Indicator Removal on Host: Uninstall Malicious Application

Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:

  • Abusing device owner permissions to perform silent uninstallation using device owner API calls.
  • Abusing root permissions to delete files from the filesystem.
  • Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.
ID: T1630.001
Sub-technique of:  T1630
Tactic Type: Post-Adversary Device Access
Tactic: Defense Evasion
Platforms: Android
MTC ID: APP-43
Version: 1.1
Created: 30 March 2022
Last Modified: 20 March 2023

Procedure Examples

ID Name Description
S1094 BRATA

BRATA can uninstall itself and remove traces of infection.[1][2]

S0480 Cerberus

Cerberus can uninstall itself from a device on command.[3]

S1092 Escobar

Escobar can uninstall itself and other applications.[4]

S1062 S.O.V.A.

S.O.V.A. can uninstall itself.[5]

S1055 SharkBot

SharkBot has C2 commands that can uninstall the app from the infected device.[6]

S0427 TrickMo

TrickMo can uninstall itself from a device on command by abusing the accessibility service.[7]

Mitigations

ID Mitigation Description
M1002 Attestation

Attestation can detect rooted devices. Mobile security software can then use this information and take appropriate mitigation action. Attestation can detect rooted devices.

M1001 Security Updates

Security updates typically provide patches for vulnerabilities that enable device rooting.

M1011 User Guidance

Inform users that device rooting or granting unnecessary access to the accessibility service presents security risks that could be taken advantage of without their knowledge.

Detection

ID Data Source Data Component Detects
DS0041 Application Vetting API Calls

Application vetting services could look for use of the accessibility service or features that typically require root access.

DS0042 User Interface System Settings

The user can see a list of applications that can use accessibility services in the device settings.

References