SpyNote_v6.4.rar
- SHA256 71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f
Overview
overview
10Static
static
10SpyNote_v6.4.rar
android-15-x64
SpyNote_v6.../c.wav
android-15-x64
SpyNote_v6.../v.wav
android-15-x64
SpyNote_v6...nt.png
android-15-x64
SpyNote_v6...il.png
android-15-x64
SpyNote_v6...nt.png
android-15-x64
SpyNote_v6...ts.png
android-15-x64
SpyNote_v6...nt.png
android-15-x64
SpyNote_v6...er.png
android-15-x64
SpyNote_v6...le.png
android-15-x64
SpyNote_v6...er.png
android-15-x64
SpyNote_v6...in.png
android-15-x64
SpyNote_v6...pp.png
android-15-x64
SpyNote_v6...er.png
android-15-x64
SpyNote_v6...us.png
android-15-x64
SpyNote_v6...es.png
android-15-x64
SpyNote_v6...ns.png
android-15-x64
SpyNote_v6...rs.png
android-15-x64
SpyNote_v6...th.png
android-15-x64
SpyNote_v6...ps.png
android-15-x64
SpyNote_v6...ta.png
android-15-x64
SpyNote_v6...al.png
android-15-x64
SpyNote_v6...nt.png
android-15-x64
SpyNote_v6...te.png
android-15-x64
SpyNote_v6...ed.png
android-15-x64
SpyNote_v6...ed.png
android-15-x64
SpyNote_v6...st.png
android-15-x64
SpyNote_v6...se.png
android-15-x64
SpyNote_v6...ue.png
android-15-x64
SpyNote_v6...se.png
android-15-x64
SpyNote_v6...ue.png
android-15-x64
SpyNote_v6...se.png
android-15-x64
Behavioral task
behavioral1
Sample
SpyNote_v6.4.rar
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral2
Sample
SpyNote_v6.4/Resources/Audio/c.wav
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral3
Sample
SpyNote_v6.4/Resources/Audio/v.wav
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral4
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/account.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral5
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.android.email.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral6
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.bbm.account.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral7
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.bbm.contacts.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral8
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.dropbox.android.account.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral9
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.facebook.messenger.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral10
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.google.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral11
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.sec.android.app.sns3.twitter.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral12
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.twitter.android.auth.login.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral13
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/com.whatsapp.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral14
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/org.telegram.messenger.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral15
Sample
SpyNote_v6.4/Resources/Icons/AccountManager/org.telegram.plus.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral16
Sample
SpyNote_v6.4/Resources/Icons/AppProperties/Activities.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral17
Sample
SpyNote_v6.4/Resources/Icons/AppProperties/Permissions.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral18
Sample
SpyNote_v6.4/Resources/Icons/AppProperties/Receivers.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral19
Sample
SpyNote_v6.4/Resources/Icons/Bar/bluetooth.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral20
Sample
SpyNote_v6.4/Resources/Icons/Bar/gps.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral21
Sample
SpyNote_v6.4/Resources/Icons/Bar/mobile_data.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral22
Sample
SpyNote_v6.4/Resources/Icons/Bar/normal.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral23
Sample
SpyNote_v6.4/Resources/Icons/Bar/silent.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral24
Sample
SpyNote_v6.4/Resources/Icons/Bar/vibrate.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral25
Sample
SpyNote_v6.4/Resources/Icons/Bar/wifi_connected.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral26
Sample
SpyNote_v6.4/Resources/Icons/Bar/wifi_disconnected.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral27
Sample
SpyNote_v6.4/Resources/Icons/Bar/wifi_rest.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral28
Sample
SpyNote_v6.4/Resources/Icons/Battery/b0false.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral29
Sample
SpyNote_v6.4/Resources/Icons/Battery/b0true.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral30
Sample
SpyNote_v6.4/Resources/Icons/Battery/b100false.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral31
Sample
SpyNote_v6.4/Resources/Icons/Battery/b100true.png
Resource
android-35-x64-arm64-20260325-en
Behavioral task
behavioral32
Sample
SpyNote_v6.4/Resources/Icons/Battery/b10false.png
Resource
android-35-x64-arm64-20260325-en
spynote
[SPY_NOTE_HOST_OK]:[SPY_NOTE_PORT_OK]
Spynote is a Remote Access Trojan first seen in 2017.
| resource | yara_rule |
|---|---|
| static1/unpack001/SpyNote_v6.4/Resources/Imports/Payload/stub.apk | family_spynote |
| description | ioc |
|---|---|
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN |
| description | ioc |
|---|---|
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE |
| description | ioc |
|---|---|
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
| Allows an application to write and read the user's call log data. | android.permission.WRITE_CALL_LOG |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to read SMS messages. | android.permission.READ_SMS |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS |
| Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. | android.permission.PROCESS_OUTGOING_CALLS |
Checks for missing JAR codesign signature.
| resource |
|---|
| unpack001/SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/SpyNote_v6.4/CoreAudioApi.dll |
| unpack001/SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll |
| unpack001/SpyNote_v6.4/Resources/Imports/Payload/SL.exe |
| unpack001/SpyNote_v6.4/Resources/Imports/T/sS.exe |
| unpack003/platform-tools/AdbWinApi.dll |
| unpack003/platform-tools/AdbWinUsbApi.dll |
| unpack003/platform-tools/adb.exe |
| unpack003/platform-tools/dmtracedump.exe |
| unpack003/platform-tools/etc1tool.exe |
| unpack003/platform-tools/fastboot.exe |
| unpack003/platform-tools/hprof-conv.exe |
| unpack003/platform-tools/libwinpthread-1.dll |
| unpack003/platform-tools/make_f2fs.exe |
| unpack003/platform-tools/mke2fs.exe |
| unpack003/platform-tools/sqlite3.exe |
| unpack001/SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe |
| unpack001/SpyNote_v6.4/SpyNote.exe |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/SpyNote_v6.4/Resources/Imports/Payload/stub.apk |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Spynote payload
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Unsigned JAR
Checks for missing JAR codesign signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=116, id=1, productName=Unmarked objects,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=57, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=1, productName=Unmarked objects,
count=17, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=73, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=40, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.