S0305 SpyNote RAT
SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware’s functionality. 1
| Item | Value |
|---|---|
| ID | S0305 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.2 |
| Created | 25 October 2017 |
| Last Modified | 24 October 2022 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| mobile | T1429 | Audio Capture | SpyNote RAT can activate the victim’s microphone.1 |
| mobile | T1533 | Data from Local System | SpyNote RAT can copy files from the device to the C2 server.1 |
| mobile | T1624 | Event Triggered Execution | - |
| mobile | T1624.001 | Broadcast Receivers | SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots.1 |
| mobile | T1430 | Location Tracking | SpyNote RAT collects the device’s location.1 |
| mobile | T1636 | Protected User Data | - |
| mobile | T1636.003 | Contact List | SpyNote RAT can view contacts.1 |
| mobile | T1636.004 | SMS Messages | SpyNote RAT can read SMS messages.1 |