Skip to content

S0305 SpyNote RAT

SpyNote RAT (Remote Access Trojan) is a family of malicious Android apps. The SpyNote RAT builder tool can be used to develop malicious apps with the malware’s functionality. 1

Item Value
ID S0305
Associated Names
Version 1.2
Created 25 October 2017
Last Modified 24 October 2022
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
mobile T1429 Audio Capture SpyNote RAT can activate the victim’s microphone.1
mobile T1533 Data from Local System SpyNote RAT can copy files from the device to the C2 server.1
mobile T1624 Event Triggered Execution -
mobile T1624.001 Broadcast Receivers SpyNote RAT uses an Android broadcast receiver to automatically start when the device boots.1
mobile T1430 Location Tracking SpyNote RAT collects the device’s location.1
mobile T1636 Protected User Data -
mobile T1636.003 Contact List SpyNote RAT can view contacts.1
mobile T1636.004 SMS Messages SpyNote RAT can read SMS messages.1