Class: Trojan-Spy
Trojan-Spy programs are used to spy on a user’s actions (to track data entered by keyboard, make screen shots, retrieve a list of running applications, etc.) The harvested information is then transmitted to the malicious user controlling the Trojan. Email, FTP, the web (including data in a request) and other methods can be used to transmit the data.Read more
Platform: AndroidOS
Android is an open-source operating system developed by Google for mobile devices, such as tablets, smartphones, and watches. Based on a Linux kernel and the Dalvik virtual machine (older versions) / Android Runtime environment (newer versions).Family: Trojan-Spy.AndroidOS.SpyNote.al
No family descriptionExamples
F393713C33DAFEEA2516C415717C9C5191FEA7F6D27836D598899B7C20AA3AE8
8D14C9B3862F793D3CBD46BE9E1746AA
5001FB97E8F807B411783FAE9C2B7764
348C1DE3AD388E906E3FAB40AE5B2612
Tactics and Techniques: Mitre*
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
* © 2025 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.