SpyNote 6.4.7z
- SHA256 3c4de323a791ec49930fe03a4fcb4fba86f5000625b9fc9c024160f59285426f
Overview
overview
10Static
static
10SpyNote 6....pi.dll
windows10-2004-x64
1SpyNote 6....pi.dll
windows11-ltsc_2024-x64
1SpyNote 6....SM.dll
windows10-2004-x64
1SpyNote 6....SM.dll
windows11-ltsc_2024-x64
1SpyNote 6....SL.exe
windows10-2004-x64
1SpyNote 6....SL.exe
windows11-ltsc_2024-x64
1SpyNote 6....ub.apk
android-9-x86
SpyNote 6....ub.apk
android-10-x64
SpyNote 6....ub.apk
android-11-x64
SpyNote 6....va.jar
windows10-2004-x64
1SpyNote 6....va.jar
windows11-ltsc_2024-x64
1SpyNote 6....sS.exe
windows10-2004-x64
1SpyNote 6....sS.exe
windows11-ltsc_2024-x64
1SpyNote 6....in.exe
windows10-2004-x64
1SpyNote 6....in.exe
windows11-ltsc_2024-x64
1SpyNote 6....ed.exe
windows10-2004-x64
3SpyNote 6....ed.exe
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
SpyNote 6.4/CoreAudioApi.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
SpyNote 6.4/CoreAudioApi.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
SpyNote 6.4/Resources/Imports/Gsm/GSM.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
SpyNote 6.4/Resources/Imports/Gsm/GSM.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
SpyNote 6.4/Resources/Imports/Payload/SL.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
SpyNote 6.4/Resources/Imports/Payload/SL.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
SpyNote 6.4/Resources/Imports/Payload/stub.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral8
Sample
SpyNote 6.4/Resources/Imports/Payload/stub.apk
Resource
android-x64-20260325-en
Behavioral task
behavioral9
Sample
SpyNote 6.4/Resources/Imports/Payload/stub.apk
Resource
android-x64-arm64-20260325-en
Behavioral task
behavioral10
Sample
SpyNote 6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Resource
win10v2004-20260911-en
Behavioral task
behavioral11
Sample
SpyNote 6.4/Resources/Imports/PlayerJava/PlayerJava.jar
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral12
Sample
SpyNote 6.4/Resources/Imports/T/sS.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral13
Sample
SpyNote 6.4/Resources/Imports/T/sS.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral14
Sample
SpyNote 6.4/Resources/Imports/platform-tools/plwin.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral15
Sample
SpyNote 6.4/Resources/Imports/platform-tools/plwin.exe
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral16
Sample
SpyNote 6.4/SpyNote Cracked.exe
Resource
win10v2004-20260911-en
Behavioral task
behavioral17
Sample
SpyNote 6.4/SpyNote Cracked.exe
Resource
win11ltsc2024-20260911-en
spynote
[SPY_NOTE_HOST_OK]:[SPY_NOTE_PORT_OK]
Spynote is a Remote Access Trojan first seen in 2017.
| resource | yara_rule |
|---|---|
| static1/unpack001/SpyNote 6.4/Resources/Imports/Payload/stub.apk | family_spynote |
| description | ioc |
|---|---|
| Required by device admin receivers to bind with the system. Allows apps to manage device administration features. | android.permission.BIND_DEVICE_ADMIN |
| description | ioc |
|---|---|
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE |
| description | ioc |
|---|---|
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to read from external storage. | android.permission.READ_EXTERNAL_STORAGE |
| Allows an application to write and read the user's call log data. | android.permission.WRITE_CALL_LOG |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to write to external storage. | android.permission.WRITE_EXTERNAL_STORAGE |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows access to the list of accounts in the Accounts Service. | android.permission.GET_ACCOUNTS |
| Allows an application to write the user's contacts data. | android.permission.WRITE_CONTACTS |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to read SMS messages. | android.permission.READ_SMS |
| Allows an application to read the user's call log. | android.permission.READ_CALL_LOG |
| Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. | android.permission.READ_PHONE_STATE |
| Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. | android.permission.CALL_PHONE |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an application to receive SMS messages. | android.permission.RECEIVE_SMS |
| Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. | android.permission.PROCESS_OUTGOING_CALLS |
Checks for missing JAR codesign signature.
| resource |
|---|
| unpack001/SpyNote 6.4/Resources/Imports/PlayerJava/PlayerJava.jar |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/SpyNote 6.4/CoreAudioApi.dll |
| unpack001/SpyNote 6.4/Resources/Imports/Gsm/GSM.dll |
| unpack001/SpyNote 6.4/Resources/Imports/Payload/SL.exe |
| unpack001/SpyNote 6.4/Resources/Imports/T/sS.exe |
| unpack001/SpyNote 6.4/Resources/Imports/platform-tools/plwin.exe |
| unpack001/SpyNote 6.4/SpyNote Cracked.exe |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/SpyNote 6.4/Resources/Imports/Payload/stub.apk |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Spynote payload
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Unsigned JAR
Checks for missing JAR codesign signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.