EagleSpy (V3 Ultimate / V4): Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "C# .NET Builder orchestrating apktool, baksmali/smali, zipalign, and apksigner with custom DEX crypter modules",
  "runtime": "Android Runtime (ART) / Dalvik VM",
  "binary_footprint": "Staged APK Dropper (800 KB - 2 MB) unpacking a core RAT DEX/APK payload (1.5 MB - 5 MB)",
  "stub_size": "1,620,000 bytes (core payload APK before dropper wrapping and asset encryption)",
  "packer_obfuscation": "Staged APK Dropper architecture (bypassing Android 13+ Restricted Settings via session-based PackageInstaller or DexClassLoader), string encryption, and manifest attribute obfuscation",
  "subsystem": "Android Application Framework (AccessibilityService + SYSTEM_ALERT_WINDOW + NotificationListenerService)",
  "entry_point_flow": "Dropper Activity -> Unpacks & loads encrypted payload from assets/ -> Prompts for AccessibilityService -> Auto-grants SYSTEM_ALERT_WINDOW, SMS, and Storage permissions -> Starts foreground service -> Establishes dual TCP connections to C2 Ports 7771 and 7772",
  "technical_summary": "EagleSpy (circulating in V3 Ultimate and V4 releases) is a specialized Android RAT and financial fraud suite heavily adapted from the CraxsRAT/SpyMax lineage. Engineered with a modern C# WinForms dashboard, EagleSpy integrates native modules specifically tailored for cryptocurrency theft and banking takeover: an automated seed-phrase overlay injector targeting MetaMask, Trust Wallet, and Binance; a dedicated Google Authenticator 2FA token scraper (G-Auth Stealer); a multi-chain clipboard clipper; and a staged APK Dropper builder designed to bypass Google Play Protect and Android 13/14 security restrictions."
}

{
  "interface_type": "GUI Builder / Operator Console",
  "builder_tabs_options": [
    {
      "tab": "Home & Quick Option",
      "options": [
        "Live Client Grid: Displays connected devices with real-time screen preview thumbnails",
        "Quick Option Tiles: One-click triggers for Screen Control, Live Screen, Keylogger, Lock Screen, Screen Reader, Browser Monitor, File Manager, and SMS Manager",
        "Banking / Crypto Injection: Instant deployment of phishing overlays for banking apps and cryptocurrency wallets",
        "G-Auth Stealer: Dedicated extraction trigger for Google Authenticator 2FA codes"
      ]
    },
    {
      "tab": "Build (APK Builder)",
      "options": [
        "Host IP / DNS & Dual Ports: Configures primary C2 address and dual TCP ports (default 7771 and 7772)",
        "App Identity: Custom App Name, Package Name, Version, and Icon",
        "Telegram Bot Bridge: Optional Telegram Bot Token and Chat ID for instant new-victim and seed-phrase alerts",
        "Anti-Delete / Super Protection: Enables Accessibility-based Settings blocking and icon hiding"
      ]
    },
    {
      "tab": "Dropper (APK Dropper)",
      "options": [
        "Generate Staged Dropper: Wraps the compiled EagleSpy APK inside a clean loader APK to evade static AV and Android 13 Restricted Settings",
        "Lure Template: Selects fake update UI (Google Play, Chrome, System Update) displayed while installing the secondary payload"
      ]
    },
    {
      "tab": "Tools / Clipper / Injector",
      "options": [
        "Crypto Clipper Addresses: Pre-loads operator BTC, ETH, TRC-20 USDT, BNB, and SOL wallet addresses for automatic clipboard replacement",
        "Target Wallet Overlays: Selects HTML/WebView seed-phrase phishing screens for Trust Wallet, MetaMask, Phantom, and Binance",
        "Lockscreen Phishing: Configures custom PIN/Pattern/Password lockscreen overlay"
      ]
    },
    {
      "tab": "Encrypt",
      "options": [
        "APK Crypter: Applies DEX class encryption, random Smali junk code insertion, and ZIP structure manipulation"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "Config.HOST",
      "field": "Host",
      "type": "String (Encrypted)",
      "description": "Primary C2 IP address or domain name"
    },
    {
      "offset": "Config.PORT_CMD",
      "field": "CommandPort",
      "type": "String / Int",
      "description": "Primary command and control TCP port (default 7771)"
    },
    {
      "offset": "Config.PORT_MEDIA",
      "field": "StreamPort",
      "type": "String / Int",
      "description": "High-throughput media and screen streaming TCP port (default 7772)"
    },
    {
      "offset": "Config.TG_TOKEN",
      "field": "TelegramToken",
      "type": "String",
      "description": "Telegram Bot API token for out-of-band victim notifications"
    },
    {
      "offset": "Config.CLIPPER_WALLETS",
      "field": "ClipperMap",
      "type": "JSON / String Array",
      "description": "Configured cryptocurrency replacement addresses (BTC, ETH, USDT-TRC20)"
    }
  ],
  "payload_generation_flags": [
    "Dual-Socket Mode: Port 7771 (Control) + Port 7772 (HVNC/Camera/Audio Stream)",
    "Dropper Staging: Session-based PackageInstaller or DexClassLoader asset unpacking",
    "Overlay Assets: Bundled HTML/CSS/JS banking and crypto wallet templates"
  ],
  "operator_commands": [
    "ScreenControl / ScreenReader: Initiates HVNC live screen streaming and remote Accessibility gesture injection",
    "CryptoInjection: Triggers immediate WebView overlay requesting 12/24-word recovery seed phrases on target wallet apps",
    "BankingInjection: Deploys targeted credential harvesting overlay matching installed mobile banking packages",
    "GAuthSteal: Launches or monitors com.google.android.apps.authenticator2 and scrapes active TOTP codes via AccessibilityNodeInfo",
    "LockScreenOverlay: Projects full-screen PIN/Pattern capture view to harvest device unlock credentials",
    "ClipperToggle: Activates or updates background regex clipboard replacement for cryptocurrency addresses",
    "FileManager / SMSManager: Full filesystem access and real-time SMS OTP interception",
    "AdminRight / DozeOff: Forces DeviceAdmin activation and battery optimization whitelisting"
  ],
  "interface_telemetry_analysis": "The EagleSpy V4 operator console features a left-hand navigation sidebar (Home, Logs, Build, Dropper, Tools, Encrypt, Injector, Settings) and a central 'Quick Option' dashboard equipped with 24 action tiles. A bottom status bar tracks connected client counts, active dual-port listeners ('Port: 7771, 7772'), and real-time upload/download throughput ('Sent / Received'). Selecting a connected handset opens a side-by-side live phone bezel preview with interactive remote touch controls."
}

struct EagleSpy_(V3_Ultimate_/_V4)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "Staged Dropper APK installed -> Uses PackageInstaller.Session (setting InstallScenario) or DexClassLoader to deploy core payload -> AccessibilityService enabled via social engineering prompt -> Auto-clicks runtime permissions and SYSTEM_ALERT_WINDOW -> Foreground window monitor detects io.metamask or com.wallet.crypto.trustapp -> Injects WebView overlay or scrapes AccessibilityNodeInfo text trees -> Exfiltrates over TCP Port 7771/7772 and Telegram Bot API.",
  "ntapi_functions": [
    "android.accessibilityservice.AccessibilityService!onAccessibilityEvent",
    "android.accessibilityservice.AccessibilityService!dispatchGesture",
    "android.view.WindowManager!addView",
    "android.webkit.WebView!addJavascriptInterface",
    "android.content.ClipboardManager!addPrimaryClipChangedListener",
    "android.content.pm.PackageInstaller!createSession",
    "android.media.projection.MediaProjection!createVirtualDisplay"
  ],
  "process_hollowing_target": "Dropper host process or persistent foreground service masquerading as Google Play Services / System UI",
  "persistence_mechanics": [
    "AccessibilityService Lifecycle Binding: System automatically maintains and restarts the bound Accessibility service",
    "BroadcastReceiver Resurrection: Hooks BOOT_COMPLETED, USER_PRESENT, and custom restart intents fired on Service.onDestroy()",
    "Battery Optimization Exemption: Programmatically requests and auto-approves ACTION_REQUEST_IGNORE_BATTERY_OPTIMIZATIONS",
    "Anti-Uninstall Watchdog: Monitors Settings activities via Accessibility events and immediately navigates away when App Info or Device Admin revocation screens are detected"
  ],
  "evasion_hooks": [
    "Session-Based Dropper Installation: Uses PackageInstaller.SessionParams to bypass Android 13/14 'Restricted Settings' blocks on AccessibilityService for sideloaded APKs",
    "Black-Screen Curtain: Covers the physical display with an opaque SYSTEM_ALERT_WINDOW view while performing automated wallet transfers in the background",
    "Notification Suppression: Uses NotificationListenerService to intercept and dismiss incoming bank transfer alerts and security notifications"
  ],
  "anti_analysis": [
    "Emulator & Sandbox Fingerprinting: Checks Build.HARDWARE, Build.PRODUCT, sensor availability, and QEMU system properties",
    "Encrypted Asset Staging: Stores the functional RAT DEX and HTML injection templates as AES/XOR-encrypted blobs inside the assets/ directory",
    "ZIP & Manifest Structure Tampering: Injects malformed resource IDs and corrupted ZIP header flags to hinder static analysis in JADX and Apktool"
  ]
}

Concrete technical breakdown of functional modules implemented in the EagleSpy (V3 Ultimate / V4) binary:

{
  "framing": "Dual-socket TCP framing: Port 7771 carries delimiter-framed, GZIP-compressed command/response packets; Port 7772 streams length-prefixed binary media and HVNC screen frames",
  "serialization": "Custom string-delimited key-value tokens with Base64-encoded JSON/binary payloads and out-of-band HTTPS POST webhook notifications to api.telegram.org",
  "handshake": "Stub connects to TCP Port 7771 -> Transmits encrypted client registration packet (HWID, Model, OS, Country, Installed Crypto/Bank Apps list) -> Opens secondary stream socket on TCP Port 7772 when live screen, camera, or audio modules are invoked",
  "cryptography": "GZIP compression combined with static-key AES-CBC or XOR obfuscation on TCP socket streams; TLS 1.2/1.3 for optional Telegram Bot API exfiltration",
  "packet_types": [
    {
      "header": "CMD_INFO / PING",
      "payload": "Device telemetry, active foreground package, battery state, and installed target wallet flags",
      "direction": "Client -> Server (Port 7771)"
    },
    {
      "header": "INJ_CRYPTO / INJ_BANK",
      "payload": "Target package identifier, HTML overlay template bytes, or captured seed phrase / login credentials",
      "direction": "Bidirectional (Port 7771)"
    },
    {
      "header": "GAUTH_DUMP",
      "payload": "Scraped Google Authenticator account labels and current 6-digit TOTP tokens",
      "direction": "Client -> Server (Port 7771)"
    },
    {
      "header": "STREAM_SCR / HVNC",
      "payload": "Compressed JPEG screen frames or serialized UI node coordinates",
      "direction": "Client -> Server (Port 7772)"
    },
    {
      "header": "GESTURE_CMD",
      "payload": "Touch X/Y coordinates, swipe vectors, or text injection strings",
      "direction": "Server -> Client (Port 7771)"
    }
  ],
  "traffic_signature": "Simultaneous outbound TCP connections from a single Android handset to the same remote IP on adjacent ports 7771 and 7772, often accompanied by HTTPS requests to api.telegram.org/bot<token>/sendMessage."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: