Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Spy Note Android Trojan Builder Leaked

Summary: Unit 42 discovered a new Android Trojan called SpyNote that gives attackers remote administrative control of a device, similar to OmniRat and DroidJack, and its builder application recently leaked on several malware discussion forums. The builder is written in .NET with no obfuscation or protector, a sample was uploaded to VirusTotal and Koodous, and the malware removes its own icon after installation while communicating with a hard-coded command-and-control IP (141.255.147.193) over TCP port 2222.

Bottom line: The tool that generates new SpyNote variants is now freely available, and Unit 42 had not yet observed it in active attacks - meaning the population of this malware is likely to grow from a builder anyone can run.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related