Extracted

• • Target
    EagleSpy-V5-Cracked/Cryptolens.Licensing.dll
  • Size 113KB
  • SHA256 87adaae9dadbb59cf050b6688d4bb1dbc6c7f2b3e9ddc6c41cb6ce7a086cbe63
  • MD5 f20cb7ba70247bf54e0f52bf705f5699
  • SHA1 bf3ffc0c571c7fd827bc17b099906db2c504c751
  • SHA512 4fa18822151a85481e3df67c42b63a7c67eb73e4b9c9d3b01623e7af6f6c756c47d8e0b7cb034ed50aa1a9efdd379e01acff5a0389ebd86dfb636aaab47b4a5b
  • SSDEEP 3072:+aqWQ/Jj+UQgHhSxpThvyWE5j4IHUmTwo/9m5zv+PaFlrCAO:oV9+UhHExpThHEPUsm
  • TLSH
    T100B308159F68836DC2AF1D75F034C4FE09E3A98A3C14EABA9F50E4CD7A63B8156105B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    EagleSpy-V5-Cracked/DrakeUI.Framework.dll
  • Size 1.6MB
  • SHA256 70e72477f7fe0018e043ce8fe2228a289459058ee41caecd6f05855898bc5b80
  • MD5 0562b4c97f643306df491a938ae636da
  • SHA1 0807c37b711374ed4814a9518c9e264517de89a0
  • SHA512 c969cd274b6bf65a34f1d129b6531616a3485a1f153088609ad2369d380fdec37c3e88a423495912715a26e353dd5498f7f9e73c895e9f3f18fc7d1e65d2ecaf
  • SSDEEP 24576:nYyUyUxws47SDJ+wfa3ZsacYwzhmT5LOMobxqFFnM9Pv1w+Fus:nYyUyUueD001YwzhmVSMoNqFF
  • TLSH
    T1D085AE4527A88E1EE57E87FED4321420D7B49601B1DEE74FEEC1B4E92CA77888C09587
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    EagleSpy-V5-Cracked/EagleSpy V5.exe
  • Size 72.0MB
  • SHA256 249589dbc7e37f50a93069bf49632ea632ac76b1bd09b66b52a86d917ad7aff8
  • MD5 89388df834f06bcda1a1c996c4f0e364
  • SHA1 0d6e3216d7d7db86e68fee67384d8a11851e963c
  • SHA512 e7d89c6d9301055004dd7a14197b47b42d9f2077b6945d9128f5459021f3a3fc2392c75a917430668930f8c567eb6e182b28101eb4cd268f490667b8dcfb4c7b
  • SSDEEP 24576:3QXqsi1OOYdKcoA5kp+S/1JGvdIflNNtnG:3Q+1OOgUAM16d
  • TLSH
    T11DF70231A5D90CE0F47ADEFADDA002E69D3D774767239718017A72C11A1FA674EC8E28
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdiscoveryasyncratpersistenceprivilege_escalationrat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral5behavioral6
• • Target
    EagleSpy-V5-Cracked/GeoIPCitys.dll
  • Size 191KB
  • SHA256 d54fd6c5903eea49a75d620d4ba232f8effb1863f5f9c974e4ac0a8fb1904131
  • MD5 c070f2421851420e832e4f5989a775a2
  • SHA1 d6af3c48ffbe0fa1e0e54860836d3bbf374b8b46
  • SHA512 75c3edeb4c16d8e82eedc5595b9c3fde4cbd4a3e9deae1967ad513474920a48e4e9275fdc76f44032b1be570a4ece1a6393c4680af8989f67bcdec039d06798e
  • SSDEEP 3072:87IcHKc0TwY4O6BlLiJxTmd9h1+fJ5uJnjpUoh/ht21hYvpMaoySJHPc8E:8dHV0Tn4pox6d9G4k
  • TLSH
    T153145F45B3EA644BFAFFEA35BD6460545BF6BCAE6925C4AC0E451D4C48F0B408DA0F32
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    EagleSpy-V5-Cracked/NAudio.dll
  • Size 498KB
  • SHA256 3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c
  • MD5 6ca17abccae3050f391401b2955f9333
  • SHA1 0975b039a793accb58130d6639262cd291d80d5d
  • SHA512 c08f366aae9baf0e7762f47a2f79d0dee5187a1d7631e5838590b7c12911bdeb6247e0ff860ade36e04f1d6717f919ad98df6d3a1a556bff4b8994db9616ccec
  • SSDEEP 12288:MnXnae2TPlr3zvzar5oRDaw92wP6mai9gs6C:K8lrT+r5ADakP4i9gs
  • TLSH
    T1B7B45C5637E4552BD4AF2374E4F0090A47B2F48B36A7EF8B5594A7AD2D837824D00BB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    EagleSpy-V5-Cracked/Newtonsoft.Json.dll
  • Size 683KB
  • SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
  • MD5 6815034209687816d8cf401877ec8133
  • SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
  • SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
  • SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
  • TLSH
    T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    EagleSpy-V5-Cracked/Siticone.Desktop.UI.dll
  • Size 4.0MB
  • SHA256 21eecaf504b7fe787a45f4aa8f8f36dacfc3ab1d75624dfb41827cdef2a9a589
  • MD5 1582aa45d981e0e569c6e05698642b30
  • SHA1 763506f312a186c55a04ef6a16ad7e867c394097
  • SHA512 278a7a4e2b9d82528200b9f92244db3f228187d15c36fd169deb927e343bc4d0bb29c9dba496f86558aea4f4deb44d1e47a41d5598c0b375d99ad9fbe99cec34
  • SSDEEP 24576:UCCxPAT4L7h3M7O2MLBSlvTh/aOBteUePU/DU/GHQYazK/DkWoql3zjbndHQ/jzb:WuO2MIThZNwewYDoyG
  • TLSH
    T12E166D013BD08917D16EBF76B463141C97F6F804E6A7E74E7995F2AC2B9B3684802363
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    EagleSpy-V5-Cracked/WinMM.Net.dll
  • Size 43KB
  • SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
  • MD5 d4b80052c7b4093e10ce1f40ce74f707
  • SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
  • SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
  • SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
  • TLSH
    T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    EagleSpy-V5-Cracked/bb2.exe
  • Size 173.1MB
  • SHA256 3201a4384b640a03c3bf0f84406d0bfec8f21128c3092bbe2ea906dc916d8124
  • MD5 7ec69a7cc39906d0709da604710612f9
  • SHA1 2fa063e9ef82fac8bc97093dbbcb846d126fac87
  • SHA512 c3fc22682f28240ed715d9cfd48904da76509fe958f091d9a40597b6c466c3f1573859bfc5df0a3dd8c390b6a0de551640d73bfb4f86b45322d845a6261324df
  • SSDEEP 3145728:rn00yD10cqe2AM5HmJvIBZ7ksA0yD10cqe2AM5HmJvIBZ7:by0ceAMwMZ7BO0ceAMwMZ7
  • TLSH
    T1D588130263D1847BDD3AD17128B70631FFB1AE83863193876A59788A5EF77C4CE52E06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    EagleSpy-V5-Cracked/res/Lib/7z.dll
  • Size 1.2MB
  • SHA256 4d61796b499a4177b03e8e36778ec57293bebbf26412c69e19d3248602a2bb8a
  • MD5 34738b1b326c7f65d365a5b33e045662
  • SHA1 54f86f6d3b5d96584d6d2a76023f3522e09706fe
  • SHA512 134faa16f9913d4cfdfb8efdc9cdda6ff6907016e0f46e3f72792cbc183a688fab0484f251efa562639a75582e380b099481d79d6324e5aded0a8041492414ce
  • SSDEEP 24576:XXm+ENgUCp+R3RuC2HhS6yR1xF2rH8W7f3z9L/SDidq2:HX7cRuC2Q6S36DJuKq
  • TLSH
    T1E7457D11F7F5C078D58A5630871DBBB540FCE71ACA2068C76BC0BE6E6F318D6C229999
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral19behavioral20
• • Target
    EagleSpy-V5-Cracked/res/Lib/7z.exe
  • Size 329KB
  • SHA256 b8c3871a5d6a473a2e9d08684a481aea7467a97d0a433cf55b127323ef61218f
  • MD5 453821572a13cc6ea0736f9db6424e13
  • SHA1 5f994bde8db4b658781756eaaca9416909a3a420
  • SHA512 22468064ae306037d2b241e8a985ad5b037b45f6873e364f46d8066018533993e66834288227ae86e94e23511386f0afcf52776060b17dad11dfba4bc333b07a
  • SSDEEP 6144:qnzsyDn7PDS+FDflUjvJUkbEOyF1rOpsuCOuOff5kYF/lTRHA:q377SKfgvqkbFyFJC5RzH
  • TLSH
    T177747C133BF9D03AD6420231DF5A9BA5E0F9A26909740D4363C40D6CAF74996E379F2E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral21behavioral22
• • Target
    EagleSpy-V5-Cracked/res/Lib/APKEditor.jar
  • Size 5.4MB
  • SHA256 5f608e30c117cd04502c8f5c6a9acf2cf1e2fde49a46ad02310b0b6489cc413c
  • MD5 38ea6d632f98858fe2ff539031942ee7
  • SHA1 10c50bd178a4d478cb4bc458d7fe2a5992e9de95
  • SHA512 d449507c6af8fb046d3df137a3c5c4e891167bb942fc7af063001252d5a22ef10ced9f6e1e1abf446c66acd0edea613827fb6bc8ee72688280785c5f5f67a008
  • SSDEEP 98304:aJQwUNHA+h6UwLb2fk4P4tn3Rg9KFB1H6Kw6RZRmFJkYJSOla+xxpC:amhN3w32fdP87Q6RZUFJLXjpC
  • TLSH
    T1C4460266F4CEA472F9775233EC6B4573BC3F01C8E45B016B29A456E2E87AC864B43744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    EagleSpy-V5-Cracked/res/Lib/aapt.exe
  • Size 1.6MB
  • SHA256 aa18b5646881ff3b8ca9879045a1b4a44e2d5b24fbe14486fc8236789de8237a
  • MD5 80f136b0642bbc25c7578e0d24d4673b
  • SHA1 883596e63700c45ab0d4d880b883f687f65c2457
  • SHA512 4a95ac6b8d6252b68ccc842e8dd36056d5b0a773a86d4a8234f39cc2195ccec06fc64954655956447dfc27896720c92f8dfa4a39c2bb568c21fcc588723d86fc
  • SSDEEP 49152:XPNjtbkZdmFxzKyfMKiTYQ0QQQKXQQQQQQQf0Qw:/NjtQZ8Pf1
  • TLSH
    T14B758D45E693B1B9FA8315F0121FA33FBB340B018728DDE7DAC4DCB46A52AD1143A65E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral25behavioral26
• • Target
    EagleSpy-V5-Cracked/res/Lib/apksigner.jar
  • Size 968KB
  • SHA256 ba13fc4122f3c8ef23eed76e13792b033fd0506de90ec3ff1e5773e383eb6f15
  • MD5 16c82bdd120d4b5803deafd3550afa5f
  • SHA1 c1e0626fe98fdbe2f1d483f99664ec957f44f891
  • SHA512 9918a24392d397a64f39489dba1c73b1576ff1e6bc2c302f3fd7bb037b9f42f620ee90c12ebb625e927543e3163fbc47bcf99c93fde6deb0b9376e171f792bea
  • SSDEEP 24576:5hCPzWIgo1IhgOBAxoBSTNDGbe48+mrmCJprmhBK5I:5hCbW6jAAks7R6OohBK5I
  • TLSH
    T12F25E1239D75403EEA334236E06AD464F91926D8E093B21F72E46BCB5D25FC39743AC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    EagleSpy-V5-Cracked/res/Lib/apktool.jar
  • Size 22.1MB
  • SHA256 7b4a8e1703e228d206db29644b71141687d8a111b55b039b08b02dfa443ab0f9
  • MD5 c186ee0c87dbf197456cc010aeba99da
  • SHA1 fb9f342bccda27ba17b737b2f8e8fa77ba9f50b9
  • SHA512 f6268c7103e6c2a10416fc039ba087b9129a699136ff172fd5e386d46c6a1ab24e4bb0562a4e6862f0f2201877caa404ea7afc6a08501d3da890bd9fdb086c8f
  • SSDEEP 393216:ZkvvoeSkja/hZscFj+KgYeJyxC3mk7qqY/YxNnvDjScxgIZQDyU9O/XvQI/+2Xo0:ZknoeRME01gYzk7qjk5vP9iIz4O/XvQ8
  • TLSH
    T1E8373382E6B4D072F99A5075602951B3FAB54750F01600E109EBEEFB9C9EC0A6F4E71F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    EagleSpy-V5-Cracked/res/Lib/junk.smali
  • Size 566KB
  • SHA256 d7afac3ee30c639badcbc6b75a9a95222a6e519d53635a4c398fedc7546f4c56
  • MD5 07daa56c012827a2ca40b03e8d3823c6
  • SHA1 484e0da731ccf4da4e7a52a73c53f70bbb0e1b21
  • SHA512 29b6879655eb818ec65cb16927a8f2d36a4384a55fb63dbe8de349430ff63757309dda5eaef20ddf43acab6806260c9723da540a86743616e8993edb1532fe4d
  • SSDEEP 12288:VilFY7VZ8EuJeio/CgCPK28VB081Em7zhZGIklwkLyXbWQs:gn
  • TLSH
    T1BAC4F14F910340072C71E09B3D8B2A5DE785A2639C29B9947F4DCB8E9FF4054D6AA6CF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32