S0305 SpyNote RAT
SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware’s functionality. 1
| Item | Value |
|---|---|
| ID | S0305 |
| Associated Names | |
| Type | MALWARE |
| Version | 1.2 |
| Created | 25 October 2017 |
| Last Modified | 10 October 2019 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| mobile | T1432 | Access Contact List | SpyNote RAT can view contacts.1 |
| mobile | T1402 | Broadcast Receivers | SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots.1 |
| mobile | T1429 | Capture Audio | SpyNote RAT can activate the victim’s microphone.1 |
| mobile | T1412 | Capture SMS Messages | SpyNote RAT can read SMS messages.1 |
| mobile | T1533 | Data from Local System | SpyNote RAT can copy files from the device to the C2 server.1 |
| mobile | T1430 | Location Tracking | SpyNote RAT collects the device’s location.1 |