General
-
Target
SpyNote-V7.3.1.zip
-
Size
132.8MB
-
Sample
250207-r6fklswner
-
MD5
e4f1d7f911262ec816ca98cfeb6126d3
-
SHA1
8dbcea8c9ccccc3a002bd9262ee5bad8920f6167
-
SHA256
fa0cfe8274608f23cef8c819fb121d55c4750e28f484ebdb37d57878c665aa5d
-
SHA512
fb147f4d03e1a6d54a649dd214c2d9c1acb495de66092dd205da119cff0492c647783bfb80ce19f0d86452fefb68b64569617ba9b7a6592c36bef59cd134fc59
-
SSDEEP
3145728:CInrJgElMeW/ZL170hS15nrJgEUsanBG9XI2qiKLz4:CSFp25/d1hlFpUNBz2qPLk
Behavioral task
behavioral1
Sample
SpyNote-V7.3.1.zip
Resource
win10v2004-20250129-en
Behavioral task
behavioral2
Sample
SpyNote-V7.3.1.zip
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral3
Sample
SpyNote-V7.3.1.zip
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
SpyNote.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
SpyNote.exe
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral6
Sample
SpyNote.exe
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
SpyNote-V7.3.1.zip
-
Size
132.8MB
-
MD5
e4f1d7f911262ec816ca98cfeb6126d3
-
SHA1
8dbcea8c9ccccc3a002bd9262ee5bad8920f6167
-
SHA256
fa0cfe8274608f23cef8c819fb121d55c4750e28f484ebdb37d57878c665aa5d
-
SHA512
fb147f4d03e1a6d54a649dd214c2d9c1acb495de66092dd205da119cff0492c647783bfb80ce19f0d86452fefb68b64569617ba9b7a6592c36bef59cd134fc59
-
SSDEEP
3145728:CInrJgElMeW/ZL170hS15nrJgEUsanBG9XI2qiKLz4:CSFp25/d1hlFpUNBz2qPLk
Score1/10 -
-
-
Target
SpyNote.exe
-
Size
18.0MB
-
MD5
c7152ddbcc572cb128faac3f3f14c4a9
-
SHA1
81b171172351f23704f90a99e11205797417ac22
-
SHA256
840339ba069bebbb433857b24a7db2e508a6d6b01572a4c5c330ef056104c5e0
-
SHA512
3647a69d64aec4b3abb449c5d8a2267d55b6ae9679198a92e6aa32e5dacd9a7df6d4004fa3a441fc4dc1a2401820dd34ed95d95e549364b2cd9efa1b99b14929
-
SSDEEP
393216:lFEYdxoJxB6kYVI5DK2NNs6LtYdEhSp4RR7XIK0j:lFJxMBh0q+MVtYSIK0
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-