SpyNoteMalware
- cypherrat
According to Cleafy, SpyNote abuses Accessibility services and other Android permissions in order to: Collect SMS messages and contacts list; Record audio and screen; Perform keylogging activities; Bypass 2FA; Track GPS locations.From MISP Galaxy
Last reported 2 months ago, by Infosecurity Magazine5 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1056.001Keylogging
“This means it can see the victim’s balance, harvest the second credential issued for two-factor authentication, and implement keylogging functions, allowing it to capture credentials.”
- T1036Masquerading
“GoldDigger spreads via fake websites masquerading as Google Play pages and fake corporate websites in Vietnam.”
- T1219Remote Access Tools
“Meanwhile, he was also behind new Remote Access tools such as Cypher Rat and Craxs Rat.”
- T1684Social Engineering
“A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam“WindRelay Malware Pairs With SpyNote RAT in Live-Call Scam”
-
Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme“A new NFC relay malware designated as WindRelay, paired with SpyNote RAT enables live-call fraud, combining social engineering with dual digital and physical cash-out.”
-
Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point Elsewhere“That network has been associated with distribution infrastructure for GootLoader, SpyNote, and other malware families.”
-
Craxs Rat, the master tool behind fake app scams and banking fraud“We discovered that Spymax, also known as Spy max or SpyNote, was first developed by a threat actor nicknamed ✶ s c я є α м in 2019 and was advertised on a popular Syrian forum, which had been shut down already.”
-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“Other noteworthy Android malware families currently targeting the region include the Gigabud family, SpyNote, HookBot, PWNDROID4, CraxsRAT, TgToxic, and Anubis (Godfather’s predecessor), etc.”
Indicators in its reports
named in the reports above- 88.86.124[.]114in 1 report
- 185.100.87[.]116in 1 report
- 185.100.87[.]223in 1 report
- 213.218.160[.]48in 1 report
- 852322e063872a02…531eac36a265in 1 report
- 11f9fb29f2cc142e…ae36282c95b3in 1 report
- 50cf07b97ef999e9…0e5f39db39fain 1 report
- 850680506df7892d…a06ef18837c7in 1 report
- 1371b2b2da10ed17…634553f865aein 1 report
- 91e66d640b2a570b…bf21e95e7469in 1 report
- 39060c673aefa090…3364cad9ed6fin 1 report
- e2e836d16a1b50d4…82c0a8e05376in 1 report
- 56b819cb285dbdbc…ddaa61319bb8in 1 report
- a1574476a616599a…dbf9b3a635f0in 1 report
- 48d011117eacf571…4d69e3d41ef6in 1 report
- ec730da64f9feae4…5cebdf2b1ad7in 1 report
- 8e665c12b7d8e80c…63ecd74e453cin 1 report
- 67e2a1e8ab963086…f58dadb0acc7in 1 report
- 294ecf0550308dff…27c064b3bfb8in 1 report
- 65ca7e9363539282…b75c9bfb6253in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.