General

  • Target

    SpyNote-V7.3.1.zip

  • Size

    132.8MB

  • Sample

    250207-r6fklswner

  • MD5

    e4f1d7f911262ec816ca98cfeb6126d3

  • SHA1

    8dbcea8c9ccccc3a002bd9262ee5bad8920f6167

  • SHA256

    fa0cfe8274608f23cef8c819fb121d55c4750e28f484ebdb37d57878c665aa5d

  • SHA512

    fb147f4d03e1a6d54a649dd214c2d9c1acb495de66092dd205da119cff0492c647783bfb80ce19f0d86452fefb68b64569617ba9b7a6592c36bef59cd134fc59

  • SSDEEP

    3145728:CInrJgElMeW/ZL170hS15nrJgEUsanBG9XI2qiKLz4:CSFp25/d1hlFpUNBz2qPLk

Malware Config

Targets

    • Target

      SpyNote-V7.3.1.zip

    • Size

      132.8MB

    • MD5

      e4f1d7f911262ec816ca98cfeb6126d3

    • SHA1

      8dbcea8c9ccccc3a002bd9262ee5bad8920f6167

    • SHA256

      fa0cfe8274608f23cef8c819fb121d55c4750e28f484ebdb37d57878c665aa5d

    • SHA512

      fb147f4d03e1a6d54a649dd214c2d9c1acb495de66092dd205da119cff0492c647783bfb80ce19f0d86452fefb68b64569617ba9b7a6592c36bef59cd134fc59

    • SSDEEP

      3145728:CInrJgElMeW/ZL170hS15nrJgEUsanBG9XI2qiKLz4:CSFp25/d1hlFpUNBz2qPLk

    Score
    1/10
    • Target

      SpyNote.exe

    • Size

      18.0MB

    • MD5

      c7152ddbcc572cb128faac3f3f14c4a9

    • SHA1

      81b171172351f23704f90a99e11205797417ac22

    • SHA256

      840339ba069bebbb433857b24a7db2e508a6d6b01572a4c5c330ef056104c5e0

    • SHA512

      3647a69d64aec4b3abb449c5d8a2267d55b6ae9679198a92e6aa32e5dacd9a7df6d4004fa3a441fc4dc1a2401820dd34ed95d95e549364b2cd9efa1b99b14929

    • SSDEEP

      393216:lFEYdxoJxB6kYVI5DK2NNs6LtYdEhSp4RR7XIK0j:lFJxMBh0q+MVtYSIK0

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks