Domain | ID | Name | Use | |
---|---|---|---|---|
Mobile | T1429 | Audio Capture | ||
Mobile | T1645 | Compromise Client Software Binary |
SpyDealer maintains persistence by installing an Android application package (APK) on the system partition.[1] |
|
Mobile | T1407 | Download New Code at Runtime |
SpyDealer downloads and executes root exploits from a remote server.[1] |
|
Mobile | T1624 | .001 | Event Triggered Execution: Broadcast Receivers |
SpyDealer registers the broadcast receiver to listen for events related to device boot-up.[1] |
Mobile | T1404 | Exploitation for Privilege Escalation |
SpyDealer uses the commercial rooting app Baidu Easy Root to gain root privilege and maintain persistence on the victim.[1] |
|
Mobile | T1430 | Location Tracking | ||
Mobile | T1644 | Out of Band Data |
SpyDealer enables remote control of the victim through SMS channels.[1] |
|
Mobile | T1636 | .002 | Protected User Data: Call Log | |
.003 | Protected User Data: Contact List | |||
.004 | Protected User Data: SMS Messages | |||
Mobile | T1513 | Screen Capture |
SpyDealer abuses Accessibility features to steal messages from popular apps such as WeChat, Skype, Viber, and QQ.[1] |
|
Mobile | T1409 | Stored Application Data |
SpyDealer exfiltrates data from over 40 apps such as WeChat, Facebook, WhatsApp, Skype, and others.[1] |
|
Mobile | T1422 | System Network Configuration Discovery |
SpyDealer harvests the device phone number, IMEI, and IMSI.[1] |
|
Mobile | T1512 | Video Capture |
SpyDealer can record video and take photos via front and rear cameras.[1] |