Add docs for SpyNote

[zinwang]

New Quark Rules For SpyNote

New Quark rules (#​238 - #​242) are now available. These rules target SpyNote, a malware family that takes screenshots, simulates user gestures, logs user input, and communicates with C2 servers. Check here for the rule details.

With these rules, Quark is now able to identify the SpyNote malware family as high-risk. In our experiment, Quark achieved 100% accuracy and 100% precision. Please check here for the APKs we tested.

Below is a summary report of a SpyNote sample (0713a683567125ea6fdff233cfa850b36a0d2c7d7c964510405cbdf669fe2a8b). The report shows that Quark identified the sample as high-risk, with a list of behaviors as evidence.

Identified Well-Known Threats

With Quark's rule classification feature, analysts can generate behavior maps and see how behaviors are related. This feature helps identify 4 well-known threats from SpyNote, as shown below.

1. Take screenshots

The behavior map shows that the Lcom/maintain/gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2/keydkuycdcczonreivsieapzgrzkejxcowwsziydpvouihgqnu3/AccessService function obtains screenshot data and converts it into bitmap format.

Behaviors detected by Quark:

• Extract screenshot data to bitmap format (#​00238)

2. Simulate user gestures

The behavior map shows that the Lcom/maintain/gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2/Perfct;clickByGesture function simulates user finger gestures on a mobile phone.

Behaviors detected by Quark:

• Simulate user gestures (#​00240)

3. Log user input

The behavior map shows that the Lcom/maintain/gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2/keydkuycdcczonreivsieapzgrzkejxcowwsziydpvouihgqnu3/AccessService;checkPassword function obtains the description of a UI element. It also calls the Lcom/maintain/gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2/FileUtils;writeText to log the data to a file. If the UI element is a keypad button on the lock screen, the user's password can be logged.

Behaviors detected by Quark:

• Get the description of a UI element (#​00241)
• Write data to a file (#​00242)

4. Communicate with C2 servers

The behavior map shows that the Lcom/maintain/gybbpabtniopoetzeacrkmlxdhuvgpvnwtahmsaxmtnaltfrgf2/hlshzietuthuztzpsjgswpikkmwdxkiqxbzdseqdoywzyerfhi4/CameraHandler$1;run function establishes a connection to an IP address, which could be a malicious C2 server.

Behaviors detected by Quark:

• Establish a connection to an IP address (#​00239)

List of Tested APKs

The table below lists the APKs we tested.

index	sha256
1	059b5f74e053c2966775157cd521580fcfaa3b1a7613560b8f499dbd9c11d4b4
2	0713a683567125ea6fdff233cfa850b36a0d2c7d7c964510405cbdf669fe2a8b
3	4b2b411e03aafaa19ea93286fadd39a5134f4a039db2d5019b1054547c0d5601
4	5c01f7727c78dea9c89dccf92b01b4c45e69406e6462340779401497bf4d4589
5	8c365bd58edeb2ca371ead5e28350ee6c480a79f558d967ecbef525e9f1d7b3e
6	da4f59bdc91eaeaba238a8ba9602f7d5cc75f0892a92f5422e23b55accbbb2f0
7	dd7650a9cd3f853e109d2d0138ede785e1559d6c2d8c52eec2f2d9808a924f1c
8	dee1eaaa8879a7d321ef4e698203be7b23eeda80a6dea3c70cbf3138597b1800
9	f46b863952599b91a4d2d682a80f345dfa03fad473d1938f2c53a3139c87a019
10	eec5096dfca6824317863f9225c29f6c4b3442c48fefa62dc382e3569bca5a60

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.10%. Comparing base (0ce4443) to head (c842f0d).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #813   +/-   ##
=======================================
  Coverage   81.10%   81.10%           
=======================================
  Files          75       75           
  Lines        6372     6372           
=======================================
  Hits         5168     5168           
  Misses       1204     1204           

Flag	Coverage Δ
unittests	81.10% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haeter525]

LGTM.

[18z]

LGTM, thanks!