Skip to content

T1418 Software Discovery

Adversaries may attempt to get a listing of applications that are installed on a device. Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not to fully infect the target and/or attempts specific actions.

Adversaries may attempt to enumerate applications for a variety of reasons, such as figuring out what security measures are present or to identify the presence of target applications.

Item Value
ID T1418
Sub-techniques T1418.001
Tactics TA0032
Platforms Android, iOS
Version 2.1
Created 25 October 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S1061 AbstractEmu AbstractEmu can obtain a list of installed applications.29
S0440 Agent Smith Agent Smith obtains the device’s application list.22
S0525 Android/AdDisplay.Ashas Android/AdDisplay.Ashas has checked to see how many apps are installed, and specifically if Facebook or FB Messenger are installed.26
S0422 Anubis Anubis can collect a list of installed applications to compare to a list of targeted applications.24
S1215 Binary Validator Binary Validator has obtained a list of installed applications.23
S1079 BOULDSPY BOULDSPY can retrieve the list of installed applications.39
C0033 C0033 During C0033, PROMETHIUM used StrongPity to obtain a list of installed applications.50
S0529 CarbonSteal CarbonSteal has looked for specific applications, such as MiCode.12
S0480 Cerberus Cerberus can obtain a list of installed applications.34
S1083 Chameleon Chameleon has read the name of application packages.20
S1225 CherryBlos CherryBlos has obtained a list of installed cryptocurrency wallet applications.7
S0479 DEFENSOR ID DEFENSOR ID can retrieve a list of installed applications.25
S0505 Desert Scorpion Desert Scorpion can obtain a list of installed applications.5
S0550 DoubleAgent DoubleAgent has accessed the list of installed apps.12
S0478 EventBot EventBot can collect a list of installed applications.18
S0405 Exodus Exodus Two can obtain a list of installed applications.49
S0509 FakeSpy FakeSpy can collect a list of installed applications.10
S0408 FlexiSpy FlexiSpy can retrieve a list of installed applications.2
S0423 Ginp Ginp can obtain a list of installed applications.31
S1231 GodFather GodFather has gathered a list of installed applications.3736
S0535 Golden Cup Golden Cup can obtain a list of installed applications.38
S0551 GoldenEagle GoldenEagle has collected a list of installed application names.12
S0421 GolfSpy GolfSpy can obtain a list of installed applications.33
S0536 GPlayed GPlayed can collect a list of installed applications.16
S0544 HenBox HenBox can obtain a list of running apps.17
S1077 Hornbill Hornbill can search for installed applications such as WhatsApp.28
S0463 INSOMNIA INSOMNIA can obtain a list of installed non-Apple applications.21
S1185 LightSpy LightSpy has accessed a list of installed applications.42434441
S0485 Mandrake Mandrake can obtain a list of installed applications.35
S0407 Monokle Monokle can list applications installed on the device.48
C0054 Operation Triangulation During Operation Triangulation, the threat actors have obtained a list of installed applications.11
S0399 Pallas Pallas retrieves a list of all applications installed on the device.8
S0316 Pegasus for Android Pegasus for Android accesses the list of installed applications.47
S1241 RatMilad RatMilad has collected package names.4
S0539 Red Alert 2.0 Red Alert 2.0 can obtain the running application.45
S0403 Riltok Riltok can retrieve a list of installed applications. Installed application names are then checked against an adversary-defined list of targeted applications.13
S0411 Rotexy Rotexy retrieves a list of installed applications and sends it to the command and control server.30
S1062 S.O.V.A. S.O.V.A. can search for installed applications that match a list of targets.3
S0328 Stealth Mango Stealth Mango uploads information about installed packages.46
S1082 Sunbird Sunbird can exfiltrate a list of installed applications.28
S1069 TangleBot TangleBot can obtain a list of installed applications.6
S0545 TERRACOTTA TERRACOTTA can obtain a list of installed apps.32
S0558 Tiktok Pro Tiktok Pro can obtain a list of installed applications.27
S0424 Triada Triada is able to modify code within the com.android.systemui application to gain access to GET_REAL_TASKS permissions. This permission enables access to information about applications currently on the foreground and other recently used apps.19
S1216 TriangleDB TriangleDB has obtained a list of installed applications.11
S0427 TrickMo TrickMo can collect a list of installed applications.14
S0418 ViceLeaker ViceLeaker can obtain a list of installed applications.15
S0489 WolfRAT WolfRAT can obtain a list of installed applications.9
S0311 YiSpecter YiSpecter has collected information about installed applications.40

Mitigations

ID Mitigation Description
M1006 Use Recent OS Version Android 11 introduced privacy enhancements to package visibility, filtering results that are returned from the package manager. iOS 12 removed the private API that could previously be used to list installed applications on non-app store applications.1
M1011 User Guidance iOS users should be instructed to not download applications from unofficial sources, as applications distributed via the Apple App Store cannot list installed applications on a device.

References

  1. Google. (n.d.). Package visibility filtering on Android. Retrieved April 11, 2022. ↩

  2. FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019. ↩

  3. Francesco Lubatti, Federico Valentini. (2022, November 8). SOVA malware is back and is evolving rapidly. Retrieved March 30, 2023. ↩

  4. Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025. ↩

  5. A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020. ↩

  6. Felipe Naves, Andrew Conway, W. Stuart Jones, Adam McNeil . (2021, September 23). TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures. Retrieved February 28, 2023. ↩

  7. Trend Micro Research. (2023, July 28). Related CherryBlos and FakeTrade Android Malware Involved in Scam Campaigns. Retrieved March 28, 2025. ↩

  8. Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018. ↩

  9. W. Mercer, P. Rascagneres, V. Ventura. (2020, May 19). The wolf is back… . Retrieved July 20, 2020. ↩

  10. O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020. ↩

  11. Kucherin, G., et al. (2023, June 21). Dissecting TriangleDB, a Triangulation spyware implant. Retrieved April 18, 2024. ↩↩

  12. A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020. ↩↩↩

  13. Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019. ↩

  14. P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020. ↩

  15. GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019. ↩

  16. V. Ventura. (2018, October 11). GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020. ↩

  17. A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019. ↩

  18. D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020. ↩

  19. Lukasz Siewierski. (2019, June 6). PHA Family Highlights: Triada. Retrieved July 16, 2019. ↩

  20. Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023. ↩

  21. I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020. ↩

  22. A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020. ↩

  23. Kucherin, G., et al. (2023, October 23). The outstanding stealth of Operation Triangulation. Retrieved April 18, 2024. ↩

  24. M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024. ↩

  25. L. Stefanko. (2020, May 22). Insidious Android malware gives up all malicious features but one to gain stealth. Retrieved June 26, 2020. ↩

  26. L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020. ↩

  27. S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021. ↩

  28. Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023. ↩↩

  29. P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023. ↩

  30. T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019. ↩

  31. ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020. ↩

  32. Satori Threat Intelligence and Research Team. (2020, August). TERRACOTTA Android Malware: A Technical Study. Retrieved December 18, 2020. ↩

  33. E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020. ↩

  34. Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020. ↩

  35. R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020. ↩

  36. Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025. ↩

  37. Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025. ↩

  38. R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020. ↩

  39. Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023. ↩

  40. Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023. ↩

  41. Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy’s iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025. ↩

  42. Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025. ↩

  43. ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025. ↩

  44. ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025. ↩

  45. J. Chandraiah. (2018, July 23). Red Alert 2.0: Android Trojan targets security-seekers. Retrieved December 14, 2020. ↩

  46. Lookout. (n.d.). Stealth Mango & Tangelo. Retrieved September 27, 2018. ↩

  47. Mike Murray. (2017, April 3). Pegasus for Android: the other side of the story emerges. Retrieved April 16, 2017. ↩

  48. Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019. ↩

  49. Security Without Borders. (2019, March 29). Exodus: New Android Spyware Made in Italy. Retrieved November 17, 2024. ↩

  50. Stefanko, L. (2023, January 10). StrongPity espionage campaign targeting Android users. Retrieved January 31, 2023. ↩