battery optimization

The Android Spynote malware disguises itself as a legitimate antivirus application called "Avast Mobile Security" to exploit vulnerabilities in Android systems. It requests permissions associated with antivirus apps, bypasses user restrictions, and excludes itself from battery optimization settings. Spynote simulates user gestures and displays misleading system update notifications to maintain its presence and hinder detection. Its primary target is cryptocurrency accounts, aiming to extract private keys and balance information for assets like Bitcoin, Ethereum, and Tether. The malware captures user credentials, stores them on the device's SD card, and employs obfuscation and evasion techniques to complicate detection efforts. It can detect virtual environments to evade analysis and monitors system settings to resist uninstallation attempts. Spynote is distributed through phishing sites that mimic the legitimate Avast download page, hosting malicious APKs named Avastavv.apk.