SpyNote Android Spyware Disguised as Translate, Temp Mail and Banking Apps
Summary
Researchers found more than 40 SpyNote APKs in open directories, including samples disguised as Google Translate, Temp Mail and a German bank app. The samples collected sensitive data and contacted identified command-and-control infrastructure.
Key points
- The researchers found SpyNote APKs hosted in open directories, with more than 40 samples identified.
- Samples masqueraded as Google Translate, Temp Mail and a German bank app, using familiar app names and icons to deceive users.
- SpyNote can abuse Android accessibility services and device administrator privileges to access location, contacts and SMS messages.
- The Translate sample requested accessibility access using an unreplaced placeholder and contacted a C2 domain hosted on the same IP as its directory.
- The Temp Mail sample beaconed to a separate C2 IP; its directory also hosted Cobalt Strike and Sliver binaries for Windows.
- The Postbank-disguised sample communicated with a DuckDNS domain resolving to a reported C2 IP; researchers said a defacement page on that IP was likely unrelated.
- The article warns that SpyNote can exfiltrate sensitive information through changing infrastructure, complicating detection and mitigation.
Article Details
- Attack Vectors
- SpyNote APKs were placed in open directories and disguised as legitimate apps, including Google Translate, Temp Mail, and Post Bank.
- The apps request accessibility permissions and device administrator privileges, then collect sensitive information such as location, contacts, and SMS messages.
- The samples communicate or beacon to C2 infrastructure; the article also reports dynamic domains used for data exfiltration.
- An open directory hosted SpyNote APKs as well as Cobalt Strike and Sliver binaries targeting Windows.
- Defensive Notes
- The article recommends tracking and analyzing threats and infrastructure found in open directories.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 3aad911b21907053a69b49086a6396c50714accb | SHA-1 hash reported for the malicious Googe.apk and Translate.apk samples. |
| SHA1 | 5b9bfa06d05172f61d1ee19724fcd12cec110353 | SHA-1 hash reported for the malicious Temp_20Mail.apk sample. |
| SHA1 | dc9a821f1e061098188503dbf7518bf263334fcd | SHA-1 hash reported for the malicious postbank.apk sample. |
MITRE ATT&CK
Malware
Vendors
Amazon Web ServicesThis directory, hosted on AWS at IP 18.219.97_209:8081, contained just three files: Google.apk, Translate.apk, and desktop.ini. Curiously, the first two files are identical, only differing in name.CloudflareFigure 8: Screenshot of postbank.apk during dynamic analysis (Source: Hatching Triage Sandbox )The C2 is hosted on Cloudflare London at the Yusuf Kemal TURKMENOGLU ASN.
Products
AndroidOur team recently unearthed multiple samples of SpyNote, a well-known spyware targeting Android devices, cleverly disguised as legitimate apps such as Google Translate, Temp Mail, Deutsche Postbank, and even an appGoogle Play StoreFigure 5 displays the malicious app using the legitimate icon, while Figure 6 shows the Temp Mail app on the Google Play Store.Google Translatea well-known spyware targeting Android devices, cleverly disguised as legitimate apps such as Google Translate, Temp Mail, Deutsche Postbank, and even an app supposedly meant to discourage intoxicated driving.Post BankThe following file masquerades as an app for the German bank Post Bank. This app communicates with the domain oebonur600.duckdns_org, which resolves to IP address 95.214.177_114 on port 3210 in a pattern that's becomingTemp Mailspyware targeting Android devices, cleverly disguised as legitimate apps such as Google Translate, Temp Mail, Deutsche Postbank, and even an app supposedly meant to discourage intoxicated driving.
Tools
Cobalt Strikeat IP 156.245.13_61:8000. This directory not only contained several SpyNote APKs but also hosted Cobalt Strike and Sliver binaries targeting the Windows operating system.SliverThis directory not only contained several SpyNote APKs but also hosted Cobalt Strike and Sliver binaries targeting the Windows operating system.