In brief
A guide-cum-demo: what SpyNote is (RAT trojans for Android), how it is built with a leaked builder, and how it is examined in phone fraud cases. The speaker graduated from the Ministry's university in computer forensic examination a year ago, is on stage for the first time, and landed in a flood of such cases.
Key points
- SpyNote is malware of the RAT trojan class for Android; per Kaspersky's reports it has been in the top 10 verdicts for several years; in 2022 the source code of the builder of one of its versions leaked. Its use — intercepting SMS messages with confirmation codes; the cover stories: a doctor's appointment booking, an antivirus, a parcel tracker.
- The v6.4 builder can be downloaded "without any VPN or SMS registration", "possibly the very one that leaked"; in a few steps it builds working APKs different from "the ones seen in the wild"; binding with another APK is available.
- Modules: SMS (viewing only), calls, contacts, a file manager without root, covert camera access with the screen locked, a keylogger on every event of the system shell; remotely — screen lock, factory reset, setting a password, "All of this without any user confirmation. I tested it myself."
- The only correct wording of the question put to the forensic expert is the presence of files detected by antivirus software; the other questions — remote access software, calls/SMS, messengers and social networks, web pages.
- The method: a physical image or a full file system → at least two different antivirus tools → static and dynamic analysis if an APK is found → the timeline. Static analysis — apktool/JADX/dex2jar (the analysis rests on the forensic expert), APKiD, strings, grep; traffic — Burp Suite/ZAP for HTTP, Wireshark for TCP.
- "A find of mine" — MobSF: open-source, automated static and semi-automated dynamic analysis, a GUI, Docker, an online version; but it searches for URLs by regular expression (it does not find a split-up address) and does not search by IP. In the manifest: the package name, the version, permissions (contacts, phone, SMS, geolocation), an activity with the intent-filter MAIN+LAUNCHER, services (an accessibility service → the contents of the screen), receivers; what they are for — only from the code of the classes.
- SpyNote works only on command from the C2; the host and port from the build sit in the resource strings. Dynamic analysis — MobSF + the Android Studio emulator (Android 10) + Wireshark: the exchange runs over TCP, "There's no other way to see it."
- On launch it asks for accessibility access, then for administrator rights; it creates a folder with the APK used for binding and with the SpyNote log: text and Base64 blocks (the keylogger) — app icons. A test without network access ("the forensically correct way") yields a DNS query for the C2 domain; with internet: domain → IP → TCP, the data compressed with Gzip, not encrypted.
- The forensics of installation: the data in
/data/data, the details — frosting.db and verify_apps.db, the main one — packages.xml (the initiator and the installer); on Samsung — the battery log and the package manager log. If neither the file nor the app is there, a built-in antivirus comes to the rescue (Sberbank's, for example): 30.db holds the verdict, the package name and the time — it can be proved that the malware "was there".
Tools, artifacts, technologies
- apktool, JADX, dex2jar, APKiD, strings, grep — static analysis; Burp Suite, ZAP, Wireshark — traffic; MobSF, the Android Studio emulator (Android 10), INetSim — dynamic analysis.
- AndroidManifest, accessibility service — static analysis artifacts.
- frosting.db, verify_apps.db, packages.xml, the Samsung battery log, the package manager log, 30.db (Sberbank's antivirus) — installation artifacts.
- Base64, Gzip — the keylogger log; traffic compression without encryption.
- Kaspersky — statistics; the SpyNote v6.4 builder — a live demo; Burp CA certificate, SSL pinning/unpinning — from a question.
Legal and organizational context
No references to laws, methodology numbers or regulators' requirements were made (unlike in the neighboring talks). The emphasis is on the correct wording of the question put to the forensic expert and on forensic correctness. The agency is the Forensic Science Centre of the Yaroslavl Regional Police, EKC (U)MVD of Russia for the Yaroslavl Region.
Questions from the audience
One question, in two parts:
- Crypters and obfuscators. In SpyNote obfuscation is "used quite heavily" (strange names for classes and variables); doing it manually is difficult, automated behavioral analysis is needed; the task boils down to finding the IP address of the C2 server.
- Traffic encryption / SSL unpinning (the wording is garbled). Samples are not let out onto the internet, so there is usually no traffic analysis task; there were cases where the scammers wrote to the forensic expert through the chat. She showed her own example only because she had both the client and the server; there was no encryption, only Gzip; otherwise — INetSim.
The speaker's position
A modest tone: "my first time on stage", the upshot — "a small practical guide". A lecture, not a sales pitch: she praises open-source software and names its limitations honestly.
Quotes
- "…the first thing I ran into was a flood of examinations related to phone fraud."
- "And nothing else, no malicious viruses. That's the only correct wording of the question."
- "…a find of mine. This is Mobile Security Framework."
- "…we can prove a malicious app's presence without it being present. That is, that it was there."