[TheMinister]

Hello guys!
i was searching for spynote program in this moment i found someone uploaded new github for spynote :
https://github.com/githuob/SpyNote-v6.5-Cracket-2020

i did upload it to virus total and before that i searched by the hash there is no record so this is new exe  :
https://www.virustotal.com/gui/file/ea6f.../detection

waiting for more defusing if  its backdoored, waiting for pro checkers and more info !

[Drako]

I would run the program in Sandboxie until there's some sort of definitive result. It's normal for RAT programs to show up with false positives in VirusTotal due to the nature of the tool.

Edit - I got this result when I scanned the extracted executable, https://www.virustotal.com/gui/file/a4e3.../detection

[miso]

Actual application download is under the report

Code:

Extracted Files: |- AndroidTester_v6.4.6.exe | Virustotal Scan [25/67]: https://www.virustotal.com/gui/file/920c573c792a062d5902474c5162f5583ada7547403f282c15eb45327a444e71/detection |- Ixgwtrib | WinSFX | Virustotal Scan [22/71]: https://www.virustotal.com/gui/file/d25280b7531acdde876249c783181b25730109aac274ad6f247e822e2f7c831a/detection |- 2.zip |- Resources (folder, too much content to list, only PE Files are listed) |- Imports |- Gsm |- GSM.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/61b0ca29ce7a62932699f33c272fd6d3731a1430ac3455b7a240b01ae461370f/detection |- platform-tools |- platform-tools-windows.zip | Contains PE-Files | Virustotal Scan [0/63]: https://www.virustotal.com/gui/file/880662adfb0d6911ff250b9e13930ae1a4110fc36d5866afd4f8f56d935f7939/detection |- plwin.exe | Virustotal Scan [6/71]: https://www.virustotal.com/gui/file/268fa687554273029bf87668367b4084d4928de6b2a4cf4fbcd52e944d0efe16/detection |- PlayerJava |- PlayerJava.jar | Virustotal Scan [0/61]: https://www.virustotal.com/gui/file/e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed/detection |- T (added "(Suspicious)" to folder name, remove it if the application actually needs it) |- sS.exe | Virustotal Scan [8/67]: https://www.virustotal.com/gui/file/e3865e0d3f776a6827f4ddb640cc66c56ede8826a1f29383e3578b85caf248ef/detection |- Payload |- apktool.zip | Contains multiple .jar apps | Virustotal Scan [0/62]: https://www.virustotal.com/gui/file/46696979f33058b5975908d66484cdc59366a964f06821d6cfcc5e5024e0d8ee/detection |- buildclient.exe | Virustotal Scan [16/71]: https://www.virustotal.com/gui/file/f0de2235c7cb055bb66f3880d58022a53339619f38165229640467250ef8547b/detection |- Android Tester.exe | Virustotal Scan [5/66]: https://www.virustotal.com/gui/file/a9a477e7d95ab1066c55f9930ab1cb563dee40beef8ff33ef87e80fa2bda0b05/detection |- Android Tester.xml | Text-based file |- CoreAudioApi.dll | Virustotal Scan [0/66]: https://www.virustotal.com/gui/file/df6115987161ee1238f9564bd10c998d9016f582e5b7b9d23d21a74d6955bdd3/detection |- NAudio.dll | Virustotal [0/67]: https://www.virustotal.com/gui/file/3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c/detection |- Fkbtko (MpCmdRun.exe) | Virustotal Scan [28/67]: https://www.virustotal.com/gui/file/0819c7e5f08a4787468997284407a8907e9007af1f0898fff153bb2d434e103d/detection |- LG.dll | Gets keys & Foreground window - Backdoor | Virustotal Scan [12/65]: https://www.virustotal.com/gui/file/3b75e0d3d3b84b8e3ac3be62a6742dd21a9e2893b5027264b933384497924152/detection |- Mn.dll | Gets webcam, Video Processing Encoder & IP (also send CMD instructions) - Backdoor | Controlled via micromedia.sytes.net:56351 (404) | Virustotal Scan [6/56]: https://www.virustotal.com/gui/file/0443fd823919820157e8272ef00c1af90e45eabc3f81d2534a720311ee71dc3d/detection ### - MpCmdRun.exe - ### ### MD: CodeLang: C# Obfuscated: .NET Reactor 4.8 (decompiled via chara.NNR (NoNetReactor) | Thanks to Azmi) ### - AndroidTester_v6.4.6.exe - ### CodeLang: C# Obfuscated: .NET Reactor ?.? (decompiled via REZiriz) ### - LG.dll - ### CodeLang: C# Obfuscated: No ### - Mn.dll - ### CodeLang: C# Obfuscated: No ### - Android Tester.xml - ### ### Content: <?xml version="1.0"?> <doc> <assembly> <name> Android Tester </name> </assembly> <members> <member name="T:SpyNote_V6._4.My.Resources.Resources"> <summary> A strongly-typed resource class, for looking up localized strings, etc. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ResourceManager"> <summary> Returns the cached ResourceManager instance used by this class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Culture"> <summary> Overrides the current thread's CurrentUICulture property for all resource lookups using this strongly typed resource class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.aBitmap"> <summary> Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ANUN"> <summary> Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Circle"> <summary> Looks up a localized resource of type System.Drawing.Bitmap. </summary> </member> </members> </doc>

Download actual application

Spoiler:

Please run this under a VM or sandbox

Virustotal Scan [21/61]
Download (mega.nz)

[mothered]

Actual application download is under the report

Code:

Extracted Files: |- AndroidTester_v6.4.6.exe | Virustotal Scan [25/67]: https://www.virustotal.com/gui/file/920c573c792a062d5902474c5162f5583ada7547403f282c15eb45327a444e71/detection   |- Ixgwtrib | WinSFX | Virustotal Scan [22/71]: https://www.virustotal.com/gui/file/d25280b7531acdde876249c783181b25730109aac274ad6f247e822e2f7c831a/detection       |- 2.zip         |- Resources (folder, too much content to list, only PE Files are listed)             |- Imports               |- Gsm                   |- GSM.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/61b0ca29ce7a62932699f33c272fd6d3731a1430ac3455b7a240b01ae461370f/detection               |- platform-tools                   |- platform-tools-windows.zip | Contains PE-Files | Virustotal Scan [0/63]: https://www.virustotal.com/gui/file/880662adfb0d6911ff250b9e13930ae1a4110fc36d5866afd4f8f56d935f7939/detection                   |- plwin.exe | Virustotal Scan [6/71]: https://www.virustotal.com/gui/file/268fa687554273029bf87668367b4084d4928de6b2a4cf4fbcd52e944d0efe16/detection               |- PlayerJava                   |- PlayerJava.jar | Virustotal Scan [0/61]: https://www.virustotal.com/gui/file/e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed/detection               |- T (added "(Suspicious)" to folder name, remove it if the application actually needs it)                   |- sS.exe | Virustotal Scan [8/67]: https://www.virustotal.com/gui/file/e3865e0d3f776a6827f4ddb640cc66c56ede8826a1f29383e3578b85caf248ef/detection               |- Payload                   |- apktool.zip | Contains multiple .jar apps | Virustotal Scan [0/62]: https://www.virustotal.com/gui/file/46696979f33058b5975908d66484cdc59366a964f06821d6cfcc5e5024e0d8ee/detection                   |- buildclient.exe | Virustotal Scan [16/71]: https://www.virustotal.com/gui/file/f0de2235c7cb055bb66f3880d58022a53339619f38165229640467250ef8547b/detection         |- Android Tester.exe | Virustotal Scan [5/66]: https://www.virustotal.com/gui/file/a9a477e7d95ab1066c55f9930ab1cb563dee40beef8ff33ef87e80fa2bda0b05/detection         |- Android Tester.xml | Text-based file         |- CoreAudioApi.dll | Virustotal Scan [0/66]: https://www.virustotal.com/gui/file/df6115987161ee1238f9564bd10c998d9016f582e5b7b9d23d21a74d6955bdd3/detection         |- NAudio.dll | Virustotal [0/67]: https://www.virustotal.com/gui/file/3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c/detection   |- Fkbtko (MpCmdRun.exe) | Virustotal Scan [28/67]: https://www.virustotal.com/gui/file/0819c7e5f08a4787468997284407a8907e9007af1f0898fff153bb2d434e103d/detection   |- LG.dll | Gets keys & Foreground window - Backdoor | Virustotal Scan [12/65]: https://www.virustotal.com/gui/file/3b75e0d3d3b84b8e3ac3be62a6742dd21a9e2893b5027264b933384497924152/detection       |- Mn.dll | Gets webcam, Video Processing Encoder & IP (also send CMD instructions) - Backdoor | Controlled via micromedia.sytes.net:56351 (404) | Virustotal Scan [6/56]: https://www.virustotal.com/gui/file/0443fd823919820157e8272ef00c1af90e45eabc3f81d2534a720311ee71dc3d/detection ### - MpCmdRun.exe - ### ### MD: CodeLang: C# Obfuscated: .NET Reactor 4.8 (decompiled via chara.NNR (NoNetReactor) | Thanks to Azmi) ### - AndroidTester_v6.4.6.exe - ### CodeLang: C# Obfuscated: .NET Reactor ?.? (decompiled via REZiriz) ### - LG.dll - ### CodeLang: C# Obfuscated: No ### - Mn.dll - ### CodeLang: C# Obfuscated: No ### - Android Tester.xml - ### ### Content: <?xml version="1.0"?> <doc> <assembly> <name> Android Tester </name> </assembly> <members> <member name="T:SpyNote_V6._4.My.Resources.Resources"> <summary>   A strongly-typed resource class, for looking up localized strings, etc. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ResourceManager"> <summary>   Returns the cached ResourceManager instance used by this class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Culture"> <summary>   Overrides the current thread's CurrentUICulture property for all   resource lookups using this strongly typed resource class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.aBitmap"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ANUN"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Circle"> <summary>   Looks up a localized resource of type System.Drawing.Bitmap. </summary> </member> </members> </doc>

Download actual application

Spoiler:

Please run this under a VM or sandbox

Virustotal Scan [21/61]
Download (mega.nz)

The nature of the detections, don't seem to be consistent with malicious behavior but as you've mentioned, be sure to run It In a controlled environment.

[TheMinister]

I would run the program in Sandboxie until there's some sort of definitive result. It's normal for RAT programs to show up with false positives in VirusTotal due to the nature of the tool.

Edit - I got this result when I scanned the extracted executable, https://www.virustotal.com/gui/file/a4e3.../detection

thank you draaco for reply i am sorry i had internet problems i couldn't reply.

---

Actual application download is under the report

Code:

Extracted Files: |- AndroidTester_v6.4.6.exe | Virustotal Scan [25/67]: https://www.virustotal.com/gui/file/920c573c792a062d5902474c5162f5583ada7547403f282c15eb45327a444e71/detection   |- Ixgwtrib | WinSFX | Virustotal Scan [22/71]: https://www.virustotal.com/gui/file/d25280b7531acdde876249c783181b25730109aac274ad6f247e822e2f7c831a/detection       |- 2.zip         |- Resources (folder, too much content to list, only PE Files are listed)             |- Imports               |- Gsm                   |- GSM.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/61b0ca29ce7a62932699f33c272fd6d3731a1430ac3455b7a240b01ae461370f/detection               |- platform-tools                   |- platform-tools-windows.zip | Contains PE-Files | Virustotal Scan [0/63]: https://www.virustotal.com/gui/file/880662adfb0d6911ff250b9e13930ae1a4110fc36d5866afd4f8f56d935f7939/detection                   |- plwin.exe | Virustotal Scan [6/71]: https://www.virustotal.com/gui/file/268fa687554273029bf87668367b4084d4928de6b2a4cf4fbcd52e944d0efe16/detection               |- PlayerJava                   |- PlayerJava.jar | Virustotal Scan [0/61]: https://www.virustotal.com/gui/file/e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed/detection               |- T (added "(Suspicious)" to folder name, remove it if the application actually needs it)                   |- sS.exe | Virustotal Scan [8/67]: https://www.virustotal.com/gui/file/e3865e0d3f776a6827f4ddb640cc66c56ede8826a1f29383e3578b85caf248ef/detection               |- Payload                   |- apktool.zip | Contains multiple .jar apps | Virustotal Scan [0/62]: https://www.virustotal.com/gui/file/46696979f33058b5975908d66484cdc59366a964f06821d6cfcc5e5024e0d8ee/detection                   |- buildclient.exe | Virustotal Scan [16/71]: https://www.virustotal.com/gui/file/f0de2235c7cb055bb66f3880d58022a53339619f38165229640467250ef8547b/detection         |- Android Tester.exe | Virustotal Scan [5/66]: https://www.virustotal.com/gui/file/a9a477e7d95ab1066c55f9930ab1cb563dee40beef8ff33ef87e80fa2bda0b05/detection         |- Android Tester.xml | Text-based file         |- CoreAudioApi.dll | Virustotal Scan [0/66]: https://www.virustotal.com/gui/file/df6115987161ee1238f9564bd10c998d9016f582e5b7b9d23d21a74d6955bdd3/detection         |- NAudio.dll | Virustotal [0/67]: https://www.virustotal.com/gui/file/3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c/detection   |- Fkbtko (MpCmdRun.exe) | Virustotal Scan [28/67]: https://www.virustotal.com/gui/file/0819c7e5f08a4787468997284407a8907e9007af1f0898fff153bb2d434e103d/detection   |- LG.dll | Gets keys & Foreground window - Backdoor | Virustotal Scan [12/65]: https://www.virustotal.com/gui/file/3b75e0d3d3b84b8e3ac3be62a6742dd21a9e2893b5027264b933384497924152/detection       |- Mn.dll | Gets webcam, Video Processing Encoder & IP (also send CMD instructions) - Backdoor | Controlled via micromedia.sytes.net:56351 (404) | Virustotal Scan [6/56]: https://www.virustotal.com/gui/file/0443fd823919820157e8272ef00c1af90e45eabc3f81d2534a720311ee71dc3d/detection ### - MpCmdRun.exe - ### ### MD: CodeLang: C# Obfuscated: .NET Reactor 4.8 (decompiled via chara.NNR (NoNetReactor) | Thanks to Azmi) ### - AndroidTester_v6.4.6.exe - ### CodeLang: C# Obfuscated: .NET Reactor ?.? (decompiled via REZiriz) ### - LG.dll - ### CodeLang: C# Obfuscated: No ### - Mn.dll - ### CodeLang: C# Obfuscated: No ### - Android Tester.xml - ### ### Content: <?xml version="1.0"?> <doc> <assembly> <name> Android Tester </name> </assembly> <members> <member name="T:SpyNote_V6._4.My.Resources.Resources"> <summary>   A strongly-typed resource class, for looking up localized strings, etc. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ResourceManager"> <summary>   Returns the cached ResourceManager instance used by this class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Culture"> <summary>   Overrides the current thread's CurrentUICulture property for all   resource lookups using this strongly typed resource class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.aBitmap"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ANUN"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Circle"> <summary>   Looks up a localized resource of type System.Drawing.Bitmap. </summary> </member> </members> </doc>

Download actual application

Spoiler:

Please run this under a VM or sandbox

Virustotal Scan [21/61]
Download (mega.nz)

The nature of the detections, don't seem to be consistent with malicious behavior but as you've mentioned, be sure to run It In a controlled environment.

thank you mothered for reply i am sorry i had internet problems i couldn't reply, is there a kind of sandbox tool that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

[mothered]

thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named Buster Sandbox Analyzer does the job well.

You can read about It here.

[TheMinister]

thank you mothered for reply i am sorry i had internet problems i couldn't reply

All good, no problem whatsoever.

is there a kind of sandbox tool  that run the program and gives you a list of files and registry files that are Opened/excuted from the .exe like the behavior of virustotal example inside a sandbox ?

A tool named Buster Sandbox Analyzer does the job well.

You can read about It here.

i appreciate the info thank you very much.

---

so sad that the sanboxie program is not supported anymore !

[TheMinister]

Actual application download is under the report

Code:

Extracted Files: |- AndroidTester_v6.4.6.exe | Virustotal Scan [25/67]: https://www.virustotal.com/gui/file/920c573c792a062d5902474c5162f5583ada7547403f282c15eb45327a444e71/detection   |- Ixgwtrib | WinSFX | Virustotal Scan [22/71]: https://www.virustotal.com/gui/file/d25280b7531acdde876249c783181b25730109aac274ad6f247e822e2f7c831a/detection       |- 2.zip         |- Resources (folder, too much content to list, only PE Files are listed)             |- Imports               |- Gsm                   |- GSM.dll | Virustotal Scan [0/71]: https://www.virustotal.com/gui/file/61b0ca29ce7a62932699f33c272fd6d3731a1430ac3455b7a240b01ae461370f/detection               |- platform-tools                   |- platform-tools-windows.zip | Contains PE-Files | Virustotal Scan [0/63]: https://www.virustotal.com/gui/file/880662adfb0d6911ff250b9e13930ae1a4110fc36d5866afd4f8f56d935f7939/detection                   |- plwin.exe | Virustotal Scan [6/71]: https://www.virustotal.com/gui/file/268fa687554273029bf87668367b4084d4928de6b2a4cf4fbcd52e944d0efe16/detection               |- PlayerJava                   |- PlayerJava.jar | Virustotal Scan [0/61]: https://www.virustotal.com/gui/file/e22d8a06415f21b900a9a079a6a7928d6c84d2cf33aa07c6ad385dfbbfcd55ed/detection               |- T (added "(Suspicious)" to folder name, remove it if the application actually needs it)                   |- sS.exe | Virustotal Scan [8/67]: https://www.virustotal.com/gui/file/e3865e0d3f776a6827f4ddb640cc66c56ede8826a1f29383e3578b85caf248ef/detection               |- Payload                   |- apktool.zip | Contains multiple .jar apps | Virustotal Scan [0/62]: https://www.virustotal.com/gui/file/46696979f33058b5975908d66484cdc59366a964f06821d6cfcc5e5024e0d8ee/detection                   |- buildclient.exe | Virustotal Scan [16/71]: https://www.virustotal.com/gui/file/f0de2235c7cb055bb66f3880d58022a53339619f38165229640467250ef8547b/detection         |- Android Tester.exe | Virustotal Scan [5/66]: https://www.virustotal.com/gui/file/a9a477e7d95ab1066c55f9930ab1cb563dee40beef8ff33ef87e80fa2bda0b05/detection         |- Android Tester.xml | Text-based file         |- CoreAudioApi.dll | Virustotal Scan [0/66]: https://www.virustotal.com/gui/file/df6115987161ee1238f9564bd10c998d9016f582e5b7b9d23d21a74d6955bdd3/detection         |- NAudio.dll | Virustotal [0/67]: https://www.virustotal.com/gui/file/3ad5d09b4c8c3146d15955a564a9f1a57d7c795b189a25c6f722a738d95ef89c/detection   |- Fkbtko (MpCmdRun.exe) | Virustotal Scan [28/67]: https://www.virustotal.com/gui/file/0819c7e5f08a4787468997284407a8907e9007af1f0898fff153bb2d434e103d/detection   |- LG.dll | Gets keys & Foreground window - Backdoor | Virustotal Scan [12/65]: https://www.virustotal.com/gui/file/3b75e0d3d3b84b8e3ac3be62a6742dd21a9e2893b5027264b933384497924152/detection       |- Mn.dll | Gets webcam, Video Processing Encoder & IP (also send CMD instructions) - Backdoor | Controlled via micromedia.sytes.net:56351 (404) | Virustotal Scan [6/56]: https://www.virustotal.com/gui/file/0443fd823919820157e8272ef00c1af90e45eabc3f81d2534a720311ee71dc3d/detection ### - MpCmdRun.exe - ### ### MD: CodeLang: C# Obfuscated: .NET Reactor 4.8 (decompiled via chara.NNR (NoNetReactor) | Thanks to Azmi) ### - AndroidTester_v6.4.6.exe - ### CodeLang: C# Obfuscated: .NET Reactor ?.? (decompiled via REZiriz) ### - LG.dll - ### CodeLang: C# Obfuscated: No ### - Mn.dll - ### CodeLang: C# Obfuscated: No ### - Android Tester.xml - ### ### Content: <?xml version="1.0"?> <doc> <assembly> <name> Android Tester </name> </assembly> <members> <member name="T:SpyNote_V6._4.My.Resources.Resources"> <summary>   A strongly-typed resource class, for looking up localized strings, etc. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ResourceManager"> <summary>   Returns the cached ResourceManager instance used by this class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Culture"> <summary>   Overrides the current thread's CurrentUICulture property for all   resource lookups using this strongly typed resource class. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.aBitmap"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.ANUN"> <summary>   Looks up a localized resource of type System.Byte[]. </summary> </member> <member name="P:SpyNote_V6._4.My.Resources.Resources.Circle"> <summary>   Looks up a localized resource of type System.Drawing.Bitmap. </summary> </member> </members> </doc>

Download actual application

Spoiler:

Please run this under a VM or sandbox

Virustotal Scan [21/61]
Download (mega.nz)

thank you meso for the info !

[mothered]

i appreciate the info thank you very much.

You're most welcome.

When you have time, I'd be Interested to read how the tool performs.

[TheMinister]

i appreciate the info thank you very much.

You're most welcome.

When you have time, I'd be Interested to read how the tool performs.

ill notify you when i add the BSA and use it, i am currently focused on unity engine and same time learning c++