71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Submit
Reports

Overview

overview

Static

static

SpyNote_v6...pi.dll

windows7-x64

SpyNote_v6...6.html

windows7-x64

SpyNote_v6...2.html

windows7-x64

SpyNote_v6...9.html

windows7-x64

SpyNote_v6...SM.dll

windows7-x64

SpyNote_v6...SL.exe

windows7-x64

apktool/apktool.bat

windows7-x64

apktool/apktool.jar

windows7-x64

apktool/signapk.jar

windows7-x64

SpyNote_v6...ub.apk

windows7-x64

SpyNote_v6...va.jar

windows7-x64

SpyNote_v6...sS.exe

windows7-x64

platform-t...pi.dll

windows7-x64

platform-t...pi.dll

windows7-x64

platform-t...db.exe

windows7-x64

platform-t...mp.exe

windows7-x64

platform-t...ol.exe

windows7-x64

platform-t...ot.exe

windows7-x64

platform-t...nv.exe

windows7-x64

platform-t...c++.so

windows7-x64

platform-t...-1.dll

windows7-x64

platform-t...fs.exe

windows7-x64

platform-t...fs.exe

windows7-x64

platform-t...e3.exe

windows7-x64

platform-t...t__.py

windows7-x64

platform-t...ror.py

windows7-x64

platform-t...per.py

windows7-x64

platform-t...est.py

windows7-x64

platform-t...est.py

windows7-x64

platform-t..._tests

windows7-x64

SpyNote_v6...in.exe

windows7-x64

SpyNote_v6...te.exe

windows7-x64

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:47

Sharing

Copy URL

Twitter E-mail

Static task

static1

spynote

6 signatures

Behavioral task

behavioral1

Sample

SpyNote_v6.4/CoreAudioApi.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html

Resource

win7-20240221-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html

Resource

win7-20240221-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html

Resource

win7-20240419-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

SpyNote_v6.4/Resources/Imports/Payload/SL.exe

Resource

win7-20231129-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

apktool/apktool.bat

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral8

Sample

apktool/apktool.jar

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

apktool/signapk.jar

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

win7-20231129-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral11

Sample

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

SpyNote_v6.4/Resources/Imports/T/sS.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

platform-tools/AdbWinApi.dll

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

platform-tools/AdbWinUsbApi.dll

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

platform-tools/adb.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

platform-tools/dmtracedump.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

platform-tools/etc1tool.exe

Resource

win7-20231129-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

platform-tools/fastboot.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

platform-tools/hprof-conv.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

platform-tools/lib64/libc++.so

Resource

win7-20240215-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral21

Sample

platform-tools/libwinpthread-1.dll

Resource

win7-20240508-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

platform-tools/make_f2fs.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

platform-tools/mke2fs.exe

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

platform-tools/sqlite3.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

platform-tools/systrace/catapult/common/battor/battor/__init__.py

Resource

win7-20240221-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral26

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_error.py

Resource

win7-20240419-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral27

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper.py

Resource

win7-20231129-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_devicetest.py

Resource

win7-20240508-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_unittest.py

Resource

win7-20240508-en

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

platform-tools/systrace/catapult/common/battor/bin/run_py_tests

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe

Resource

win7-20240215-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

SpyNote_v6.4/SpyNote.exe

Resource

win7-20240508-en

windows7-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2904 wrote to memory of 2784	2904	cmd.exe	java.exe
PID 2904 wrote to memory of 2784	2904	cmd.exe	java.exe
PID 2904 wrote to memory of 2784	2904	cmd.exe	java.exe

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2904

C:\Windows\system32\java.exe
java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
2⤵
PID:2784

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2784-2-0x0000000002320000-0x0000000002590000-memory.dmp

Filesize
2.4MB

Download
memory/2784-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2784-13-0x0000000002320000-0x0000000002590000-memory.dmp

Filesize
2.4MB

Download