Overview
overview
10Static
static
10SpyNote_v6...pi.dll
windows7-x64
1SpyNote_v6...6.html
windows7-x64
1SpyNote_v6...2.html
windows7-x64
1SpyNote_v6...9.html
windows7-x64
1SpyNote_v6...SM.dll
windows7-x64
1SpyNote_v6...SL.exe
windows7-x64
1apktool/apktool.bat
windows7-x64
1apktool/apktool.jar
windows7-x64
1apktool/signapk.jar
windows7-x64
1SpyNote_v6...ub.apk
windows7-x64
3SpyNote_v6...va.jar
windows7-x64
1SpyNote_v6...sS.exe
windows7-x64
1platform-t...pi.dll
windows7-x64
3platform-t...pi.dll
windows7-x64
1platform-t...db.exe
windows7-x64
1platform-t...mp.exe
windows7-x64
1platform-t...ol.exe
windows7-x64
1platform-t...ot.exe
windows7-x64
1platform-t...nv.exe
windows7-x64
1platform-t...c++.so
windows7-x64
3platform-t...-1.dll
windows7-x64
1platform-t...fs.exe
windows7-x64
1platform-t...fs.exe
windows7-x64
1platform-t...e3.exe
windows7-x64
1platform-t...t__.py
windows7-x64
3platform-t...ror.py
windows7-x64
3platform-t...per.py
windows7-x64
3platform-t...est.py
windows7-x64
3platform-t...est.py
windows7-x64
3platform-t..._tests
windows7-x64
1SpyNote_v6...in.exe
windows7-x64
1SpyNote_v6...te.exe
windows7-x64
5Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 08:47
Behavioral task
behavioral1
Sample
SpyNote_v6.4/CoreAudioApi.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html
Resource
win7-20240419-en
Behavioral task
behavioral5
Sample
SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SpyNote_v6.4/Resources/Imports/Payload/SL.exe
Resource
win7-20231129-en
Behavioral task
behavioral7
Sample
apktool/apktool.bat
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
apktool/apktool.jar
Resource
win7-20240508-en
Behavioral task
behavioral9
Sample
apktool/signapk.jar
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
SpyNote_v6.4/Resources/Imports/Payload/stub.apk
Resource
win7-20231129-en
Behavioral task
behavioral11
Sample
SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SpyNote_v6.4/Resources/Imports/T/sS.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
platform-tools/AdbWinApi.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
platform-tools/AdbWinUsbApi.dll
Resource
win7-20240508-en
Behavioral task
behavioral15
Sample
platform-tools/adb.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
platform-tools/dmtracedump.exe
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
platform-tools/etc1tool.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
platform-tools/fastboot.exe
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
platform-tools/hprof-conv.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
platform-tools/lib64/libc++.so
Resource
win7-20240215-en
Behavioral task
behavioral21
Sample
platform-tools/libwinpthread-1.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
platform-tools/make_f2fs.exe
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
platform-tools/mke2fs.exe
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
platform-tools/sqlite3.exe
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
platform-tools/systrace/catapult/common/battor/battor/__init__.py
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
platform-tools/systrace/catapult/common/battor/battor/battor_error.py
Resource
win7-20240419-en
Behavioral task
behavioral27
Sample
platform-tools/systrace/catapult/common/battor/battor/battor_wrapper.py
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_devicetest.py
Resource
win7-20240508-en
Behavioral task
behavioral29
Sample
platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_unittest.py
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
platform-tools/systrace/catapult/common/battor/bin/run_py_tests
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe
Resource
win7-20240215-en
Behavioral task
behavioral32
Sample
SpyNote_v6.4/SpyNote.exe
Resource
win7-20240508-en
General
-
Target
platform-tools/lib64/libc++.so
-
Size
1.2MB
-
MD5
299383192987cab6106075b5e0b5214a
-
SHA1
aac38d27554ff20a054562c6d1a8640c77c24964
-
SHA256
cbcb47f0907e688c30f846490884a2c24ef465dc96080350063491c3c0713835
-
SHA512
4c71c386381a86926edaac2924b2a29edbbdff9c6eddba1b810ce26c38b2dec49eac41b767af13fa71f2c7f56642858303b4b262bc87db64dec900473081c542
-
SSDEEP
24576:WR7l2SLumB5qsbVElEbhYe2sdpQM0srPgAT7MBaUNdSbGR7l2SLu2BT:+AsbuvePp0srPgATVUXSbaT
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.so\ = "so_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.so rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\so_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2556 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2556 AcroRd32.exe 2556 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2260 wrote to memory of 2664 2260 cmd.exe rundll32.exe PID 2260 wrote to memory of 2664 2260 cmd.exe rundll32.exe PID 2260 wrote to memory of 2664 2260 cmd.exe rundll32.exe PID 2664 wrote to memory of 2556 2664 rundll32.exe AcroRd32.exe PID 2664 wrote to memory of 2556 2664 rundll32.exe AcroRd32.exe PID 2664 wrote to memory of 2556 2664 rundll32.exe AcroRd32.exe PID 2664 wrote to memory of 2556 2664 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\platform-tools\lib64\libc++.so1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\platform-tools\lib64\libc++.so2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\platform-tools\lib64\libc++.so"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD521a5b26cf121e8fa3968d66cae0bc0bf
SHA107fa4686b1add35b800bde1ff4b7eb72315e2bf9
SHA256fd894cd2bb91a85c5a404e250aee10fb19945cd5306d87cda1b3cf2586c49645
SHA512d00b923a075d12b85556d43a1d84f32cd2ac7fef4906ecd06708ff6e67768e1eb1b9ec67ab2bc2ea7f1612802a1c343421672dbd46bdcd9f5d74b4fefcb07371