Overview
overview
3Static
static
3Spykee/lib...kee.pm
ubuntu-18.04-amd64
1Spykee/lib...kee.pm
debian-9-armhf
1Spykee/lib...kee.pm
debian-9-mips
1Spykee/lib...kee.pm
debian-9-mipsel
1Spykee/lib.../rules
ubuntu-18.04-amd64
1Spykee/lib.../rules
debian-9-armhf
1Spykee/lib.../rules
debian-9-mips
1Spykee/lib.../rules
debian-9-mipsel
1Spykee/lib...9/demo
ubuntu-18.04-amd64
1Spykee/lib...9/demo
debian-9-armhf
1Spykee/lib...9/demo
debian-9-mips
1Spykee/lib...9/demo
debian-9-mipsel
1libspykee-...kee.pm
ubuntu-18.04-amd64
1libspykee-...kee.pm
debian-9-armhf
1libspykee-...kee.pm
debian-9-mips
1libspykee-...kee.pm
debian-9-mipsel
1libspykee-.../rules
ubuntu-18.04-amd64
1libspykee-.../rules
debian-9-armhf
1libspykee-.../rules
debian-9-mips
1libspykee-.../rules
debian-9-mipsel
1libspykee-...9/demo
ubuntu-18.04-amd64
1libspykee-...9/demo
debian-9-armhf
1libspykee-...9/demo
debian-9-mips
1libspykee-...9/demo
debian-9-mipsel
1pyspykeewe...Web.py
windows10-2004-x64
3pyspykeewe...Web.py
windows11-21h2-x64
3pyspykeewe...col.py
windows10-2004-x64
3pyspykeewe...col.py
windows11-21h2-x64
3pyspykeewe...ol.pyc
windows10-2004-x64
3pyspykeewe...ol.pyc
windows11-21h2-x64
3Spykee/pys...Web.py
windows10-2004-x64
3Spykee/pys...Web.py
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
Spykee/libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
Spykee/libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
Spykee/libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
Spykee/libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral5
Sample
Spykee/libspykee-perl-0.0.20101009/debian/rules
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral6
Sample
Spykee/libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral7
Sample
Spykee/libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral8
Sample
Spykee/libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral9
Sample
Spykee/libspykee-perl-0.0.20101009/demo
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral10
Sample
Spykee/libspykee-perl-0.0.20101009/demo
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral11
Sample
Spykee/libspykee-perl-0.0.20101009/demo
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral12
Sample
Spykee/libspykee-perl-0.0.20101009/demo
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral13
Sample
libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral14
Sample
libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral15
Sample
libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral16
Sample
libspykee-perl-0.0.20101009/Robotics/Spykee.pm
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral17
Sample
libspykee-perl-0.0.20101009/debian/rules
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral18
Sample
libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral19
Sample
libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral20
Sample
libspykee-perl-0.0.20101009/debian/rules
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral21
Sample
libspykee-perl-0.0.20101009/demo
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral22
Sample
libspykee-perl-0.0.20101009/demo
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral23
Sample
libspykee-perl-0.0.20101009/demo
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral24
Sample
libspykee-perl-0.0.20101009/demo
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral25
Sample
pyspykeeweb/pySpykeeWeb.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
pyspykeeweb/pySpykeeWeb.py
Resource
win11-20260513-en
Behavioral task
behavioral27
Sample
pyspykeeweb/twistedprotocol.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
pyspykeeweb/twistedprotocol.py
Resource
win11-20260513-en
Behavioral task
behavioral29
Sample
pyspykeeweb/twistedprotocol.pyc
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
pyspykeeweb/twistedprotocol.pyc
Resource
win11-20260513-en
Behavioral task
behavioral31
Sample
Spykee/pyspykeeweb/pySpykeeWeb.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
Spykee/pyspykeeweb/pySpykeeWeb.py
Resource
win11-20260513-en
General
- Target Spykee/pyspykeeweb/pySpykeeWeb.py
- Size 7KB
- Sample260601-pgalysdt2p
- SHA256 3fab42c80c6a3af5668e00a09df67ae460bc11e47fb319d36db538757f3d0f54
- MD5 b46ce84a541b33bf0d888b9965d59f7d
- SHA1 75623b03526a204b720e3fd354c2ff337e71cc6f
- SHA512 c2131594c5e12df1a798d05bcc2aedbcdb931d11ff64047355cd483131a883dafaffd8abccf38b7311a24c6a15d79ec64343015aabfa87f13a828442c5458e07
- SSDEEP 192:bHyRZILfOdLdRFsmWmrLqCoI9tAPoiwWs3A7oRjM:bHyRZADjCo4ifj7oR4
- TLSH T13EE1C820D4579B76823388F9C5826507A62EA613735E2013B4BED37B1F71C7292F2ED8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2416 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Spykee\pyspykeeweb\pySpykeeWeb.py1⤵
- Modifies registry class
PID:4892
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2416