Register to stream ATT&CKcon 2.0 October 29-30

SpyNote RAT

SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware's functionality. [1]

ID: S0305
Type: MALWARE
Platforms: Android
Version: 1.1

Techniques Used

Domain ID Name Use
Mobile T1432 Access Contact List SpyNote RAT can view contacts. [1]
Mobile T1409 Access Sensitive Data or Credentials in Files SpyNote RAT can copy files from the device to the C2 server. [1]
Mobile T1402 App Auto-Start at Device Boot SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots. [1]
Mobile T1412 Capture SMS Messages SpyNote RAT can read SMS messages. [1]
Mobile T1430 Location Tracking SpyNote RAT collects the device's location. [1]
Mobile T1429 Microphone or Camera Recordings SpyNote RAT can activate the victim's microphone. [1]

References