Suppress Application Icon

A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.

This behavior has been seen in the BankBot/Spy Banker family of malware.[1][2][3]

ID: T1508
Sub-techniques:  No sub-techniques
Tactic Type: Post-Adversary Device Access
Tactic: Defense Evasion
Platforms: Android
Contributors: Emily Ratliff, IBM
Version: 1.1
Created: 11 July 2019
Last Modified: 14 November 2019

Procedure Examples

Name Description
Agent Smith

Agent Smith can hide its icon from the application launcher.[11]

Cerberus

Cerberus hides its icon from the application drawer after being launched for the first time.[12]

FlexiSpy

FlexiSpy is capable of hiding SuperSU's icon if it is installed and visible.[4] FlexiSpy can also hide its own icon to make detection and the uninstallation process more difficult.[5]

Ginp

Ginp hides its icon after installation.[10]

Gustuff

Gustuff hides its icon after installation.[7]

Rotexy

Rotexy hides its icon after first launch.[6]

SimBad

SimBad hides its icon from the application launcher.[8]

ViceLeaker

ViceLeaker includes code to hide its icon, but the function does not appear to be called in an analyzed version of the software.[9]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

The user can examine the list of all installed applications, including those with a suppressed icon, in the device settings.

References