SpyNote RAT
SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware's functionality. [1]
ID: S0305
ⓘ
Type: MALWARE
ⓘ
Platforms: Android
Version: 1.2
Created: 25 October 2017
Last Modified: 25 April 2025
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Mobile | T1429 | Audio Capture |
SpyNote RAT can activate the victim's microphone.[1] |
|
| Mobile | T1533 | Data from Local System |
SpyNote RAT can copy files from the device to the C2 server.[1] |
|
| Mobile | T1624 | .001 | Event Triggered Execution: Broadcast Receivers |
SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots.[1] |
| Mobile | T1430 | Location Tracking |
SpyNote RAT collects the device's location.[1] |
|
| Mobile | T1636 | .003 | Protected User Data: Contact List |
SpyNote RAT can view contacts.[1] |
| .004 | Protected User Data: SMS Messages |
SpyNote RAT can read SMS messages.[1] |
||