Spymax
SpyMax is an Android remote access trojan/spyware.
Profile source: Mallory opens in a new tabSpymax
Family profile
SpyMax is an Android remote access trojan/spyware. The provided content describes it as a commodity malware family and specifically as an Android RAT used in campaigns targeting Assad’s forces in Syria. In one reported operation, attackers distributed SpyMax inside a malicious Android application named STFD-686, which purported to offer financial aid to Syrian Army officers and soldiers and falsely claimed association with the Syria Trust for Development. Once installed, the embedded SpyMax malware allowed attackers to track the movement of infected Syrian soldiers. The content also notes that SpyMax has ranked prominently in spyware detections and has been deployed in campaigns using the SpyMax Android remote access trojan. High-confidence details in the content are limited to its Android RAT/spyware functionality, use in the STFD-686 lure, and targeting of Syrian military personnel.
Reporting
Research mentioning Spymax
EU has a problem attracting and retaining cyber talent
...deploy and use the Spymax Android remote access trojan.
MuddyWater deploys new DCHSpy variants amid Iran-Israel conflict
"...campaigns targeting Assad’s forces in Syria using the commodity malware SpyMax."
Risky Bulletin: Security firms will attempt to clean up their own mess—APT name taxonomies
STFD-686 spyware infects Syrian Army: Syrian Army officers and soldiers allegedly installed spyware on their Android devices. The spyware was hidden inside STFD-686, an app that promised financial aid for military members. The app claimed to be a project of the Syria Trust for Development, a humanitarian organization overseen by Bashar al-Assad's wife. It contained a version of the SpyMax remote access trojan that allowed attackers to track the movement of Syrian soldiers.
