spynote | 71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Sharing

Copy URL Twitter E-mail

General

Target
SpyNote_v6.4.rar
Size 22.0MB
Sample260708-vmpwqaes9x
SHA256 71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f
MD5 84325e47432141d8440127bce6b974d0
SHA1 3ffa30171e6d57af803b6fae0f8b35559bc45274
SHA512 701f3573be8634d5a10d72935be0ae9a1929804e1f16634bc3ed104c1e863df14456a5b7ffb62a0c7612db506017ad672ed447ee6bd2dbf81af88caf840ae03e
SSDEEP 393216:KTkHSGrRzx7bynxYnMHcBNvUqvvDY4gXX9w+ijU0UkL20tzPt/OGtgwGIR46mrn:KQHSqomnM8BNvnNga+KU0zp//RxmL
TLSH
T1FB3733E6D3B0A2D9D35A6D72108A0800F9F76F1E9B03743DEEC1BACFA575E821768514
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

spynote

[SPY_NOTE_HOST_OK]:[SPY_NOTE_PORT_OK]

Targets

- Target
  SpyNote_v6.4.rar
- Size 22.0MB
- SHA256 71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f
- MD5 84325e47432141d8440127bce6b974d0
- SHA1 3ffa30171e6d57af803b6fae0f8b35559bc45274
- SHA512 701f3573be8634d5a10d72935be0ae9a1929804e1f16634bc3ed104c1e863df14456a5b7ffb62a0c7612db506017ad672ed447ee6bd2dbf81af88caf840ae03e
- SSDEEP 393216:KTkHSGrRzx7bynxYnMHcBNvUqvvDY4gXX9w+ijU0UkL20tzPt/OGtgwGIR46mrn:KQHSqomnM8BNvnNga+KU0zp//RxmL
- TLSH
  T1FB3733E6D3B0A2D9D35A6D72108A0800F9F76F1E9B03743DEEC1BACFA575E821768514
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  SpyNote_v6.4/Resources/Icons/window/win/23.ico
- Size 4KB
- SHA256 e21c3e110c2a972d4ba293ebdabedc7914e4573d53a4c6b450534e6912ea0cd1
- MD5 32c80d34c3582a2d19e0f4ba7fd80301
- SHA1 7b33b51efabdd5a09302b3fa808810e911935812
- SHA512 2824b13f6c7fffbb4a9b7643cd5992161918f8f7eeaf642fdb56d35e2c820eca6c4bde5a92194953df75ce35075184dcbc53e0a13427da3e68e8ec31d77c7a2d
- SSDEEP 24:sulTl86JijqAhbHCskqsFo/09p++3obYe8n7b2WeKmf7:/CbrhbS3i/kpYbYe2TeKa7
- TLSH
  T18D9167A57912C316F6703270DB3ADEF12D522C9AD200A69321E4FEBD7F7B0444D6298D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral2
- Target
  SpyNote_v6.4/Resources/Icons/window/win/24.ico
- Size 4KB
- SHA256 c7ded9a7915a57b121ccb8bab33aac983bca3aee3e87f65ab380b2650e14eb94
- MD5 92fe0d607da578ad6acebc7b0b104ce0
- SHA1 a2aa8ed3aa1383546edcceb9e2924b218f74d9f9
- SHA512 02a155b65ffb6766a564d2ed8c57659242dc1de28f3562bc07f4c98b3807d74cd15fb94da5e0d3411355afead6fb79640d36a69d71e2e1a3441ac0fdc492124f
- SSDEEP 48:+lNFaqp1hp4t/wHBvVqlbwdfsiEzeMe4wmGM7:Oaqp10eJ+w3EW4YC
- TLSH
  T183912146BE40C201F174BA34CFB6C2F06622BCA8CE460A177092FF7E7CB21611DA498D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  SpyNote_v6.4/Resources/Icons/window/win/25.ico
- Size 4KB
- SHA256 e573b4cba1eaed901ea34e41e236fd85eb8826e9267ffe948a45da354a5e625f
- MD5 abdfcee258ee9866dd058c6451df120e
- SHA1 2c6f1f0faf3bc7cf232ae28541b0fb93909c25b2
- SHA512 d4db4399c1ce436ff632e9a634aa1b6ba43b97ad7026ee8f6487a178f7f6431320e4404f6281372cb058a3ec08da0ff6b2726f556bb072392c4bad52a143c0de
- SSDEEP 12:suZFlKkccHckqc/QcEWc0mck2cUGcEWc06wAWlOcU0w6Dck9TL0lfRFcSiDyb2R5:suZRt8k/JoYI4o7+Uh6g3lwMCv
- TLSH
  T1F29148187292CA12FAB83639CF75C5F011167C49ED46930732A4FFBE3EBA5914D5060E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral4
- Target
  SpyNote_v6.4/Resources/Icons/window/win/26.ico
- Size 21KB
- SHA256 cd3313502fd472d158b429d27f085e13310bb935ab37f8079af79a7552e0bbf9
- MD5 90193c76cef7cf9c5375c9d8dfca342e
- SHA1 368c1c3576e034c5861b85704480972c9ad5380e
- SHA512 6a9e4f6bd6462a38238b869a86061490b621fe890746bce528b6de8a36f700bf47dd27d8aa554b527bd3a4e07477148da88ff2f765d3eb0e50e1d567eb32ab7c
- SSDEEP 24:5NIfptiLfawaatttttttt1111ttttNNN+waatttttttt1111ttttNNN4:OiLc
- TLSH
  T111A2D3A5E916E345F2B471B0CF3CCAFBA9984D82D647594311A6FEBA33BD5012E9420C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral5
- Target
  SpyNote_v6.4/Resources/Icons/window/win/3.ico
- Size 4KB
- SHA256 55b0b7dfa1890def760a5b25a39fd3efcb343a12fcc737657712fb12734fa857
- MD5 fa8c59f79b9ed6deccf1a09c303b5d49
- SHA1 0942ee1e810382f1b977137dffe12c33bfe65cfd
- SHA512 4d8c8abd806b112fe9b6dcd14ab515b4755fd1cc0d18928c0f8f747fbabe186ace4570d079980d6caacc1cdf3eda87de681b15f454255a4dbfcdaaa90158c24d
- SSDEEP 24:sul8WBunOerGick1X0yjbUfGCZ8detGNy:OOYG2myvn8GNy
- TLSH
  T1A79185917A1BC626F174B53CCBB6D2F928167C91CA188573B089FFBEB8374421D2168C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral6
- Target
  SpyNote_v6.4/Resources/Icons/window/win/4.ico
- Size 4KB
- SHA256 00ee618d234af45badb48a6e8551cf0864adcbc3422c127f5b3505f68e124d59
- MD5 4f232b1f2d3bf0d3d8ce809da2a43650
- SHA1 bfe8479193ac2fc956fd8f6e23ed475e394151c2
- SHA512 a3588c09b68ff623f5002884346a2fe7056769a8c966385e2118bd44be13774f7cfe0b41a222919b54d47d92d222537165164dbb66268f0811a391590928abb3
- SSDEEP 24:su4w48+kPxAkq5rDk/PFRGdbNR/MLR1ki+KNlcInqWlNa:mAADk/DGdXKRaTSlNnq8I
- TLSH
  T1249120607B60DA24F5B97A78CBB2C6F05228BD61ED11162331C1FF7E3E765904E059AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  SpyNote_v6.4/Resources/Icons/window/win/5.ico
- Size 4KB
- SHA256 5817cec3776cc7ce961a167b28977d660150f45e0df4461ae03884683ed086db
- MD5 4b2178c58995a8fc08bb972736c97ad8
- SHA1 dad4396bf54876efd1ba07ffb064316a73dc1187
- SHA512 d9c911293fcaf4a67fd6ef4431a08ac79970e563be4a169fa720b75061ba2433a62e9499a4588c288efa9e4b0626c5b5327bbe34a056c6dad6e46df07bfee7ea
- SSDEEP 24:suXBthg1LE0qCKCBsgK9laO7GdEsCp+H+wJ4cYlFlrtdJufVy+Fc:bg1OCzBu9l1wEf+/J4TdvKTc
- TLSH
  T12F9110A57025DA9AF434BA34CFBAD1F10224BC90CA05054BB18CFF3E7A72472AE2154C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral8
- Target
  SpyNote_v6.4/Resources/Icons/window/win/6.ico
- Size 4KB
- SHA256 e5fa92f374f87275b603d3fcf2ee78f2a0bc1a7ba58d01008632037e74fe01c3
- MD5 5223af56a032242b1e25b1dea6fe19ec
- SHA1 a1c92811ed1bbc98f2c534527ae02b67a8a0b72e
- SHA512 c7cd82247f56f2d3053bf11402945d47e5426382a82c382f90ec7210db13ffb3caf93cac962218d3106b1fa15202f2e682bd248fccb311ace03c9a7266b1b30e
- SSDEEP 12:sug4t8CdBmJn7HQJQuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuQtuW:suF8WBunufi58d9q
- TLSH
  T159910781B529E61AF138753CCFB6D2FA18917C55D9544963B1C8FFBFBA7A8010C2164C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral9
- Target
  SpyNote_v6.4/Resources/Icons/window/win/7.ico
- Size 4KB
- SHA256 8cf6af3b6dcd0af7445597fba5da56fdae17e7229261e4391dd793e342790ccf
- MD5 31f2f47f7a22f9af93076d0705fbbeb1
- SHA1 6ff7712ad53e5d3f106c56fd052af2ced03d72f1
- SHA512 dbe28720fa6f3eb9f963cb22dc81b80e4573959c99872f4bb8c855f90ec6044aef27e7cdd358f1842d902455ad5eed673cc064f494fc8ad8af2f3de201ed03ea
- SSDEEP 24:su3/mmmmmmmmmmmmwxgdlYYYjNlcTRQommmm3ccccm8a:uYCL
- TLSH
  T1F79115657256C61AF036B63AEBB9C8F020116C4ADD494A4372A1FF7B383C5030F99B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10
- Target
  SpyNote_v6.4/Resources/Icons/window/win/8.ico
- Size 4KB
- SHA256 9bc6afe3a5327bb8f4ddb77d02c814d75d7cd6401993746572641ead2f584a15
- MD5 2abd27826d44e207ce7cbd23d297b4f5
- SHA1 21a82152471725ddf8bb187fac31f5a2a3ebcc1f
- SHA512 89d05a4bc91b1cd454b34ca93a68921a410cba7b021b589c2df406484ebbcfb35bff350a6d048e9cd9b428e5be7aed14d22d186add9fc9ca5af0b63875e7a386
- SSDEEP 24:suKOtB+OWqd9x9RL+xL+RL+w/S+xPP6BCbWqMlPlU:70k7EklS1XU
- TLSH
  T10E9160997A3AE641F3393171CF76D3F10262AD20FE1281037645FF3D38324624E9925A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral11
- Target
  SpyNote_v6.4/Resources/Icons/window/win/9.ico
- Size 4KB
- SHA256 7a30d9bb74288b3dca09985a509e4efd98ad8c251072b2b4ac115cc1d7d0b310
- MD5 65bccadc7e66ecb2f247af01c1039093
- SHA1 48d6957184a67103884e0cd3dcea78fbeda5535b
- SHA512 d3d0b44cbf78667c48033049aa30c85544549e4479eacbac20345d7af3a8251e34cb54663373ecabb5775ad014dee9bbeb648992c269e1240d0e6d78cbec6065
- SSDEEP 24:suWmmWaCp8kpEVU/61s5eiGFtBNlPae29bzabi7K6NvZ1Y8c8eCd0mmlUUUWbSUp:IeHEVUcs5eltB4ii7V4PBn2Na
- TLSH
  T1F69188293AA5D656F574BA39DBB2C6F022207C60DA02431332C0FF7F3C762944E00A5E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral12
- Target
  SpyNote_v6.4/Resources/Icons/window/ww0.png
- Size 187B
- SHA256 c8fee4e99115028441734696270a700ec56a602d612fb2528e10945387bc5397
- MD5 2f2c5b4574f2cfaaacf22aeb197ff2dd
- SHA1 3981a01b532f701a22f0a971c8815a3196db8413
- SHA512 eaafa272a2249b147c001a86a8c4cc885db46a61a1cf190193079990dba070600ccbe72cdf313373aa2c5d74f0003b2b0224ece3da1d184e585571135f4cdf78
- TLSH
  T1C6C0C0E51500EC3FCE5E0DB300834F44C4C304B42F176C1A80AFD8BD18BAE270290254
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13
- Target
  SpyNote_v6.4/Resources/Icons/window/ww1.png
- Size 207B
- SHA256 1037295f1aff6d47a2905462ac99d010733d93e646056ca2b308ec68cfe6049c
- MD5 3a2c1688457ff51f93a4bec647081a63
- SHA1 1b151bc669118612748160868fa4a47528c47b77
- SHA512 9c0482ae892337eee6d6ea49e8a489b77412b86a1d762f5f120f128e8ce05d9b81b518fd964db9b141d3faa5ea9908cad044dcbb060e33b8b88a21364558571a
- TLSH
  T1C0D023DA6440BD3EC55E19B340134A59C8D7441416137450D01FE46D6DE2D1F1354501
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral14
- Target
  SpyNote_v6.4/Resources/Icons/window/ww2.png
- Size 306B
- SHA256 e156ea2cc08aa86e75c3ee088d2823b0aa88f03efc28d277baa063de0f6a18ef
- MD5 1b80d51c7f22dc74fea4a6946e1ae9fd
- SHA1 8fb4030547a6283a00fc05f4f9fe6b1e684bd0c0
- SHA512 e7224bab8707062d01dcd737bba1c8cab3c52463c0fcedf51e87e4f6532954659ce305484698a73118ec81c9392707a4cef82f005fdca6c2f047269d94e6ebe8
- TLSH
  T1F0E07DD81A80586EC6DACEC3E1D714195193007807D338884B9FF13F2846A425B65714
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15
- Target
  SpyNote_v6.4/Resources/Imports/GeoIP/GeoIP.dat
- Size 1.1MB
- SHA256 681ede512fe7ac21e976c754bfc1e1a75a9e02c3d931ce6849cfaa9d4080338a
- MD5 2fbec46d430f57befcde85b86c68b36e
- SHA1 3ff9829e3242deb69a7fde0832b7d9345b925afc
- SHA512 42036af6f57e446fec194ce71fa634dee9f4c77342f64a867fca8730d76349190960a7e7a5967ea59c250ca1b220d4845b4911dd63ee870f5620d9eb513b91d6
- SSDEEP 24576:3nHFtqj0+DZBNJvOL1h5NsVOQu7MgAsrmPQbdclxkghoIes:3ltqjRDZZehvsVOQu7MgOPkKSghks
- TLSH
  T1E1457B22FF9A56DB68A03A1EBE109DDC0864DDBAFD0B0739225C37AC50B8371DDC6156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral16
- Target
  SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll
- Size 5KB
- SHA256 61b0ca29ce7a62932699f33c272fd6d3731a1430ac3455b7a240b01ae461370f
- MD5 c4ceacedf5310a761b828bed9f7dbc62
- SHA1 f2c4c23d1c04df3899bc0a1e1812eca8f421fbb1
- SHA512 58c42d60a28c6e344060242e77cc841ba1a892cb8b9d5dae02c8f9b2e4c1deeebb599e6a1c401a3c585eb44c28d9c72b2ee56be273169af1d52850e426a1da32
- SSDEEP 96:Vuyz+/KPV+gzlmtrLPfdHOzHFu90rdjF:5z+m9ELPfdHH90H
- TLSH
  T1D5C1520673AC033BD86A4772FD63D2F05271EB786B524B7E1AC4830BAC5359009B2B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  SpyNote_v6.4/Resources/Imports/OBU.inf
- Size 532B
- SHA256 0e65512580c0bfc396d2136e8986074c0738e1a3d62c29868bdcfb71ed95e99c
- MD5 eea9f16ae9c1fc464ff9b4f27cffc955
- SHA1 8387e8d2457f915fd33d2bc8bc73f600896abf69
- SHA512 545fbf639d00b225c1cc08c0eaaa620572a332f3bf3130a19541e599d54593f463256212cf00a12f997a5c268e829e97d2a5d2b262d15a6d80316dcd0a77774f
- TLSH
  T1C8F0BEC729D28B834BCB1CBFF8FD4190B86F300D3B81E7F175A69811350640C46AB059
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral18
- Target
  SpyNote_v6.4/Resources/Imports/Payload/SL.exe
- Size 1.5MB
- SHA256 ebabf22b419f6a4b1fde570999f5871fb4f0552f4a97629f6ebf02edd33b8a2b
- MD5 f6a422a88819ddbea39c40a28fbdd307
- SHA1 710fdbbd3d6f273bdc05bf4c3a0146b0142ad71e
- SHA512 42c6f6e92d0c3ec764017c69e1c52ced65944b45782b72ce586d4203acbbf39affb267a16314c30ec146cb8710c0e151c3db2a851100b8cf7bbcf800dbde3051
- SSDEEP 768:rKSAOfhZXvSzjWKDIp93ZZwpZpTQdBHiF7QHsIMd3uDxZuFs+mg:9rfhZXvSzjWb5wz16S7l9eDxZuv
- TLSH
  T196756FC432948216F5BE27F885A0B12F0F7CBD57D50ED35E5A8CB8B92972770BA03546
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  SpyNote_v6.4/Resources/Imports/Payload/apktool.ascii
- Size 497B
- SHA256 b156d008588369e24bb4cedcb3275aff62b9038694f56e3f7edf29dbdfb9ad68
- MD5 a0cde0df4dc177d58256487a8a9a3974
- SHA1 39506e7dd3e0f753671a5c8437a8a520bba0eef6
- SHA512 0ea76f10d4e01414efa18144a1f28202c0cdfcf9b099e8f3e46c40ffc3635194f9ee3227d263718c9c317c8218a3c30868cea65b4742c59ad3a051231e2c7012
- TLSH
  T1FDF002E120120000887232FB3843F2AEBED2110FCA0A48F0BF8C40ABCB3E4CA08200C1
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral20
- Target
  SpyNote_v6.4/Resources/Imports/Payload/apktool.zip
- Size 8.6MB
- SHA256 3910604a99275579f07313caee2b3f04915999245a40772eeb942088d60c410b
- MD5 604ab3c9829f3f9f89c11cb39ee444db
- SHA1 b2bac6f9d3dd9837ae8f593e63706280c2be945d
- SHA512 5de6594071f9e711c578081c8b3a175b3b36ce25e5577b724b41f0388ec24e1f575f6a63cb455593109575d78ea921443e29cc64564573dfce9482b2d3dc8831
- SSDEEP 196608:DddtxPFyJqinxYndWH1yBEPF4vUqvvDYIObO5gB:D7bynxYnMHcBNvUqvvDY4gB
- TLSH
  T1359633DB30B8178023A05CA0E9CEA1A4EF84BB35D4061E1AADE4FF5935F63DC695F161
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  SpyNote_v6.4/Resources/Imports/Payload/s.inf
- Size 145B
- SHA256 49726a556a1da2a0fec110053d430818dcb233b673dcfc0749dc89ad1ae63f4c
- MD5 32feac3b537ce626be700f57ac123cb3
- SHA1 500a01617bb216e572dc313168348a9dc2ee7c2c
- SHA512 bb922ba7461bf04aabdbcc840163e9b33cbb1bdf57de442d223a648c66eb54c69b12c8e390cb9d4027f62108b2c0a40527c6a50ce77ff60bd6ed4dab4fbdf68f
- TLSH
  T16FC02B87D771C4AF10FDC35B40D25C0C1B7508069911F1410DC008C9F28DA0C7343901
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral22
- Target
  SpyNote_v6.4/Resources/Imports/Payload/stub.apk
- Size 730KB
- SHA256 7b20a276931c8625b39ebc46017c7e4d4a7bdf319b9f451231d777b078b0cd6a
- MD5 0c0290abde03555f3c66c81eba860a3d
- SHA1 939a8e6d0ed4bd8c9f491405ecf069df7bddb7cc
- SHA512 441922d41856ec246d1cb29e3b290b62b2d3bc4ca54f896af1df72263e67a320f1b3b85f4d5bd129fa32b4633a1b9f74a63783791f1ea1cb1ca97a8a26b8ea48
- SSDEEP 12288:CJc+EIBvAvcKIth8eGz3zaR9QHqd8gmw+/goe13VvqX:CJc+EIO0K4KeGTzaR+imz/goeHvqX
- TLSH
  T198F4AE86E789B433CAB7C03647B6CBAB51964C584B46D7131995B23C4DBBBC08E85FC8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23
- Target
  SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar
- Size 3KB
- SHA256 e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed
- MD5 d9c23d7574c0d886321dcd029e463f2c
- SHA1 7fad47eb6860a01325c6d526a43d9bbadb66aff7
- SHA512 c32c019fb0bacbd70441cf3ed769bfde9597389f840ff8511db36586756382ef22bd163a7b7cb9e258a4b7a896e5d1a606d92513a141cb2e3c6e421a66ecb316
- TLSH
  T113712E2BF82411EFE104D17DB2314BF3212EE031ABE9C111ED9D6E062E8B8D9AE45741
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral24
- Target
  SpyNote_v6.4/Resources/Imports/T/sS.exe
- Size 20KB
- SHA256 60cb176777a21fa10359afff9d48766ee84d50d7d2f06a5047fe84106fe07626
- MD5 90c145d34b8ac338e099f062bf5d86c0
- SHA1 d8518776439fd67f9e4d1b5441a96b5cb783d2b1
- SHA512 07694ca2c05b3c8932ddc17920dfd05e58e1f435b468f5f896a4dc0d0c5688fb1217140515a497fe8a10a1cb30b135fd9ac928125f7602218b1588e7a9363a73
- SSDEEP 384:sOaTt8CNVFW6qh/M+z/QunGLS9tLEO2a0R72t465i:stTBVzqO+z9SZRSt465i
- TLSH
  T11E923B2523A4D336C8BD97BA5CA3E50007F2D212D613EF2D6DDC646A0C57F208386BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  SpyNote_v6.4/Resources/Imports/Xml/Settings/SpyNote.xml
- Size 604B
- SHA256 016313f74908139de529dbe575548c1cbd38e5937e7942cb3349c653df97a589
- MD5 debfa0f2fd4ba17909c44a2189382545
- SHA1 373272fb81f24f31adba85544d3f10197cab2271
- SHA512 071a5c1188250a52dee0fb8256150a3e2378acf4fce784b9269cbe620b0cc954b9c1d32d4205174bf09d1dd5f2efab1f93440900b603fd590ca3c46129103155
- TLSH
  T1A9F0F929B0C4EAE10478A1782A339644DEB2E09FCD851880BCD184832FF1C4563B3A63
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral26
- Target
  SpyNote_v6.4/Resources/Imports/opt.inf
- Size 95B
- SHA256 b0e6c24d35a9154cf1e40a6fcf0bb2439fe4b32a0481f6b05a52e30890f1523e
- MD5 1f5511a315fe6684177eebcf8ebde04a
- SHA1 83c296d3aec584d0845b047331a83a8ffb018b43
- SHA512 497dbe6c9af2c5a9d4f379b848ef12e4dc6a5cbd7f1f2ef0c90c1bfd21932204909c4deda74734c476e7a39de10dcf437e296f7a640980c04b3ed11bb2bf3d57
- TLSH
  T1B6B0127EA30C010283CE943B64221C00955886CB5CC323D40040183D375345C1FC24A4
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral27
- Target
  SpyNote_v6.4/Resources/Imports/platform-tools/pack.inf
- Size 25B
- SHA256 5ceea525f72494712db428e1000b85ec8c2293220e6e2521d1a408366588e5f2
- MD5 39648b2075367fca4364481763172e00
- SHA1 e609773cc13cf484048332d9fe6f79675fb6a2ec
- SHA512 ec73d8980460cf5bef0fa53960eb305147ace2f747e9887869ddc3d9b38ec876b67f6c93a2c8e00eb669987c445d49547a59180e8816009d52be3c011e0b0ae3
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral28
- Target
  SpyNote_v6.4/Resources/Imports/platform-tools/platform-tools-windows.zip
- Size 4.5MB
- SHA256 880662adfb0d6911ff250b9e13930ae1a4110fc36d5866afd4f8f56d935f7939
- MD5 a934403443bd4bf7225212fb09ceb810
- SHA1 11505582e66ef81730cc5150a7566a3ca5c677b7
- SHA512 19b059aab3cb6fce95269a1650730d1f4b7940c4e62d1c8c925ff5be7bc175cee9409c58ef12a53c849bcd900ce50acc8a1a8f399b6e2383c61dcbe89b45738d
- SSDEEP 98304:4FlDXAs1REk7r+lA93evJ+vqkGU0b7P3Mdtb3Z/yW2A3qKxp:4/XDjB7yBJ+ijU0bTsbJqW227
- TLSH
  T1C1262374C3B2F7C5D7199A3222856900B4F36F0B3B4368AFAED166D7F53D1806A36618
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe
- Size 23KB
- SHA256 4a30fcc8f1e39ebd9f9085c792a0b73c2cf95f1e2af22b69576c5ad208f39159
- MD5 624ce101b693a1bf4523207ceb67ac3e
- SHA1 db438de8104db8c080eec4eb7ac317c48ee3c479
- SHA512 cce751ef22b30c51b11ec3fa2198e7366361a5d5f1b382c48e807fd256259318a98209b5f7b1e3afea37af475530f0f36f49265348187d76dda2024e2d11c6f9
- SSDEEP 384:+WEULAwolvM7nEUaRR2LyGcBEYLcfQTVKh+JmU6/nd5eff4x4AQIft:+3ULAwxnEUab2LyDCMc/o6/d5efs4Ar
- TLSH
  T1AEB22A6517E4C236C4BD1BF558B2B11003B1E69AC91BEA9E49CCD49E1F73B008BE1B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  SpyNote_v6.4/Resources/Imports/terminal/tr.inf
- Size 746B
- SHA256 bc6692b0c50771aadc3da38bdf2eaacbdf1d74313c93235b20a4f36f4b8bbc9f
- MD5 0320c62304ec42e1ac04aa05bd3829a1
- SHA1 2d795b5cb50dfc04b2cb3677ff05b3cfa839df4c
- SHA512 79a17c1422333b918a62e8fe8e7de94054373deaf37594a9e076c8d9d5f2c9d934bf5c93a506bb5f3da4e00387ac71ad076ac40f4fe19c55f54509f273e9909c
- TLSH
  T1C501CB298A42E2707471A9D3E2002F62CB2489295FC32B1535AE70A4F12E3A19761837
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral31
- Target
  SpyNote_v6.4/SpyNote.exe
- Size 6.7MB
- SHA256 53f32f6ed5e1fbd5f5a29f83ab0eebc385f693824544fa4664242c91c7d9f1bf
- MD5 d9265f1d01fe8cfde1b241886e834a8c
- SHA1 a5f29b1c2a6f981c246976de1ba7e053841aa562
- SHA512 59fc93e2ba15e8c901216dd2108ddfc3f1b7fa954ba0cc903d684aa4a2353b295c7e5c9f8f20e744de743cff436fee5fd0e96ba1f156a0a681a275f20af85e6b
- SSDEEP 196608:2dHPY7vsZ+oa4DuuyrMi8VKe+PMfw7k2c4PAVv1sUpr:+vfZ+IaLM9we+P2myds
- TLSH
  T1C466333B3B2F5518D0C430FE8DB6F6B70D21DE82108B291E62E93C4B7936B09855A7D6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32