SpyNote (SpyMax / CypherRAT Lineage): Forensic Reverse-Engineering & Architectural Dossier

{
  "compiler": "Java SE Runtime executing apktool.jar (build) + signapk.jar (X.509 testkey signing) driven by .NET WinForms Builder",
  "runtime": "Android Runtime (ART) / Dalvik VM",
  "binary_footprint": "Standalone or merged APK package, typ. 400 KB - 2.5 MB uncompressed DEX and resource bundle",
  "stub_size": "680,000 bytes (base template APK situated in Server\\Resources\\stub.apk)",
  "packer_obfuscation": "Random ASCII/alphanumeric Smali identifier substitution, manifest permission inflation, and optional DEX asset encryption in CypherRAT/SpyMax forks",
  "subsystem": "Android Background Service + DeviceAdminReceiver + AccessibilityService",
  "entry_point_flow": "MainActivity -> Request DeviceAdmin / AccessibilityService privileges -> Hide launcher icon via PackageManager.setComponentEnabledSetting -> Start foreground CameraManager/ConnectionService -> Register SensorRestarterBroadcastReceiver -> Connect TCP socket to C2",
  "technical_summary": "SpyNote (and its direct source derivatives SpyMax v2/v4 and CypherRAT v3.5) is the foundational Android RAT architecture upon which modern commercial families were built. Following the public leak of its v5.0/v6.4 builder and stub source code, it became ubiquitous across mobile threat operations. The framework pairs a VB.NET/C# Windows server with a Java Android stub that leverages AccessibilityService auto-clicking, DeviceAdminReceiver deletion prevention, MediaProjection screen streaming, and SensorRestarterBroadcastReceiver service resurrection."
}

{
  "interface_type": "GUI Builder / Operator Console",
  "builder_tabs_options": [
    {
      "tab": "Build / App Settings",
      "options": [
        "Service Name: Foreground service label displayed in Android system settings",
        "App Name: Application title patched into strings.xml",
        "Version: Version string metadata",
        "App Icon: Custom icon image injected into drawable/mipmap folders",
        "Merge With APK: Binds SpyNote Smali classes and manifest receivers into a legitimate host APK"
      ]
    },
    {
      "tab": "Connection Settings",
      "options": [
        "DNS / IP Host: Target C2 IPv4 address or Dynamic DNS domain",
        "Port: Listening TCP port (default 2222, 3210, or 7771/7772 in SpyMax)",
        "Client Name / Victim ID: Tag string identifying the deployment batch",
        "Key / Password: Socket authentication secret shared between server and stub"
      ]
    },
    {
      "tab": "Installation & Persistence",
      "options": [
        "Hide Application Icon: Disables MainActivity launcher alias upon first execution",
        "Device Administrator: Prompts victim to activate BIND_DEVICE_ADMIN to block standard uninstallation",
        "Accessibility Service: Enables automated permission clicking and keystroke logging",
        "Foreground Service Notification: Configures persistent notification or silent channel hiding"
      ]
    },
    {
      "tab": "Ports & Network",
      "options": [
        "Listener Ports Array: Configures single or dual TCP listener sockets on the Windows host",
        "Connection Password: Drops unauthorized TCP peers that fail initial key validation"
      ]
    }
  ],
  "config_struct_layout": [
    {
      "offset": "res/values/strings.xml -> h",
      "field": "Host",
      "type": "String",
      "description": "C2 Server IP address or DNS hostname patched during APK build"
    },
    {
      "offset": "res/values/strings.xml -> p",
      "field": "Port",
      "type": "String",
      "description": "C2 TCP listener port number"
    },
    {
      "offset": "res/values/strings.xml -> n",
      "field": "ClientName",
      "type": "String",
      "description": "Operator-defined victim identifier string"
    },
    {
      "offset": "res/values/strings.xml -> s",
      "field": "ServiceName",
      "type": "String",
      "description": "Background Android service display name"
    },
    {
      "offset": "CameraManager / Config.SPL",
      "field": "Splitter",
      "type": "String",
      "description": "Packet delimiter token separating fields and binary chunks"
    }
  ],
  "payload_generation_flags": [
    "Toolchain: java -jar apktool.jar b -f -o built.apk",
    "Signing: java -jar signapk.jar certificate.pem key.pk8 built.apk out.apk",
    "ZipAlign: zipalign -v 4 out.apk final.apk"
  ],
  "operator_commands": [
    "FileManager: Browses internal/external storage, downloads files, edits text, and uploads payloads",
    "SMSManager: Dumps content://sms/inbox and content://sms/sent, and sends SMS via SmsManager.sendTextMessage",
    "CallManager: Reads CallLog.Calls content provider and initiates or terminates phone calls",
    "ContactsManager: Exfiltrates address book entries from ContactsContract.CommonDataKinds.Phone",
    "Microphone: Captures live ambient audio via AudioRecord at configurable sample rates (8000Hz - 44100Hz)",
    "CameraManager: Captures still photographs or live video streams from front/back cameras",
    "Keylogger: Streams real-time Accessibility text events and pulls saved offline log files",
    "LocationManager: Streams live GPS coordinates and renders victim position on an integrated map view"
  ],
  "interface_telemetry_analysis": "The SpyNote v6.4 and SpyMax v4.0 operator interfaces present a Windows Forms DataGridView listing active mobile sessions. Columns report the client IP, country flag, victim identifier, device manufacturer/model, Android OS version, root status, battery level, and active screen state. Right-clicking any row opens a hierarchical context menu organized into Account Manager, File Manager, SMS Manager, Call Manager, Contacts, Camera, Microphone, Keylogger, Terminal Shell, and Fun/System actions."
}

struct SpyNote_(SpyMax_/_CypherRAT_Lineage)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

{
  "injection_chain": "APK Execution -> MainActivity launches AccessibilityService and DeviceAdmin activation intents -> AccessibilityService auto-approves runtime permissions (READ_SMS, RECORD_AUDIO, CAMERA, ACCESS_FINE_LOCATION) and DeviceAdmin prompt -> PackageManager hides launcher icon -> Persistent foreground service spawns Socket worker thread -> SensorRestarterBroadcastReceiver and JobScheduler maintain execution across process kills.",
  "ntapi_functions": [
    "android.media.AudioRecord!startRecording",
    "android.hardware.Camera!open",
    "android.media.projection.MediaProjection!createVirtualDisplay",
    "android.telephony.SmsManager!sendTextMessage",
    "android.location.LocationManager!requestLocationUpdates",
    "android.app.admin.DevicePolicyManager!resetPassword",
    "android.content.pm.PackageManager!setComponentEnabledSetting"
  ],
  "process_hollowing_target": "Standalone background service process or merged host APK activity lifecycle",
  "persistence_mechanics": [
    "SensorRestarterBroadcastReceiver: Broadcast intent fired inside Service.onDestroy() and Service.onTaskRemoved() that immediately restarts the core C2 service",
    "JobScheduler / AlarmManager Heartbeat: Schedules periodic wakeup jobs every 5-15 minutes to verify socket health and re-establish dropped connections",
    "BOOT_COMPLETED BroadcastReceiver: Starts the background service upon Android OS boot completion or PACKAGE_REPLACED events",
    "DeviceAdminReceiver Protection: Registers android.app.action.DEVICE_ADMIN_ENABLED to grey out the 'Uninstall' button in Android Settings",
    "WakeLock Acquisition: Holds PowerManager.PARTIAL_WAKE_LOCK to keep CPU scheduling active when the screen is off"
  ],
  "evasion_hooks": [
    "Launcher Icon Suppression: Invokes PackageManager.setComponentEnabledSetting(ComponentName, COMPONENT_ENABLED_STATE_DISABLED, DONT_KILL_APP)",
    "Accessibility Settings Guard: Monitors foreground window package names and executes performGlobalAction(GLOBAL_ACTION_BACK) if the user attempts to revoke Device Admin or Accessibility privileges",
    "Silent Notification Channel: Creates low-importance or collapsed NotificationChannel entries to conceal the mandatory startForeground() service indicator"
  ],
  "anti_analysis": [
    "Root & Debugger Checks: Inspects /system/bin/su, /system/xbin/su, and Build.TAGS for 'test-keys'",
    "Emulator Detection: Evaluates TelephonyManager.getNetworkOperatorName() for 'Android' and checks Build.MODEL for 'sdk' or 'google_sdk'",
    "Decompiler Evasion (CypherRAT/SpyMax variants): Appends oversized junk byte arrays and invalid opcodes into unused Smali methods"
  ]
}

Concrete technical breakdown of functional modules implemented in the SpyNote (SpyMax / CypherRAT Lineage) binary:

{
  "framing": "Custom ASCII string delimiters separating command headers and arguments, followed by a null byte or delimiter token and GZIP-compressed payload bytes",
  "serialization": "Custom delimited text arrays (e.g., separated by 'SPL_DATA' or '0x0F0x0F') paired with GZIPInputStream / GZIPOutputStream binary blocks",
  "handshake": "Android stub connects via java.net.Socket to C2 IP:Port -> Transmits initial GZIP-compressed identification string (ClientName, IP, Device Model, Android Version, Battery, Camera flag) -> Server validates delimiter format and registers session in UI grid",
  "cryptography": "Unencrypted raw TCP transport utilizing GZIP stream compression (0x1F 0x8B magic bytes) for bandwidth reduction; optional static XOR or Base64 encoding on string arguments",
  "packet_types": [
    {
      "header": "files / file_manager",
      "payload": "Delimited directory listing (FileName, Size, LastModified, Type)",
      "direction": "Client -> Server"
    },
    {
      "header": "mic / audio",
      "payload": "GZIP-compressed raw PCM audio buffer recorded from AudioRecord",
      "direction": "Client -> Server"
    },
    {
      "header": "cam / camera",
      "payload": "GZIP-compressed JPEG byte array captured from Camera preview callback",
      "direction": "Client -> Server"
    },
    {
      "header": "sms / call_log",
      "payload": "Delimited records containing Address, Body, Date, and Thread Type",
      "direction": "Client -> Server"
    },
    {
      "header": "keylogger",
      "payload": "Accessibility event stream containing PackageName, EventType, and CapturedText",
      "direction": "Client -> Server"
    }
  ],
  "traffic_signature": "Raw TCP streams over ports 2222, 3210, 7771, or 7772 containing repetitive GZIP headers (1F 8B 08 00) immediately preceded or followed by hardcoded ASCII delimiter strings."
}

Indicators of compromise and forensic patterns recorded across laboratory triage: