Targets banking applications to steal credentials through keylogging and screen capturing via the MediaProjection API .
Android (Primary target), though Windows-based control builders exist. Author: Syrian threat actor known as EVLF DEV . CypherRatV3.5-NEW.zip
This report analyzes the package, a variant of the potent CypherRat (also known as SpyNote.C) Remote Access Trojan (RAT). Originally developed by the threat actor EVLF DEV , this malware transitioned from a paid "Malware-as-a-Service" model to an open-source tool on GitHub , leading to a significant increase in global infections. Malware Profile CypherRatV3.5-NEW.zip