Thus far we have not observed SpyNote used in active attacks but we suspect cyber criminals will begin using it as the building of SpyNote is freely available. Side-loading apps from questionable sources exposes users and their mobile devices to a variety of malware and possible data loss. Installing apps from third-party sources can be very risky - those sources often lack the governance provided by official sources such as the Google Play Store, which, even with detailed procedures and algorithms to weed out malicious applications, is not impregnable. # _log : Prints out logs for debug purposes
#DROIDJACK ماهو APK#
The spynote.C2.py script (shown below) parses these values from the APK file and prints them to the command line (Figure 5).įrom import apkįrom import dvm We can now create an extractor for the C2 information using Androguard ( ) as shown below. The uploader might be following the instructions described in YouTube videos on using SpyNote, considering the port number used is exactly the same as in the videos () and the uploader only changes the icon of the APK file.įurthermore, this RAT has been configured to communicate to the command and control (C&C) IP address (141.255.147.193) over TCP port 2222 as shown in the image below.įigure 3 – Dalvik bytecode view using Cerbero profilerįigure 4 – SpyNote opening a socket connectionīased on the information we have already found, we now know that the malware is using the hard-coded SERVER_IP and SERVER_PORT values (Figure 4) for this socket connection. The application is neither obfuscated nor protected with any Obfuscator or Protector. Also apparent is that the SpyNote builder application is developed in. Upon installation, SpyNote will remove the application’s icon from the victim’s device. We have found that a sample of SpyNote was uploaded to the VirusTotal and Koodous malware analysis websites. The SpyNote APK requires victims to accept and give SpyNote many permissions, including the ability to edit text messages, read call logs and contacts, or modify or delete the contents of the SD card.
#DROIDJACK ماهو INSTALL#
Install new APKs and update the malware.Like these other RATs, SpyNote has a large feature set including the following: SpyNote is similar to OmniRat and DroidJack, which are RATs (remote administration tools) that allow malware owners to gain remote administrative control of an Android device. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying.