Hide Artifacts: Suppress Application Icon

ID Name
T1628.001 Suppress Application Icon
T1628.002 User Evasion

A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.

This behavior has been seen in the BankBot/Spy Banker family of malware.[1][2][3]

Beginning in Android 10, changes were introduced to inhibit malicious applications’ ability to hide their icon. If an app is a system app, requests no permissions, or does not have a launcher activity, the application’s icon will be fully hidden. Further, if the device is fully managed or the application is in a work profile, the icon will be fully hidden. Otherwise, a synthesized activity is shown, which is a launcher icon that represents the app’s details page in the system settings. If the user clicks the synthesized activity in the launcher, they are taken to the application’s details page in the system settings.[4][5]

ID: T1628.001
Sub-technique of:  T1628
Tactic Type: Post-Adversary Device Access
Tactic: Defense Evasion
Platforms: Android
Contributors: Emily Ratliff, IBM
Version: 1.0
Created: 30 March 2022
Last Modified: 20 May 2022

Procedure Examples

ID Name Description
S0440 Agent Smith

Agent Smith can hide its icon from the application launcher.[6]

S0525 Android/AdDisplay.Ashas

Android/AdDisplay.Ashas can hide its icon and create a shortcut based on the C2 server response.[7]

S0655 BusyGasper

BusyGasper can hide its icon.[8]

S0480 Cerberus

Cerberus hides its icon from the application drawer after being launched for the first time.[9]

S0505 Desert Scorpion

Desert Scorpion can hide its icon.[10]

S0550 DoubleAgent

DoubleAgent has hidden its app icon.[11]

S0509 FakeSpy

FakeSpy can hide its icon if it detects that it is being run on an emulator.[12]

S0408 FlexiSpy

FlexiSpy is capable of hiding SuperSU's icon if it is installed and visible.[13] FlexiSpy can also hide its own icon to make detection and the uninstallation process more difficult.[14]

S0423 Ginp

Ginp hides its icon after installation.[15]

S0406 Gustuff

Gustuff hides its icon after installation.[16]

S0485 Mandrake

Mandrake can hide its icon on older Android versions.[17]

S0411 Rotexy

Rotexy hides its icon after first launch.[18]

S0419 SimBad

SimBad hides its icon from the application launcher.[19]

S0558 Tiktok Pro

Tiktok Pro can hide its icon after launch.[20]

S0302 Twitoor

Twitoor can hide its presence on the system.[21]

S0418 ViceLeaker

ViceLeaker includes code to hide its icon, but the function does not appear to be called in an analyzed version of the software.[22]


ID Mitigation Description
M1006 Use Recent OS Version

Android 10 introduced changes to prevent malicious applications from fully suppressing their icon in the launcher.[4][5]

M1011 User Guidance

Users should be shown what a synthetic activity looks like so they can scrutinize them in the future.


The user can examine the list of all installed applications, including those with a suppressed icon, in the device settings. If the user is redirected to the device settings when tapping an application’s icon, they should inspect the application to ensure it is genuine. Application vetting services could potentially detect the usage of APIs intended for suppressing the application’s icon.