SpyNote Android Trojan Builder Leaked

KNOWLEDGE BELONGS TO THE WORLD
Share on FacebookTweet about this on TwitterShare on LinkedInShare on RedditShare on Google+Share on TumblrPin on PinterestDigg this

Our team recently discovered a new Android Trojan called SpyNote which facilitates remote spying. The builder, which creates new versions of the malware, recently leaked on several malware discussion forums. SpyNote is similar to OmniRat and DroidJack, which are RATs (remote administration tools) that allow malware owners to gain remote administrative control of an Android device.

Like these other RATs, SpyNote has a large feature set including the following:

  • No root access required
  • Install new APKs and update the malware
  • Copy files from device to computer
  • View all messages on the device
  • Listen to calls made on the device
  • List all the contacts on the device
  • Listen live or record audio from the device’s microphone
  • Gain control of the camera on the device
  • Get IMEI number, Wi-Fi MAC address, and cellphone carrier details
  • Get the device’s last GPS location
  • Make calls on the device

image1

Figure 1: SpyNote Control Panel

The SpyNote APK requires victims to accept and give SpyNote many permissions, including the ability to edit text messages, read call logs and contacts, or modify or delete the contents of the SD card. We have found that a sample of SpyNote was uploaded to the VirusTotaland Koodous malware analysis websites.

Analysis

Upon installation, SpyNote will remove the application’s icon from the victim’s device. Also apparent is that the SpyNote builder application is developed in .NET

The application is neither obfuscated nor protected with any Obfuscator or Protector.

image2

Figure 2: Decompiled SpyNote Builder

The uploader might be following the instructions described in YouTube videos on using SpyNote, considering the port number used is exactly the same as in the videos (https://www.youtube.com/watch?v=E9OxlTBtdkA) and the uploader only changes the icon of the APK file.

Furthermore, this RAT has been configured to communicate to the command and control (C&C) IP address (141.255.147.193) over TCP port 2222 as shown in the image below.

image3

Figure 3 – Dalvik bytecode view using Cerbero profiler

image4

Figure 4 – SpyNote opening a socket connection

Based on the information we have already found, we now know that the malware is using the hard-coded SERVER_IP and SERVER_PORT values (Figure 4) for this socket connection. We can now create an extractor for the C2 information using Androguard (https://github.com/androguard/androguard) as shown below. The spynote.C2.py script (shown below) parses these values from the APK file and prints them to the command line (Figure 5).

image5

Figure 5 – Extracted C2 information

Conclusion

Installing apps from third-party sources can be very risky — those sources often lack the governance provided by official sources such as the Google Play Store, which, even with detailed procedures and algorithms to weed out malicious applications, is not impregnable. Side-loading apps from questionable sources exposes users and their mobile devices to a variety of malware and possible data loss.

Source:http://researchcenter.paloaltonetworks.com/

KNOWLEDGE BELONGS TO THE WORLD
Share on FacebookTweet about this on TwitterShare on LinkedInShare on RedditShare on Google+Share on TumblrPin on PinterestDigg this