Extracted

• • Target
    SpyNote_v6.4.rar
  • Size 22.0MB
  • SHA256 71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f
  • MD5 84325e47432141d8440127bce6b974d0
  • SHA1 3ffa30171e6d57af803b6fae0f8b35559bc45274
  • SHA512 701f3573be8634d5a10d72935be0ae9a1929804e1f16634bc3ed104c1e863df14456a5b7ffb62a0c7612db506017ad672ed447ee6bd2dbf81af88caf840ae03e
  • SSDEEP 393216:KTkHSGrRzx7bynxYnMHcBNvUqvvDY4gXX9w+ijU0UkL20tzPt/OGtgwGIR46mrn:KQHSqomnM8BNvnNga+KU0zp//RxmL
  • TLSH
    T1FB3733E6D3B0A2D9D35A6D72108A0800F9F76F1E9B03743DEEC1BACFA575E821768514
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    SpyNote_v6.4/Resources/Audio/c.wav
  • Size 375KB
  • SHA256 d987b1f46ec60ec58bc3ebf2d70ce42de12fea78bcc37ffd970c309e42f1271b
  • MD5 33eb69a9e1bf6f67a1a691315c66350e
  • SHA1 78e8b35ab8f0f039e4291c8caa692afcef89b2fc
  • SHA512 429699cac56e30902f5b4ece04d52394b8248e28e7f60f53f9ccbb48a6e68008c61156e9f84afe18f1744199631c5581d5c20139284dba3fca54f11b46c397ae
  • SSDEEP 6144:svn5z8VvTt4eKHOs5FBXS+g+quyBUwdNTNes0IyriEc8s:K5zkvTt4e3YBX0VzUQTNesmriF
  • TLSH
    T153840183C163075036AA86266FC55C982D84F65C7E611E3F265DDE1AF3A3340B2F27B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    SpyNote_v6.4/Resources/Audio/v.wav
  • Size 440KB
  • SHA256 b6c3c2795b5aac2ef9da3c764de04274ef6b921995ef863407cd6a109f8c6c94
  • MD5 b3b0b07868623b958972d154689751e7
  • SHA1 6bb86ad085854dfd556435868f198a6bcf48e091
  • SHA512 2d34cf757ff6967e503f02a016593eaa26ec55fecf11c257847f9db295aef91efea0a11d7012d2f401ae4cb72d02f1a150c53cf9a029b73ba8917303bcf17e86
  • SSDEEP 12288:7geh254EdeaurKg1d91oubUPqhahKx2Urs:7geh2546O1dTxAhqC
  • TLSH
    T164A40163D1678B58166266924FC14C412D88F49DFD692D3F368ECE24F343350B3A9BBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/account.png
  • Size 329B
  • SHA256 2d522164e403478e178483dfd9d1f31ba2e8e8e9056f967aa626308e39aa6bd0
  • MD5 37b34268c25a9bf7ebf61dd220382f5f
  • SHA1 f25c0432b755392606dc73dca390d370c124d684
  • SHA512 2d511116f3c1a945d4288362bb799f03e1e863193233ef02d6ae06652aeb6904f0c12cfea8a17fb0a0cc1defca4482b8824edde53201d8f4ef3711ed182a7ca4
  • TLSH
    T1A3E0C0CD0A01152F4A2A271755425DA85DB2248016B794CC9C5DAC185842C213089A90
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral7behavioral8
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.android.email.png
  • Size 438B
  • SHA256 6e68465a4c4e86f84517a3b230510e4d5d2f163744cd592c55da8a89b0c866f5
  • MD5 1fc4abe2f26276c04b55591bd0a584c3
  • SHA1 ebb9061b3c6dcd341e8f6dcdf1e786eb6ba78086
  • SHA512 7f48ddaae370d87e6e83cd4d0d21972c2a56f23d4d08fa773dd2093f5e653c24240471486c157c91abc4901fe97d61f3fc7c3dba30176592e659c2bcd4d781fb
  • TLSH
    T1D5F0DCF90A0F153BD7166D9F005A8928E07156A4ABA20284914E90FF0920C058022545
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.bbm.account.png
  • Size 433B
  • SHA256 35bbb89ec6aceeaf456c11e00ffcc8b9b08a642f22ba136b2e16ae49a2ca4767
  • MD5 5343892a5aebba75ad7485437151a5da
  • SHA1 9af94cc2d5e577d2920e9ac00cef9eb3e8e4cabc
  • SHA512 6252e1cc4bc5ed5666dc4d141cdda89fb953310a64687837f2e7c2a27dcc524e6ced953bd47ef175def7cbde08e0fd44bb17bc3252f4073116244d85c8f489a3
  • TLSH
    T100E023CAC3D05C6E8B171C30414B9460CD0B8E83374330CA8D6DB8EDA908D4F7650680
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral11behavioral12
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.bbm.contacts.png
  • Size 433B
  • SHA256 35bbb89ec6aceeaf456c11e00ffcc8b9b08a642f22ba136b2e16ae49a2ca4767
  • MD5 5343892a5aebba75ad7485437151a5da
  • SHA1 9af94cc2d5e577d2920e9ac00cef9eb3e8e4cabc
  • SHA512 6252e1cc4bc5ed5666dc4d141cdda89fb953310a64687837f2e7c2a27dcc524e6ced953bd47ef175def7cbde08e0fd44bb17bc3252f4073116244d85c8f489a3
  • TLSH
    T100E023CAC3D05C6E8B171C30414B9460CD0B8E83374330CA8D6DB8EDA908D4F7650680
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.dropbox.android.account.png
  • Size 505B
  • SHA256 a013f12f38f6be308711e29790a7fb0c6cb7c059d3574ddd775aa0b4e2db8607
  • MD5 4e06aedb09dc5726a8f14126effb08af
  • SHA1 9c3f540ac4dcfc47423117e8e898a59597be7861
  • SHA512 377551566c38cbb04b038bf1ba78bfcb2f36abcdd2b33157115524b9fbff9f78a7bb3b00b6ef4fad461587e37913ee0f8aeed4a1523115bcc1890f4edac8fcef
  • TLSH
    T1E8F00EDEA39C852F0A0F187B02836276956ACEF0E71330094E1B95AA5E23B7EE084640
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral15behavioral16
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.facebook.messenger.png
  • Size 463B
  • SHA256 38d2cdff888a68fa4928ada746db2588e76127447aca16bead6e03d940d9d266
  • MD5 a3e44e927afbbcafd1ccba0df328341b
  • SHA1 faf7d85a72f770c87238b360edde11fdd51cc094
  • SHA512 0669a8a8b67a3997c8fa1b2fbbb137c7b24acd45a10cbc802116d6694fb7f91b8ce0e611cdd7fe43f1333b59c3c21a4f0f2df7e09d5940dc8715ca0d3435c0c1
  • TLSH
    T1CDF0D498091DDD3ECFA8464221958DE5A21775315E071055A9D6EB174C40D0C9FD6D19
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.google.png
  • Size 731B
  • SHA256 9c93e054668c0f1702dde013f1c662a67a2927dcf159dd430ac900ce8ed18bcd
  • MD5 a9167f9901e0bfe4f4d3696cb894d7f2
  • SHA1 0b13479b62046c479e431217414bb964893a50ff
  • SHA512 b0b44613f5fbce760082ad22827e1217bb01c87903c9e8cf77dcd09b039580c0d72f7197abe102ae7b330b687528f46cde4e8bbd58b1df166bb5ab025aa7550e
  • TLSH
    T11A0165897324D47ACD5902670B33E89D208793E182274D52259FD4CD24A210991E052E
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral19behavioral20
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.sec.android.app.sns3.twitter.png
  • Size 391B
  • SHA256 b22a3b32746acf7e778308f4a894c95151bd4c8d728cbb4180bbc025c543663d
  • MD5 911fa3fe86e280e9594b17d1c49cabfe
  • SHA1 c4aa3f022aae5a487aa7373751170a39940684c6
  • SHA512 73dddacf96290355f1267093eaf4a48272a451f18cbf12422440ab518b5b8c5b70b40bac9f16574503b2b1492adb40cbe536693b0d371482b81cc0cd28822c8e
  • TLSH
    T1AFE0F1F15B41752EC13F0973892709654753082B47DF155CE459DC2C8502F006361211
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.twitter.android.auth.login.png
  • Size 391B
  • SHA256 b22a3b32746acf7e778308f4a894c95151bd4c8d728cbb4180bbc025c543663d
  • MD5 911fa3fe86e280e9594b17d1c49cabfe
  • SHA1 c4aa3f022aae5a487aa7373751170a39940684c6
  • SHA512 73dddacf96290355f1267093eaf4a48272a451f18cbf12422440ab518b5b8c5b70b40bac9f16574503b2b1492adb40cbe536693b0d371482b81cc0cd28822c8e
  • TLSH
    T1AFE0F1F15B41752EC13F0973892709654753082B47DF155CE459DC2C8502F006361211
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/com.whatsapp.png
  • Size 895B
  • SHA256 d0e60e17eb46f9cff30ab4ef170ba90b4b9b77b4eeb48ba476611347d6421f25
  • MD5 dcf45df26e2ceadf027dc3cab1a44b84
  • SHA1 1ce3a8918eb0985fce080123a68be4910f336089
  • SHA512 0dce259571b57ee348b5c62b5576386373af192a664e3c570b39fad35b32d51969631f201efbff253623eb9bf5c9b50f6ace9ddcc968f7954ef48fc3eb60223c
  • TLSH
    T18811B7DF82844977DFAEB0792103D328529B874C0993D0E15AD5514FE435E0A6390858
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/org.telegram.messenger.png
  • Size 377B
  • SHA256 6913959595d510db620cfead0d1240c6415082dc5c5405a573c8410033d6d2ef
  • MD5 7501198ae01a5ddb14d6bcca6cb8063a
  • SHA1 585632c16aa67bab1bf7a37ec73c788d14b17c22
  • SHA512 0fb4377b21bca7b13eb7fed082f6c9c4bee7a792100574631a3a8233fb9e06999bde53b659efdeb5a778ece1828c253de43563df3358ff8fa2254dd4bab7070f
  • TLSH
    T11AE068CE16606E37C4086B16C62F190AD1FFEA60DA371859509AA828A9C2E8382CD208
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral27behavioral28
• • Target
    SpyNote_v6.4/Resources/Icons/AccountManager/org.telegram.plus.png
  • Size 377B
  • SHA256 6913959595d510db620cfead0d1240c6415082dc5c5405a573c8410033d6d2ef
  • MD5 7501198ae01a5ddb14d6bcca6cb8063a
  • SHA1 585632c16aa67bab1bf7a37ec73c788d14b17c22
  • SHA512 0fb4377b21bca7b13eb7fed082f6c9c4bee7a792100574631a3a8233fb9e06999bde53b659efdeb5a778ece1828c253de43563df3358ff8fa2254dd4bab7070f
  • TLSH
    T11AE068CE16606E37C4086B16C62F190AD1FFEA60DA371859509AA828A9C2E8382CD208
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    SpyNote_v6.4/Resources/Icons/AppProperties/Activities.png
  • Size 336B
  • SHA256 7849aeae0621d68f0120a4ee284f43a063e68830ae27d6b16152a424b4f05cb6
  • MD5 82f0dff489c3e89dcedce30a83dc8ff7
  • SHA1 a5fbaad521f39a895e443543e93f3593f5fe6fca
  • SHA512 eeb2a8de3f546863739f676054d66a5acaec53079afcdbba0200fc2593ef8971f7fb922044d291a190f681d40bbb73c67d17db77fe17a0b8b8b656ee4bd97a7c
  • TLSH
    T163E02DE722906AFF4D19AAA2022B090CC9FB4DC30F031AC45838F4393D83D0609C3281
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral31behavioral32