Android.SpyMax
Android.SpyMax is an Android banking trojan family that Dr.Web describes as being based on leaked source code of the SpyNote RAT/spyware trojan. The malware supports remote control of infected Android devices and has been used in multiple scenarios, including banking-trojan operations. Reported banking functionality includes phishing-style behavior associated with Android banking malware, and the family was specifically tracked by Dr.Web as Android.SpyMax banking trojans. Dr.Web reported that Android.SpyMax activity declined in some 2025 reporting periods, including a 17.25% decrease in detections in Q3 2025, and was described as less active in later reporting. Some Android.SpyMax samples or versions were noted as being protected with obfuscation/packing detected as Android.Packed.57.origin. High-confidence context directly ties Android.SpyMax to Android devices, banking-trojan use cases, SpyNote-derived code, remote device control capability, and use of obfuscation in at least some variants.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named banking trojan referenced as being protected by an obfuscator in some versions.
SpyNote-derived Android RAT/spyware family used in multiple criminal scenarios, including banking fraud.
Android banking trojan family referenced as decreasing in activity during 2025.
Android banking trojan family referenced as less active in 2025 compared to prior periods.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.