�^G���X_��� L�E*�I���Mv����#��!XuI29L0���X�GKZ�8�-D���d�2G��BrKwU����� ���I�PPQur^YU(�Fʃ'v����͘�pSW4�iNѾJ�3������?T�n�Ζ��_~K%��@�h����*�as��k���hi@C�}y������.DI30`RW��K�&ܷ� %.�� �3=|oH�9Ww=Jl�����{<PA�]d�];T��6� Ci�Z<6�������� "�O���^{Ip��q���~7�:F��"ڔ�%�%�uyKȱLv���� 0�F=;P[���2��U#�IX���Gݟ:������o]��I�U"�QO<>�we����[Q���be��� ���v����y*�dsd�M� �V���CT�����<�k^K�3��uG4װy@N�/�X�IE>�����w���Ǥ��]�����Ip��@c �GM�f�� ��,b���`�7n�+Q�5�m���P� �(lF�뷉[���=����x!Kc2 ��1pB�G�5{O ��:���O���^:.3t�z��U&��"3�^6�4}ȼ d*��<S�#�I��n� ���N����Mc�kxh_9h���u����#�)4��:e'���=@��ߺ����hŇl4X.�&�-pI�孨�#.��"���f�P� |��>�c��(z��QO��]{|�|Z���1<0k�h��A�nyC2��q�{�Z���LN*���p�XO=N@�b����0�#4R�]���?Q��y�缌�Q�a8���P:����B�)��r��ҭ�J8�4djm[��-��m*ϹZK����w���#s�Ȟ���z{�1�n�t]^�Vx��~�t� )��$z�c�����4�"����4}��CzW=7�7>���!�'+����?�?#ч��Y���qw�p'�_��I9�m��a�$�&Ą:�X�ppá�ȏw�4�gn�t"�Ε��cv��<3zڭ�ПJP������^ۛ���(��-��"a}&c4l���2 �sk�)0'@=�q\Z�P3��g�E��xڝ����k���B�r:�e>L���z���jUWt�O��R֞��]��+��^���O� wzTq)�C c�S��X�|ɡ����;kǤ��b�wF9Ĵ���)B�M}�� ��W��|+�ү�u�St��2������ 6`'\Y�M*�N��UF#,�g��Pm9vy����ͼ�װʦ��I���6a�LEc��O���+������Cc��^�������Ki���$�y�cw��:��y��Ͱ��V�c���"��~�o��~�a�����v�%�Ί�ʡw�W RQCcT���m����Zx� ng@�a�B���1���z�W��(_"w�T=�'��#���ޢ�`�u��D��E�+��M�"SD�SDB�:j�u��)%��D� ����H��Ç������r�?�a�A�6�bBX,V�w@eD�D\���y�K�A��t/�W�W|�9S���g�x���e�Eܪf������%~hU|��������^ẖ�*��U2��9'~Llɵ�k�s�+�~�0�Z��_���;��RJU���qx��I�<>��<�w [��T���.�➰�>(��p�Q|#o������<$w���������67�kȱx$lӡ1gv�f�>���ΐ̷pW!(Q� OKM"0�_/�{s�M �b����V�ҁ�+S8���/�XI���N`��i]�*x��ͻ��Q��a�������09Y��N�{V���;�x����I^��K+(�����j�H��3�>����"������_q�f���[�t�n��Je���Zq�dupDr��t.X��╁������/��� ����b����ھ�)d��ӣ��B���ܢ8��Y,�&����4�K�4n�ԪJ�r�[4��(j��$E|�a&-����8�?<�n%=��M���O�;b�!�z�G�}cv[��bmtl�����h�������囈 �'HE�E���TY&Af�O߽���?�;��������0Z�>R@Ίs�b�J9���$;�?e�����3�nPN{�]5/�V隹*���<���Byۨ|��\��ޞ2�����0��F�l��0"�4�' (0���(�: ���Ā�fl��S\�CބO�5�h nO�H7�`����g�-��xr���>�O"1.�?c��/�8���V�����^�c���I7\�0n����OszB�c���R�6��{=QT�+l`�G�+�K�mn�P��֭ ����gM���Kr�_r�����z[�+hr�,��'�W��w/����)��@ �/���� ܳ�UY�֍���Zev��nJ�.Q�z9G�@1-ݝ-9a϶���֥��Zц�6�M5�[dz��[E�b-k'�K�hE�)��_������V���+uy��aU�*���u�,����s@ڡ�/���$��P8IZ�=�����Y�r�0� �NK �9�07o���̰����5 �D&N&�G�\�D{�^g��hݔQ����`d�O ���d���BB-s] ��Ge�;7�G�}�� ����T��� N�.\�o�J�4f���M���T� X�#A]b20*Ž~�YgZB�DR��m�b���'���h�����!���{��{���[Q����@���7������UՃ�!B���q[��'�U�?���S���>+�DSzK�]�f����g�%�Z.]��~�8�jl}�oj�=��5���>�F@&1�zkKZ�:�5�f�l�eMr�t�4����� �bd�F )l���w@/���b #'Q@s���t{]��z�H_r��%dv���'#���p��d�aNt����cz6��a�`< $�)O�ʟ����Z�<|�E�������Ƣ�����ٷ]�A]ۉ����_u��\)����4D���`4@!q��-r"8��H�ġ�o=�e��P���v��{2Q?a��݇+�㌐W�j�����)��=t�:.K��� M���υO�Qj����C�T^9��8��h���(GmrM ��o����y�.����Oƥ�}�"L�_|�Z0��璘����u�E#뛵�CZ%��*���qް2�`�^���� �n=��]�a�v���~�t���-ehkK���70�����8Y�fзc���TI��b��8�N��`�)=ݰK!�Ui�Ŀ�g:k�z.�����IW��3:�~��֖�Y�,�)[T'L�Σb(p%oV�� O��m�x�3��~��lW�r�|��Sv8IPF���|���E{K� ����F��0�{��K�|y[�h<2l]��~ 3T瀬�S��,���$� �v�7��"Ƒ���Jvx&��Z�G�'\Y�s��6�
Static task
static1
Behavioral task
behavioral1
Sample
SpyNote.exe
Resource
win7-20240708-de
Behavioral task
behavioral2
Sample
SpyNote.exe
Resource
win10v2004-20240709-de
General
-
Target
SpyNote.exe
-
Size
6.7MB
-
MD5
d9265f1d01fe8cfde1b241886e834a8c
-
SHA1
a5f29b1c2a6f981c246976de1ba7e053841aa562
-
SHA256
53f32f6ed5e1fbd5f5a29f83ab0eebc385f693824544fa4664242c91c7d9f1bf
-
SHA512
59fc93e2ba15e8c901216dd2108ddfc3f1b7fa954ba0cc903d684aa4a2353b295c7e5c9f8f20e744de743cff436fee5fd0e96ba1f156a0a681a275f20af85e6b
-
SSDEEP
196608:2dHPY7vsZ+oa4DuuyrMi8VKe+PMfw7k2c4PAVv1sUpr:+vfZ+IaLM9we+P2myds
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SpyNote.exe
Files
-
SpyNote.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 1.4MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 20.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
SpyNote Size: 5.1MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE