T1418 Application Discovery
Adversaries may seek to identify all applications installed on the device. One use case for doing so is to identify the presence of endpoint security applications that may increase the adversary’s risk of detection. Another use case is to identify the presence of applications that the adversary may wish to target.
On Android, applications can use methods in the PackageManager class 1 to enumerate other apps installed on device, or an entity with shell access can use the pm command line tool.
On iOS, apps can use private API calls to obtain a list of other apps installed on the device. 2 However, use of private API calls will likely prevent the application from being distributed through Apple’s App Store.
Item | Value |
---|---|
ID | T1418 |
Sub-techniques | |
Tactics | TA0030, TA0032 |
Platforms | Android, iOS |
Version | 1.0 |
Created | 25 October 2017 |
Last Modified | 17 October 2018 |
Procedure Examples
ID | Name | Description |
---|---|---|
S0440 | Agent Smith | Agent Smith obtains the device’s application list.18 |
S0525 | Android/AdDisplay.Ashas | Android/AdDisplay.Ashas has checked to see how many apps are installed, and specifically if Facebook or FB Messenger are installed.28 |
S0422 | Anubis | Anubis can collect a list of installed applications to compare to a list of targeted applications.15 |
S0529 | CarbonSteal | CarbonSteal has looked for specific applications, such as MiCode.29 |
S0480 | Cerberus | Cerberus can obtain a list of installed applications.22 |
S0479 | DEFENSOR ID | DEFENSOR ID can retrieve a list of installed applications.21 |
S0505 | Desert Scorpion | Desert Scorpion can obtain a list of installed applications.25 |
S0550 | DoubleAgent | DoubleAgent has accessed the list of installed apps.29 |
S0478 | EventBot | EventBot can collect a list of installed applications.20 |
S0522 | Exobot | Exobot can obtain a list of installed applications and can detect if an antivirus application is running, and close it if it is.27 |
S0405 | Exodus | Exodus Two can obtain a list of installed applications.9 |
S0509 | FakeSpy | FakeSpy can collect a list of installed applications.26 |
S0408 | FlexiSpy | FlexiSpy can retrieve a list of installed applications.3 |
S0423 | Ginp | Ginp can obtain a list of installed applications.16 |
S0535 | Golden Cup | Golden Cup can obtain a list of installed applications.30 |
S0551 | GoldenEagle | GoldenEagle has collected a list of installed application names.29 |
S0421 | GolfSpy | GolfSpy can obtain a list of installed applications.14 |
S0536 | GPlayed | GPlayed can collect a list of installed applications.31 |
S0406 | Gustuff | Gustuff checks for antivirus software contained in a predefined list.10 |
S0544 | HenBox | HenBox can obtain a list of running apps.33 |
S0463 | INSOMNIA | INSOMNIA can obtain a list of installed non-Apple applications.19 |
S0485 | Mandrake | Mandrake can obtain a list of installed applications.23 |
S0407 | Monokle | Monokle can list applications installed on the device.11 |
S0399 | Pallas | Pallas retrieves a list of all applications installed on the device.6 |
S0316 | Pegasus for Android | Pegasus for Android accesses the list of installed applications.4 |
S0539 | Red Alert 2.0 | Red Alert 2.0 can obtain the running application.32 |
S0403 | Riltok | Riltok can retrieve a list of installed applications. Installed application names are then checked against an adversary-defined list of targeted applications.8 |
S0411 | Rotexy | Rotexy retrieves a list of installed applications and sends it to the command and control server.12 |
S0328 | Stealth Mango | Stealth Mango uploads information about installed packages.5 |
S0545 | TERRACOTTA | TERRACOTTA can obtain a list of installed apps.34 |
S0558 | Tiktok Pro | Tiktok Pro can obtain a list of installed applications.35 |
S0424 | Triada | Triada is able to modify code within the com.android.systemui application to gain access to GET_REAL_TASKS permissions. This permission enables access to information about applications currently on the foreground and other recently used apps.7 |
S0427 | TrickMo | TrickMo can collect a list of installed applications.17 |
S0418 | ViceLeaker | ViceLeaker can obtain a list of installed applications.13 |
S0489 | WolfRAT | WolfRAT can obtain a list of installed applications.24 |
Mitigations
ID | Mitigation | Description |
---|---|---|
M1005 | Application Vetting | Application vetting techniques could search for use of the Android PackageManager class to enumerate other apps, and such applications could have extra scrutiny applied to them. However, this technique may not be practical if many apps invoke these methods as part of their legitimate behavior. On iOS, application vetting techniques could similarly search for use of the private API call necessary to obtain a list of apps installed on the device. Additionally, on iOS, use of the private API call is likely to result in the app not being accepted into Apple’s App Store. |
References
-
Android. (n.d.). PackageManager. Retrieved December 21, 2016. ↩
-
Andreas Kurtz. (2014, September 18). Malicious iOS Apps. Retrieved December 21, 2016. ↩
-
FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019. ↩
-
Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017. ↩
-
Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018. ↩
-
Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018. ↩
-
Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019. ↩
-
Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019. ↩
-
Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved September 3, 2019. ↩
-
Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019. ↩
-
Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019. ↩
-
T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019. ↩
-
GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019. ↩
-
E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020. ↩
-
M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020. ↩
-
ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020. ↩
-
P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020. ↩
-
A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020. ↩
-
I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020. ↩
-
D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020. ↩
-
L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020. ↩
-
Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020. ↩
-
R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020. ↩
-
W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back… . Retrieved July 20, 2020. ↩
-
A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020. ↩
-
O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020. ↩
-
Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020. ↩
-
L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020. ↩
-
A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020. ↩↩↩
-
R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020. ↩
-
V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020. ↩
-
J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020. ↩
-
A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019. ↩
-
Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020. ↩
-
S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021. ↩