Spynote v6.4 is written in Java and uses the Android SDK to interact with the device's operating system. The RAT uses a Command and Control (C2) server to receive commands from the attacker and send data back to the attacker. The C2 server is typically hosted on a remote server, and communication between the device and C2 server is encrypted using SSL/TLS.
: A hallmark of SpyNote is its abuse of Android's Accessibility Services. By tricking users into granting this permission, the RAT can perform automated actions, bypass security prompts, and log keystrokes (keylogging). spynote v6.4 github
However, others argue that the risks associated with such malware outweigh any potential benefits, and that its presence on GitHub legitimizes its use and encourages its development. Spynote v6