Degree of destruction<\/strong>: average<\/p>\n Prevalence<\/strong>: average<\/p>\n By installing Spyware on your phone, the user\u2019s data security is always under threat and each second, it is possible to be stolen and received by an unauthorized person. Usually, spyware is installed on the phone secretly and out of the user\u2019s sight and performs its actions in complete secrecy. This kinds of spyware collect the necessary data about the user\u2019s activity on the phone or any other data that is necessary and at the right time will send it to another person. Usually, spyware by deceiving users on the internet will be installed on their phone, as a useful and applicant application. The malware collects the information about the user\u2019s activity on the phone such as passwords, credit card information, and other security information such as compressed buttons by keyboard and user\u2019s call list, contact list, sending and receiving a text message, etc.<\/p>\n This is a remote access Trojan (RAT). It means, it can remotely and by the server, access all devices that the malware is installed on. The destructive actions that are performed in the user\u2019s phone are items such as: stealing user\u2019s data like messages and contact list, listening to victims conversation, sound recording, controlling camera, attain admin access (Admin), and the possibility to initial calls in the user\u2019s phone.<\/p>\n The name of this application is \u201cFollowerInstagram\u201d which is a member of the Spyware family and names \u201cSpyNote\u201d. This application immediately gets control of the Device Admin to help its persistence; so, it does not help the user to delete the application easily. Also, by using AccessibilityServices permission which attains from the user for its application, will attempt to steal complete information from an installed application on the phone, user\u2019s personal information such as calls, send\/receive SMS, complete information of the phone, sound recording, taking a photo, receiving geographical situation, etc. after running the application, a service of the type AccessibilityServices, is recalled to attain settings related to accessibility services and the following image will appear to the user. If the user enables the accession for the application, malware will initiate its destructive action without any problem and still keeps its services in the above background (even if the user stops this service, it will restart again after few seconds, and then automatically the application will be closed and its icon will vanish). As surveys, after attaining accessibility services, malware will provide a file that includes a list of the installed application on the phone along with the installation date and package name and will add it in the data\/data path. I.e. the application updated will make a list of installed applications on the phone and collect its other desired information, will run once the A application service every 3 minutes, and checks the execution of this service.<\/p>\n \u201cA\u201d service:<\/p>\n The following destruction operation will happen every 15 seconds:<\/p>\n Finally, this spyware after collecting all its desired information about the victim, will encrypt them and send them to its command and control server \u201cimages. myvnc[.]com\u201d.<\/p>\nWhat is spyware?<\/h3>\n
What is the SpyNote family?<\/h3>\n
Technical Explanation<\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/Service-a.png\")
<\/p>\n\n
\n
How to deal with it and disinfect the system<\/h2>\n