71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Submit
Reports

Overview

overview

Static

static

SpyNote_v6...pi.dll

windows7-x64

SpyNote_v6...6.html

windows7-x64

SpyNote_v6...2.html

windows7-x64

SpyNote_v6...9.html

windows7-x64

SpyNote_v6...SM.dll

windows7-x64

SpyNote_v6...SL.exe

windows7-x64

apktool/apktool.bat

windows7-x64

apktool/apktool.jar

windows7-x64

apktool/signapk.jar

windows7-x64

SpyNote_v6...ub.apk

windows7-x64

SpyNote_v6...va.jar

windows7-x64

SpyNote_v6...sS.exe

windows7-x64

platform-t...pi.dll

windows7-x64

platform-t...pi.dll

windows7-x64

platform-t...db.exe

windows7-x64

platform-t...mp.exe

windows7-x64

platform-t...ol.exe

windows7-x64

platform-t...ot.exe

windows7-x64

platform-t...nv.exe

windows7-x64

platform-t...c++.so

windows7-x64

platform-t...-1.dll

windows7-x64

platform-t...fs.exe

windows7-x64

platform-t...fs.exe

windows7-x64

platform-t...e3.exe

windows7-x64

platform-t...t__.py

windows7-x64

platform-t...ror.py

windows7-x64

platform-t...per.py

windows7-x64

platform-t...est.py

windows7-x64

platform-t...est.py

windows7-x64

platform-t..._tests

windows7-x64

SpyNote_v6...in.exe

windows7-x64

SpyNote_v6...te.exe

windows7-x64

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Static task

static1

spynote

6 signatures

Behavioral task

behavioral1

Sample

SpyNote_v6.4/CoreAudioApi.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html

Resource

win7-20240221-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html

Resource

win7-20240221-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html

Resource

win7-20240419-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

SpyNote_v6.4/Resources/Imports/Payload/SL.exe

Resource

win7-20231129-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

apktool/apktool.bat

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

apktool/apktool.jar

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

apktool/signapk.jar

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

win7-20231129-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

SpyNote_v6.4/Resources/Imports/T/sS.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

platform-tools/AdbWinApi.dll

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

platform-tools/AdbWinUsbApi.dll

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

platform-tools/adb.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

platform-tools/dmtracedump.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

platform-tools/etc1tool.exe

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

platform-tools/fastboot.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

platform-tools/hprof-conv.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

platform-tools/lib64/libc++.so

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

platform-tools/libwinpthread-1.dll

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

platform-tools/make_f2fs.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

platform-tools/mke2fs.exe

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

platform-tools/sqlite3.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

platform-tools/systrace/catapult/common/battor/battor/__init__.py

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral26

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_error.py

Resource

win7-20240419-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper.py

Resource

win7-20231129-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_devicetest.py

Resource

win7-20240508-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_unittest.py

Resource

win7-20240508-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

platform-tools/systrace/catapult/common/battor/bin/run_py_tests

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

SpyNote_v6.4/SpyNote.exe

Resource

win7-20240508-en

windows7-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

platform-tools/AdbWinUsbApi.dll
Size

61KB
MD5

0e24119daf1909e398fa1850b6112077
SHA1

293eedadb3172e756a421790d551e407457e0a8c
SHA256

25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
SHA512

9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
SSDEEP

1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe
PID 2916 wrote to memory of 2932	2916	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
2⤵
PID:2932

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads