb
- SHA1 6c6b306f7b10b1dcfabfd92ff45ad866be697991
- SHA512 38716a25533cb80c90ccafa0e49db555be22197809d96f927395def3bfc604ad6bc5408fa485d90197865317001eb603ddf4846c74bc76edcd7d3adeaddf8e9b
- TLSH T12C90020B761FD75B8E70091126616CA009F00615848886F334106A14012E970D11958D
- MD5 SHA1 SHA512 TLSH
Eagle RAT v1.2/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6b945fec14f309058ac5db5ff19254b5aa3facfc9c68b44b4c926cb9336529a2
- MD5 634a099b8caf5f1e7cc71ac2836f9f1a
- SHA1 8fec4c6fa33ba80c4556498f3ffd15a82ad08ae8
- SHA512 870959f9947574f42fc60aaa2ab131c769bd296c0a5824c41408dbc2125e77ab74a51dc0e33ede55565c3758db6c1f367f5da397f521fa69a22847c38d349819
- SSDEEP 3072:wL/Kd9XnJ4OXwHlt8VQg3Oi1OXvtWxepexZKjYOCDT:JhJZYl5vtWepexZ/
- TLSH T163D33BA533E48D02D5BF4ABE84739A2043B5A1169A13E74F0FE454ACBE73384891F797
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SmartAssembly .NET packer
Detects SmartAssembly .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
143318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ