Skip to content

S0305 SpyNote RAT

SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware’s functionality. 1

Item Value
ID S0305
Associated Names
Version 1.2
Created 25 October 2017
Last Modified 10 October 2019
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
mobile T1432 Access Contact List SpyNote RAT can view contacts.1
mobile T1402 Broadcast Receivers SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots.1
mobile T1429 Capture Audio SpyNote RAT can activate the victim’s microphone.1
mobile T1412 Capture SMS Messages SpyNote RAT can read SMS messages.1
mobile T1533 Data from Local System SpyNote RAT can copy files from the device to the C2 server.1
mobile T1430 Location Tracking SpyNote RAT collects the device’s location.1


Back to top