{"source_checked_on":"2026-10-19","schema_version":1,"key":"mobile/T1426","id":"T1426","name":"System Information Discovery","domain":"mobile","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1426","source_file":{"file":"mobile.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/mobile-attack/mobile-attack-20.0.json","sha256":"824f7d8a37e7893b29e4c6ca6d87b5fbbf3b228ec6384f1a69ee20d523ff59e5","bytes":6095145},"source_object_sha256":"6c8fe442e9648f196b4a338f58628e288357d9818667d84917788d6fe22b83b0","description":"Adversaries may attempt to get detailed information about a device’s operating system and hardware, including versions, patches, and architecture. Adversaries may use the information from [System Information Discovery](https://attack.mitre.org/techniques/T1426) during automated discovery to shape follow-on behaviors, including whether or not to fully infects the target and/or attempts specific actions. \n\n \n\nOn Android, much of this information is programmatically accessible to applications through the `android.os.Build` class. (Citation: Android-Build) iOS is much more restrictive with what information is visible to applications. Typically, applications will only be able to query the device model and which version of iOS it is running. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1426","external_id":"T1426"},{"source_name":"Android-Build","description":"Android. (n.d.). Build. Retrieved December 21, 2016.","url":"https://developer.android.com/reference/android/os/Build"},{"source_name":"NIST Mobile Threat Catalogue","url":"https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-12.html","external_id":"APP-12"}],"platforms":["Android","iOS"],"environments":["mobile"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0112","name":"API Calls","page":"telemetry/DC0112/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Instrumented mobile API calls and results relevant to an application behavior.","collection_focus":"Instrument selected APIs in the owned test app or approved research build; log caller, API, sanitized argument class and return status.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","api","result","thread"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0123","name":"Application State","page":"telemetry/DC0123/","kind":"attack_component","category":"Mobile lab instrumentation","description":"Application state and lifecycle observations such as foreground/background transitions.","collection_focus":"Instrument the owned app lifecycle and corroborate permitted service snapshots; distinguish app events from inferred gateway activity.","providers":[{"name":"Android logcat","scope":"Permitted logs from a consented test device/emulator; output depends on build, permissions and instrumentation.","source_id":"android_logs"},{"name":"Android dumpsys","scope":"Point-in-time service/package state on an authorized development device.","source_id":"android_state"},{"name":"Instrumented test application","scope":"Own-app permission, API and state callbacks; not universal visibility into other apps.","source_id":"android_permissions"}],"configuration":["Use a disposable emulator or owned development device with approved debugging. Record OS/API level, app version and instrumentation privileges.","Collect only relevant logcat buffers/tags and service snapshots; add explicit own-app instrumentation for events absent from OS logs.","Forward sanitized logs and compare before/after state. Remove test data and revoke debugging access after the lab session."],"configuration_example":null,"required_fields":["package","state_before","state_after","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Android tooling does not imply iOS coverage. Standard mobile apps cannot observe all other apps or protected OS internals; MDM status is not full API, filesystem or content telemetry.","sources":[{"id":"android_logs","title":"Android logcat and access limits","url":"https://developer.android.com/tools/logcat"},{"id":"android_state","title":"Android dumpsys","url":"https://developer.android.com/tools/dumpsys"},{"id":"android_permissions","title":"Android runtime permission requests","url":"https://developer.android.com/training/permissions/requesting"}],"association":"attack_component","anomaly_design":"Per owned device, app version and permission state: unexpected API/permission changes, background activity and network destinations. OS privacy restrictions and emulator differences limit observability."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"mobile/T1426","id":"T1426","name":"System Information Discovery","domain":"mobile","platforms":["Android","iOS"],"environments":["mobile"],"source_url":"https://attack.mitre.org/techniques/T1426","technique_page":"techniques/mobile/T1426/","page":"detections/mobile/T1426/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0601","name":"Detection of System Information Discovery","url":"https://attack.mitre.org/detectionstrategies/DET0601","stix_id":"x-mitre-detection-strategy--0a60e161-3347-49e6-9687-123e8a06c620","relationship_id":"relationship--e56b94c0-eb5a-4597-b961-523971d84a73","description":"","analytics":[{"id":"AN1648","name":"Analytic 1648","guidance":"For Android, detect System Information Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; Network Connection Creation via Android Enterprise Network Logging / Enterprise VPN [DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1648","platforms":["Android"],"tuning":[{"field":"SysInfoFieldThreshold","description":"Default 5 distinct Build fields within window. Single-field reads are legitimate."},{"field":"SysInfoWindow","description":"Default 30s at launch."},{"field":"SysInfoAllowList","description":"MDM agent, crash reporter, analytics SDK (if pre-approved). Derive from MDM catalog."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"FollowOnWindow","description":"Default 120s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: android.os.Build field reads > $SysInfoFieldThreshold$ distinct fields within $SysInfoWindow$ by app NOT IN $SysInfoAllowList$ at launch or in background","platforms":["Android"],"analytic_id":"AN1648","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0123","component":"Application State","name":"android:EMM","channel":"Managed package inventory/status and package metadata","platforms":["Android"],"analytic_id":"AN1648","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"android:EnterpriseNetworkLog","channel":"DevicePolicyManager.retrieveNetworkLogs(): DnsEvent / ConnectEvent; VPN flow metadata","platforms":["Android"],"analytic_id":"AN1648","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1648","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN1649","name":"Analytic 1649","guidance":"For iOS, detect System Information Discovery by correlating analyst-visible device/network evidence and management state; use streaming or batched telemetry only where the documented collector is deployed. Correlate API Calls via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: UIDevice.current.model]; Application State via Apple MDM [InstalledApplicationList / ManagedApplicationList]; Network Connection Creation via Apple Network Extension / Enterprise VPN [NEFilterFlow / per-app VPN / secure-web-gateway flow metadata]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.","url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1649","platforms":["iOS"],"tuning":[{"field":"SysInfoAllowList","description":"MDM agent, analytics SDK (pre-approved), crash reporter."},{"field":"SysInfoWindow","description":"Default 30s at launch."},{"field":"AppCDNList","description":"Per-app CDN. Derive by measurement."},{"field":"FollowOnWindow","description":"Default 120s."}],"log_sources":[{"component_id":"DC0112","component":"API Calls","name":"mobile:DynamicAnalysis","channel":"Dynamic API/runtime trace: UIDevice.current.model","platforms":["iOS"],"analytic_id":"AN1649","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0112/"},{"component_id":"DC0123","component":"Application State","name":"iOS:MDM","channel":"InstalledApplicationList / ManagedApplicationList","platforms":["iOS"],"analytic_id":"AN1649","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0123/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"iOS:NetworkExtension","channel":"NEFilterFlow / per-app VPN / secure-web-gateway flow metadata","platforms":["iOS"],"analytic_id":"AN1649","source_url":"https://attack.mitre.org/detectionstrategies/DET0601#AN1649","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0112","name":"API Calls","tag":"API Calls","page":"telemetry/DC0112/","kind":"attack_component"},{"id":"DC0123","name":"Application State","tag":"Application State","page":"telemetry/DC0123/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0288","name":"KeyRaider","url":"https://attack.mitre.org/software/S0288","kind":"malware","description":"Most [KeyRaider](https://attack.mitre.org/software/S0288) samples search to find the Apple account's username, password and device's GUID in data being transferred.(Citation: Xiao-KeyRaider)","relationship_id":"relationship--05563777-5771-4bd6-a1af-3e244cf42372","references":[{"source_name":"Xiao-KeyRaider","description":"Claud Xiao. (2015, August 30). KeyRaider: iOS Malware Steals Over 225,000 Apple Accounts to Create Free App Utopia. Retrieved December 12, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/08/keyraider-ios-malware-steals-over-225000-apple-accounts-to-create-free-app-utopia/"}]},{"id":"S0289","name":"Pegasus for iOS","url":"https://attack.mitre.org/software/S0289","kind":"malware","description":"[Pegasus for iOS](https://attack.mitre.org/software/S0289) monitors the victim for status and disables other access to the phone by other jailbreaking software.(Citation: Lookout-Pegasus)","relationship_id":"relationship--7af7d094-3a49-4e5e-99d0-385c79f95f06","references":[{"source_name":"Lookout-Pegasus","description":"Lookout. (2016). Technical Analysis of Pegasus Spyware. Retrieved December 12, 2016.","url":"https://info.lookout.com/rs/051-ESQ-475/images/lookout-pegasus-technical-analysis.pdf"}]},{"id":"S0304","name":"Android/Chuli.A","url":"https://attack.mitre.org/software/S0304","kind":"malware","description":"[Android/Chuli.A](https://attack.mitre.org/software/S0304) gathered system information including phone number, OS version, phone model, and SDK version.(Citation: Kaspersky-WUC)","relationship_id":"relationship--83991b5c-59b9-4fe5-9ef2-39c6ddc8b835","references":[{"source_name":"Kaspersky-WUC","description":"Costin Raiu, Denis Maslennikov, Kurt Baumgartner. (2013, March 26). Android Trojan Found in Targeted Attack. Retrieved December 23, 2016.","url":"https://securelist.com/android-trojan-found-in-targeted-attack-58/35552/"}]},{"id":"S0310","name":"ANDROIDOS_ANSERVER.A","url":"https://attack.mitre.org/software/S0310","kind":"malware","description":"[ANDROIDOS_ANSERVER.A](https://attack.mitre.org/software/S0310) gathers the device OS version, device build version, manufacturer, and model.(Citation: TrendMicro-Anserver2)","relationship_id":"relationship--a82d3cfb-7ef2-4e39-a6e1-3097d7b106f7","references":[{"source_name":"TrendMicro-Anserver2","description":"Karl Dominguez. (2011, September 27). ANDROIDOS_ANSERVER.A. Retrieved November 30, 2018.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ANDROIDOS_ANSERVER.A"}]},{"id":"S0311","name":"YiSpecter","url":"https://attack.mitre.org/software/S0311","kind":"malware","description":"[YiSpecter](https://attack.mitre.org/software/S0311) has collected the device UUID.(Citation: paloalto_yispecter_1015)","relationship_id":"relationship--fc7639c8-0e52-4f6f-9cf3-7840be81ad55","references":[{"source_name":"paloalto_yispecter_1015","description":"Claud Xiao. (2015, October 4). YiSpecter: First iOS Malware That Attacks Non-jailbroken Apple iOS Devices by Abusing Private APIs. Retrieved March 3, 2023.","url":"https://unit42.paloaltonetworks.com/yispecter-first-ios-malware-attacks-non-jailbroken-ios-devices-by-abusing-private-apis/"}]},{"id":"S0313","name":"RuMMS","url":"https://attack.mitre.org/software/S0313","kind":"malware","description":"[RuMMS](https://attack.mitre.org/software/S0313) gathers device model and operating system version information and transmits it to a command and control server.(Citation: FireEye-RuMMS)","relationship_id":"relationship--bb3be217-08e2-4bb0-9f1a-d8e538010451","references":[{"source_name":"FireEye-RuMMS","description":"Wu Zhou, Deyu Hu, Jimmy Su, Yong Kang. (2016, April 26). RUMMS: THE LATEST FAMILY OF ANDROID MALWARE ATTACKING USERS IN RUSSIA VIA SMS PHISHING. Retrieved February 6, 2017.","url":"https://www.fireeye.com/blog/threat-research/2016/04/rumms-android-malware.html"}]},{"id":"S0318","name":"XLoader for Android","url":"https://attack.mitre.org/software/S0318","kind":"malware","description":"[XLoader for Android](https://attack.mitre.org/software/S0318) collects the device’s Android ID and serial number.(Citation: TrendMicro-XLoader-FakeSpy)","relationship_id":"relationship--020f79c6-d5f8-49eb-beee-e716e1fa4e80","references":[{"source_name":"TrendMicro-XLoader-FakeSpy","description":"Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/"}]},{"id":"S0326","name":"RedDrop","url":"https://attack.mitre.org/software/S0326","kind":"malware","description":"[RedDrop](https://attack.mitre.org/software/S0326) exfiltrates details of the victim device operating system and manufacturer.(Citation: Wandera-RedDrop)","relationship_id":"relationship--e9cbc901-38cb-4895-9dfb-7a4fe10ba6d7","references":[{"source_name":"Wandera-RedDrop","description":"Nell Campbell. (2018, February 27). RedDrop: the blackmailing mobile malware family lurking in app stores. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180618225805/https://www.wandera.com/reddrop-malware/"}]},{"id":"S0399","name":"Pallas","url":"https://attack.mitre.org/software/S0399","kind":"malware","description":"[Pallas](https://attack.mitre.org/software/S0399) queries the device for metadata, such as device ID, OS version, and the number of cameras.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--9366529d-fba9-4ef6-b4ee-b6b41aa3b18c","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0403","name":"Riltok","url":"https://attack.mitre.org/software/S0403","kind":"malware","description":"[Riltok](https://attack.mitre.org/software/S0403) can query various details about the device, including phone number, country, mobile operator, model, root availability, and operating system version.(Citation: Kaspersky Riltok June 2019)","relationship_id":"relationship--7b8c3ae2-7e52-4f1d-ad30-788b367a7531","references":[{"source_name":"Kaspersky Riltok June 2019","description":"Tatyana Shishkova. (2019, June 25). Riltok mobile Trojan: A banker with global reach. Retrieved August 7, 2019.","url":"https://securelist.com/mobile-banker-riltok/91374/"}]},{"id":"S0406","name":"Gustuff","url":"https://attack.mitre.org/software/S0406","kind":"malware","description":"[Gustuff](https://attack.mitre.org/software/S0406) gathers information about the device, including the default SMS application, if SafetyNet is enabled, the battery level, the operating system version, and if the malware has elevated permissions.(Citation: Talos Gustuff Apr 2019)","relationship_id":"relationship--a87fa426-3968-4d3b-8f8d-8e3c3a9c32f5","references":[{"source_name":"Talos Gustuff Apr 2019","description":"Vitor Ventura. (2019, April 9).  Gustuff banking botnet targets Australia . Retrieved September 3, 2019.","url":"https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html"}]},{"id":"S0407","name":"Monokle","url":"https://attack.mitre.org/software/S0407","kind":"malware","description":"[Monokle](https://attack.mitre.org/software/S0407) queries the device for metadata such as make, model, and power levels.(Citation: Lookout-Monokle)","relationship_id":"relationship--be256f8a-8bae-4a00-8682-22797ba7e0ce","references":[{"source_name":"Lookout-Monokle","description":"Bauer A., Kumar A., Hebeisen C., et al. (2019, July). Monokle: The Mobile Surveillance Tooling of the Special Technology Center. Retrieved September 4, 2019.","url":"https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"}]},{"id":"S0411","name":"Rotexy","url":"https://attack.mitre.org/software/S0411","kind":"malware","description":"[Rotexy](https://attack.mitre.org/software/S0411) collects information about the compromised device, including phone number, network operator, OS version, device model, and the device registration country.(Citation: securelist rotexy 2018)","relationship_id":"relationship--ee9c1a8c-5f84-4571-8518-300a6412df0f","references":[{"source_name":"securelist rotexy 2018","description":"T. Shishkova, L. Pikman. (2018, November 22).  The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.","url":"https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/"}]},{"id":"S0418","name":"ViceLeaker","url":"https://attack.mitre.org/software/S0418","kind":"malware","description":"[ViceLeaker](https://attack.mitre.org/software/S0418) collects device information, including the device model and OS version.(Citation: SecureList - ViceLeaker 2019)","relationship_id":"relationship--271a311f-71bc-4558-a314-0edfbec44b64","references":[{"source_name":"SecureList - ViceLeaker 2019","description":"GReAT. (2019, June 26).  ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.","url":"https://securelist.com/fanning-the-flames-viceleaker-operation/90877/"}]},{"id":"S0420","name":"Dvmap","url":"https://attack.mitre.org/software/S0420","kind":"malware","description":"[Dvmap](https://attack.mitre.org/software/S0420) checks the Android version to determine which system library to patch.(Citation: SecureList DVMap June 2017)","relationship_id":"relationship--70ec9e67-b755-41ee-a1db-71d250a90b4e","references":[{"source_name":"SecureList DVMap June 2017","description":"R. Unuchek. (2017, June 8). Dvmap: the first Android malware with code injection. Retrieved December 10, 2019.","url":"https://securelist.com/dvmap-the-first-android-malware-with-code-injection/78648/"}]},{"id":"S0421","name":"GolfSpy","url":"https://attack.mitre.org/software/S0421","kind":"malware","description":"[GolfSpy](https://attack.mitre.org/software/S0421) can obtain the device’s battery level, network operator, connection information, sensor information, and information about the device’s storage and memory.(Citation: Trend Micro Bouncing Golf 2019)","relationship_id":"relationship--ccfffa97-17fd-4826-9a16-c9d8174fb8ac","references":[{"source_name":"Trend Micro Bouncing Golf 2019","description":"E. Xu, G. Guo. (2019, June 28).  Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/mobile-cyberespionage-campaign-bouncing-golf-affects-middle-east/"}]},{"id":"S0422","name":"Anubis","url":"https://attack.mitre.org/software/S0422","kind":"malware","description":"[Anubis](https://attack.mitre.org/software/S0422) can collect the device’s ID.(Citation: Cofense Anubis)","relationship_id":"relationship--50ad2a8c-ed45-4376-be31-8bafa26ba794","references":[{"source_name":"Cofense Anubis","description":"M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20231222134431/https://cofense.com/blog/infostealer-keylogger-ransomware-one-anubis-targets-250-android-applications/"}]},{"id":"S0425","name":"Corona Updates","url":"https://attack.mitre.org/software/S0425","kind":"malware","description":"[Corona Updates](https://attack.mitre.org/software/S0425) can collect various pieces of device information, including OS version, phone model, and manufacturer.(Citation: TrendMicro Coronavirus Updates) ","relationship_id":"relationship--b018fe06-740b-4864-b30a-f047598506b3","references":[{"source_name":"TrendMicro Coronavirus Updates","description":"T. Bao, J. Lu. (2020, April 14).  Coronavirus Update App Leads to Project Spy Android and iOS Spyware. Retrieved April 24, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware/"}]},{"id":"S0427","name":"TrickMo","url":"https://attack.mitre.org/software/S0427","kind":"malware","description":"[TrickMo](https://attack.mitre.org/software/S0427) can collect device information such as network operator, model, brand, and OS version.(Citation: SecurityIntelligence TrickMo)","relationship_id":"relationship--950e1476-83ca-4e81-b542-c91a19b206d7","references":[{"source_name":"SecurityIntelligence TrickMo","description":"P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.","url":"https://securityintelligence.com/posts/trickbot-pushing-a-2fa-bypass-app-to-bank-customers-in-germany/"}]},{"id":"S0463","name":"INSOMNIA","url":"https://attack.mitre.org/software/S0463","kind":"malware","description":"[INSOMNIA](https://attack.mitre.org/software/S0463) can collect the device’s name, serial number, iOS version, total disk space, and free disk space.(Citation: Google Project Zero Insomnia) ","relationship_id":"relationship--0993769f-63fb-4720-bbcf-e6f37f71515e","references":[{"source_name":"Google Project Zero Insomnia","description":"I. Beer. (2019, August 29). Implant Teardown. Retrieved June 2, 2020.","url":"https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html"}]},{"id":"S0478","name":"EventBot","url":"https://attack.mitre.org/software/S0478","kind":"malware","description":"[EventBot](https://attack.mitre.org/software/S0478) can collect system information such as OS version, device vendor, and the type of screen lock that is active on the device.(Citation: Cybereason EventBot)","relationship_id":"relationship--92c9106d-a71b-4a4f-a9d4-ef692a0294eb","references":[{"source_name":"Cybereason EventBot","description":"D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.","url":"https://www.cybereason.com/blog/eventbot-a-new-mobile-banking-trojan-is-born"}]},{"id":"S0480","name":"Cerberus","url":"https://attack.mitre.org/software/S0480","kind":"malware","description":"[Cerberus](https://attack.mitre.org/software/S0480) can collect device information, such as the default SMS app and device locale.(Citation: Threat Fabric Cerberus)(Citation: CheckPoint Cerberus)","relationship_id":"relationship--ad0c873b-9e45-44e0-adaf-529921ee7a77","references":[{"source_name":"Threat Fabric Cerberus","description":"Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.","url":"https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html"},{"source_name":"CheckPoint Cerberus","description":"A. Hazum, B. Melnykov, C. Efrati, D. Golubenko, I. Wernik, L. Kuperman, O. Mana. (2020, April 29). First seen in the wild – Malware uses Corporate MDM as attack vector. Retrieved June 26, 2020.","url":"https://research.checkpoint.com/2020/mobile-as-attack-vector-using-mdm/"}]},{"id":"S0485","name":"Mandrake","url":"https://attack.mitre.org/software/S0485","kind":"malware","description":"[Mandrake](https://attack.mitre.org/software/S0485) can access device configuration information and status, including Android version, battery level, device model, country, and SIM operator.(Citation: Bitdefender Mandrake)","relationship_id":"relationship--eceeb39e-887c-4a9b-a93b-a6fd768e455a","references":[{"source_name":"Bitdefender Mandrake","description":"R. Gevers, M. Tivadar, R. Bleotu, A. M. Barbatei, et al.. (2020, May 14). Uprooting Mandrake: The Story of an Advanced Android Spyware Framework That Went Undetected for 4 Years. Retrieved July 15, 2020.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf"}]},{"id":"S0490","name":"XLoader for iOS","url":"https://attack.mitre.org/software/S0490","kind":"malware","description":"[XLoader for iOS](https://attack.mitre.org/software/S0490) can obtain the device’s UDID, version number, and product number.(Citation: TrendMicro-XLoader-FakeSpy)","relationship_id":"relationship--3f392718-87c4-483b-b89f-4f0cc056d251","references":[{"source_name":"TrendMicro-XLoader-FakeSpy","description":"Hiroaki, H., Wu, L., Wu, L.. (2019, April 2). XLoader Disguises as Android Apps, Has FakeSpy Links. Retrieved July 20, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-version-of-xloader-that-disguises-as-android-apps-and-an-ios-profile-holds-new-links-to-fakespy/"}]},{"id":"S0505","name":"Desert Scorpion","url":"https://attack.mitre.org/software/S0505","kind":"malware","description":"[Desert Scorpion](https://attack.mitre.org/software/S0505) can collect device metadata and can check if the device is rooted.(Citation: Lookout Desert Scorpion)","relationship_id":"relationship--6de29595-e63e-4d7e-992f-b4622b7b8e23","references":[{"source_name":"Lookout Desert Scorpion","description":"A. Blaich, M. Flossman. (2018, April 16). Lookout finds new surveillanceware in Google Play with ties to known threat actor targeting the Middle East. Retrieved September 11, 2020.","url":"https://blog.lookout.com/desert-scorpion-google-play"}]},{"id":"S0506","name":"ViperRAT","url":"https://attack.mitre.org/software/S0506","kind":"malware","description":"[ViperRAT](https://attack.mitre.org/software/S0506) can collect system information, including brand, manufacturer, and serial number.(Citation: Lookout ViperRAT)","relationship_id":"relationship--6c859d6b-28b1-409d-90ea-d4eba64edf82","references":[{"source_name":"Lookout ViperRAT","description":"M. Flossman. (2017, February 16). ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar. Retrieved September 11, 2020.","url":"https://blog.lookout.com/viperrat-mobile-apt"}]},{"id":"S0507","name":"eSurv","url":"https://attack.mitre.org/software/S0507","kind":"malware","description":"[eSurv](https://attack.mitre.org/software/S0507)’s iOS version can collect device information.(Citation: Lookout eSurv)","relationship_id":"relationship--4df6a22e-489f-400c-b953-cc53bfb708a3","references":[{"source_name":"Lookout eSurv","description":"A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.","url":"https://blog.lookout.com/esurv-research"}]},{"id":"S0509","name":"FakeSpy","url":"https://attack.mitre.org/software/S0509","kind":"malware","description":"[FakeSpy](https://attack.mitre.org/software/S0509) can collect device information, including OS version and device model.(Citation: Cybereason FakeSpy)","relationship_id":"relationship--873b98de-d7cf-471b-9aa2-229eb03c9165","references":[{"source_name":"Cybereason FakeSpy","description":"O. Almkias. (2020, July 1). FakeSpy Masquerades as Postal Service Apps Around the World. Retrieved September 15, 2020.","url":"https://www.cybereason.com/blog/fakespy-masquerades-as-postal-service-apps-around-the-world"}]},{"id":"S0522","name":"Exobot","url":"https://attack.mitre.org/software/S0522","kind":"malware","description":"[Exobot](https://attack.mitre.org/software/S0522) can obtain the device’s country and carrier name.(Citation: Threat Fabric Exobot)","relationship_id":"relationship--da424f3f-8a93-4a66-858c-b33f587108e6","references":[{"source_name":"Threat Fabric Exobot","description":"Threat Fabric. (2017, February). Exobot - Android banking Trojan on the rise. Retrieved October 29, 2020.","url":"https://www.threatfabric.com/blogs/exobot_android_banking_trojan_on_the_rise.html"}]},{"id":"S0525","name":"Android/AdDisplay.Ashas","url":"https://attack.mitre.org/software/S0525","kind":"malware","description":"[Android/AdDisplay.Ashas](https://attack.mitre.org/software/S0525) can collect information about the device including device type, OS version, language, free storage space, battery status, device root, and if *developer mode* is enabled.(Citation: WeLiveSecurity AdDisplayAshas)","relationship_id":"relationship--1c180c0e-c789-4176-b568-789ada9487bb","references":[{"source_name":"WeLiveSecurity AdDisplayAshas","description":"L. Stefanko. (2019, October 24). Tracking down the developer of Android adware affecting millions of users. Retrieved October 29, 2020.","url":"https://www.welivesecurity.com/2019/10/24/tracking-down-developer-android-adware/"}]},{"id":"S0529","name":"CarbonSteal","url":"https://attack.mitre.org/software/S0529","kind":"malware","description":"[CarbonSteal](https://attack.mitre.org/software/S0529) has gathered device metadata, including model, manufacturer, SD card size, disk usage, memory, CPU, and serial number.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--760faa7b-06cb-48b7-9103-1c52f2ca408f","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0535","name":"Golden Cup","url":"https://attack.mitre.org/software/S0535","kind":"malware","description":"[Golden Cup](https://attack.mitre.org/software/S0535) can collect various pieces of device information, such as serial number and product information.(Citation: Symantec GoldenCup)","relationship_id":"relationship--07036963-6f5e-4eb5-9b20-3f81dd582c85","references":[{"source_name":"Symantec GoldenCup","description":"R. Iarchy, E. Rynkowski. (2018, July 5). GoldenCup: New Cyber Threat Targeting World Cup Fans. Retrieved October 29, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/goldencup-new-cyber-threat-targeting-world-cup-fans"}]},{"id":"S0536","name":"GPlayed","url":"https://attack.mitre.org/software/S0536","kind":"malware","description":"[GPlayed](https://attack.mitre.org/software/S0536) can collect the device’s model, country, and Android version.(Citation: Talos GPlayed)","relationship_id":"relationship--bbe1af69-7303-4205-82d8-5b03c43e39c1","references":[{"source_name":"Talos GPlayed","description":"V. Ventura. (2018, October 11).  GPlayed Trojan - .Net playing with Google Market . Retrieved November 24, 2020.","url":"https://blog.talosintelligence.com/2018/10/gplayedtrojan.html"}]},{"id":"S0540","name":"Asacub","url":"https://attack.mitre.org/software/S0540","kind":"malware","description":"[Asacub](https://attack.mitre.org/software/S0540) can collect various pieces of device information, including device model and OS version.(Citation: Securelist Asacub)","relationship_id":"relationship--496976ef-4a0c-4782-95e7-231bd44df162","references":[{"source_name":"Securelist Asacub","description":"T. Shishkova. (2018, August 28).  The rise of mobile banker Asacub. Retrieved December 14, 2020.","url":"https://securelist.com/the-rise-of-mobile-banker-asacub/87591/"}]},{"id":"S0544","name":"HenBox","url":"https://attack.mitre.org/software/S0544","kind":"malware","description":"[HenBox](https://attack.mitre.org/software/S0544) can collect device information and can check if the device is running MIUI on a Xiaomi device.(Citation: Palo Alto HenBox)","relationship_id":"relationship--9c853c22-7607-4cbd-b114-08aaa4625c35","references":[{"source_name":"Palo Alto HenBox","description":"A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.","url":"https://unit42.paloaltonetworks.com/unit42-henbox-chickens-come-home-roost/"}]},{"id":"S0550","name":"DoubleAgent","url":"https://attack.mitre.org/software/S0550","kind":"malware","description":"[DoubleAgent](https://attack.mitre.org/software/S0550) has accessed common system information.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--f9de9819-b131-459e-948b-bdf3fe6f1ef0","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0551","name":"GoldenEagle","url":"https://attack.mitre.org/software/S0551","kind":"malware","description":"[GoldenEagle](https://attack.mitre.org/software/S0551) has checked for system root.(Citation: Lookout Uyghur Campaign)","relationship_id":"relationship--b9b9ce86-89f6-41ea-8ba1-9520985acb49","references":[{"source_name":"Lookout Uyghur Campaign","description":"A. Kumar, K. Del Rosso, J. Albrecht, C. Hebeisen. (2020, June 1). Mobile APT Surveillance Campaigns Targeting Uyghurs - A collection of long-running Android tooling connected to a Chinese mAPT actor. Retrieved November 10, 2020.","url":"https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf"}]},{"id":"S0555","name":"CHEMISTGAMES","url":"https://attack.mitre.org/software/S0555","kind":"malware","description":"[CHEMISTGAMES](https://attack.mitre.org/software/S0555) has fingerprinted devices to uniquely identify them.(Citation: CYBERWARCON CHEMISTGAMES)","relationship_id":"relationship--0b693e45-cc20-45a9-846f-2f5f4d3a3253","references":[{"source_name":"CYBERWARCON CHEMISTGAMES","description":"B. Leonard, N. Mehta. (2019, November 21). The Secret Life of Sandworms. Retrieved December 31, 2020.","url":"https://www.youtube.com/watch?v=xoNSbm1aX_w"}]},{"id":"S0558","name":"Tiktok Pro","url":"https://attack.mitre.org/software/S0558","kind":"malware","description":"[Tiktok Pro](https://attack.mitre.org/software/S0558) can check the device’s battery status.(Citation: Zscaler TikTok Spyware)","relationship_id":"relationship--8c8ce536-d9b5-4dfc-93f1-84c4f222b49e","references":[{"source_name":"Zscaler TikTok Spyware","description":"S. Desai. (2020, September 8). TikTok Spyware. Retrieved January 5, 2021.","url":"https://www.zscaler.com/blogs/security-research/tiktok-spyware"}]},{"id":"S0577","name":"FrozenCell","url":"https://attack.mitre.org/software/S0577","kind":"malware","description":"[FrozenCell](https://attack.mitre.org/software/S0577) has gathered the device manufacturer, model, and serial number.(Citation: Lookout FrozenCell)","relationship_id":"relationship--c264d954-8b5f-4be1-acf0-6387b7f04fae","references":[{"source_name":"Lookout FrozenCell","description":"Michael Flossman. (2017, October 5). FrozenCell: Multi-platform surveillance campaign against Palestinians. Retrieved November 11, 2020.","url":"https://blog.lookout.com/frozencell-mobile-threat"}]},{"id":"S1056","name":"TianySpy","url":"https://attack.mitre.org/software/S1056","kind":"malware","description":"[TianySpy](https://attack.mitre.org/software/S1056) can gather device UDIDs.(Citation: trendmicro_tianyspy_0122) ","relationship_id":"relationship--4a408dee-07da-4855-b2ff-be512480ccb5","references":[{"source_name":"trendmicro_tianyspy_0122","description":"Trend Micro. (2022, January 25). TianySpy Malware Uses Smishing Disguised as Message From Telco. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/en_us/research/22/a/tianyspy-malware-uses-smishing-disguised-as-message-from-telco.html"}]},{"id":"S1061","name":"AbstractEmu","url":"https://attack.mitre.org/software/S1061","kind":"malware","description":"[AbstractEmu](https://attack.mitre.org/software/S1061) can collect device information such as manufacturer, model, version, serial number, and telephone number.(Citation: lookout_abstractemu_1021)","relationship_id":"relationship--a46c3b05-07d5-461c-b1b1-4a81912b79f8","references":[{"source_name":"lookout_abstractemu_1021","description":"P Shunk, K Balaam. (2021, October 28). Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign. Retrieved February 6, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-global-rooting-malware-campaign"}]},{"id":"S1062","name":"S.O.V.A.","url":"https://attack.mitre.org/software/S1062","kind":"malware","description":"[S.O.V.A.](https://attack.mitre.org/software/S1062) can gather data about the device.(Citation: threatfabric_sova_0921)","relationship_id":"relationship--60ad088f-3133-4b0c-a441-e1e06fff1765","references":[{"source_name":"threatfabric_sova_0921","description":"ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.","url":"https://www.threatfabric.com/blogs/sova-new-trojan-with-fowl-intentions.html"}]},{"id":"S1077","name":"Hornbill","url":"https://attack.mitre.org/software/S1077","kind":"malware","description":"[Hornbill](https://attack.mitre.org/software/S1077) can collect the device ID, model, manufacturer, and Android version. It can also check available storage space and if the screen is locked.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--54bfecbc-4d1d-4bca-bb9c-652d09b29515","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1079","name":"BOULDSPY","url":"https://attack.mitre.org/software/S1079","kind":"malware","description":"[BOULDSPY](https://attack.mitre.org/software/S1079) can collect system information, such as Android version and device identifiers.(Citation: lookout_bouldspy_0423)","relationship_id":"relationship--a25a0454-d6da-4448-a3c5-33648ee6675a","references":[{"source_name":"lookout_bouldspy_0423","description":"Kyle Schmittle, Alemdar Islamoglu, Paul Shunk, Justin Albrecht. (2023, April 27). Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities: BouldSpy. Retrieved July 21, 2023.","url":"https://www.lookout.com/blog/iranian-spyware-bouldspy"}]},{"id":"S1082","name":"Sunbird","url":"https://attack.mitre.org/software/S1082","kind":"malware","description":"[Sunbird](https://attack.mitre.org/software/S1082) can exfiltrate the victim device ID, model, manufacturer, and Android version.(Citation: lookout_hornbill_sunbird_0221)","relationship_id":"relationship--6a813057-5fe0-46b5-89a3-c804d223568c","references":[{"source_name":"lookout_hornbill_sunbird_0221","description":"Apurva Kumar, Kristin Del Rosso. (2021, February 10). Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict. Retrieved June 9, 2023.","url":"https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict"}]},{"id":"S1083","name":"Chameleon","url":"https://attack.mitre.org/software/S1083","kind":"malware","description":"[Chameleon](https://attack.mitre.org/software/S1083) has the ability to gather basic device information, such as version, model, root status, and country.(Citation: cyble_chameleon_0423) [Chameleon](https://attack.mitre.org/software/S1083) has also checked the restricted settings status of the device. If the Android 13 Restricted Settings status is present, an HTML page with instructions on how to enable the Accessibility Service will be shown to the user. Additionally, [Chameleon](https://attack.mitre.org/software/S1083) has checked the keyguard’s status regarding how the device is locked (e.g. pattern, PIN or password).(Citation: ThreatFabric_Chameleon_Dec2023) ","relationship_id":"relationship--06e2e07f-7835-4ef8-bcc0-bb5e2886839d","references":[{"source_name":"cyble_chameleon_0423","description":"Cyble Research & Intelligence Labs. (2023, April 13). Banking Trojan targeting mobile users in Australia and Poland. Retrieved August 16, 2023.","url":"https://cyble.com/blog/chameleon-a-new-android-malware-spotted-in-the-wild/"},{"source_name":"ThreatFabric_Chameleon_Dec2023","description":"ThreatFabric. (2023, December 21). Android Banking Trojan Chameleon can now bypass any Biometric Authentication. Retrieved July 7, 2025.","url":"https://www.threatfabric.com/blogs/android-banking-trojan-chameleon-is-back-in-action"}]},{"id":"S1094","name":"BRATA","url":"https://attack.mitre.org/software/S1094","kind":"malware","description":"[BRATA](https://attack.mitre.org/software/S1094) can retrieve Android system and hardware information.(Citation: securelist_brata_0819)","relationship_id":"relationship--583720d0-8b15-4662-822e-bb40bc1df940","references":[{"source_name":"securelist_brata_0819","description":"Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.","url":"https://securelist.com/spying-android-rat-from-brazil-brata/92775/"}]},{"id":"S1095","name":"AhRat","url":"https://attack.mitre.org/software/S1095","kind":"malware","description":"[AhRat](https://attack.mitre.org/software/S1095) can obtain device info such as manufacturer, device ID, OS version, and country.(Citation: welivesecurity_ahrat_0523)","relationship_id":"relationship--c32cbb0c-b5d7-44ad-94aa-43e2fbade91d","references":[{"source_name":"welivesecurity_ahrat_0523","description":"Lukas Stefanko. (2023, May 23). Android app breaking bad: From legitimate screen recording to file exfiltration within a year. Retrieved December 18, 2023.","url":"https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/"}]},{"id":"S1126","name":"Phenakite","url":"https://attack.mitre.org/software/S1126","kind":"malware","description":"[Phenakite](https://attack.mitre.org/software/S1126) can collect device metadata.(Citation: fb_arid_viper) ","relationship_id":"relationship--99011840-f920-44d1-82f9-a6ff0d4f8c07","references":[{"source_name":"fb_arid_viper","description":"Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20231126111812/https:/about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) collects device information, including the phone number, IMEI, CPU details, screen specifications, and memory information.(Citation: LinkedIn Dmitry LightSpy 2025)(Citation: Threatfabric LightSpy 2024)(Citation: Threatfabric LightSpy 2023)(Citation: MelikovBlackBerry LightSpy 2024)","relationship_id":"relationship--e4451543-136b-4fe2-a8e2-d005db705aa2","references":[{"source_name":"LinkedIn Dmitry LightSpy 2025","description":"Dmitry Bestuzhev. (2025, April 7). The Coordinated Kill Switch: LightSpy's iOS Destructive Plugin Architecture Manages Device Disablement. Retrieved April 14, 2025.","url":"https://www.linkedin.com/pulse/coordinated-kill-switch-lightspys-ios-destructive-plugin-bestuzhev-zhoye/"},{"source_name":"MelikovBlackBerry LightSpy 2024","description":"Melikov, D. (2024, April 11). LightSpy Returns: Renewed Espionage Campaign Targets Southern Asia, Possibly India. Retrieved January 14, 2025.","url":"https://blogs.blackberry.com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-india"},{"source_name":"Threatfabric LightSpy 2023","description":"ThreatFabric. (2023, October 2). LightSpy mAPT Mobile Payment System Attack. Retrieved January 17, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack"},{"source_name":"Threatfabric LightSpy 2024","description":"ThreatFabric. (2024, October 29). LightSpy: Implant for iOS. Retrieved January 30, 2025.","url":"https://www.threatfabric.com/blogs/lightspy-implant-for-ios"}]},{"id":"S1231","name":"GodFather","url":"https://attack.mitre.org/software/S1231","kind":"malware","description":"[GodFather](https://attack.mitre.org/software/S1231) has the ability to gain remote control of the victim device and to gather data associated with the device, including battery level, sound settings, and device brightness.(Citation: ZimperiumOrtegaPratapagiri_GodFather_Jun2025) [GodFather](https://attack.mitre.org/software/S1231) has also obtained the phone's state, including network information, phone number, and serial number.(Citation: MerkleScience_Godfather_April2023) ","relationship_id":"relationship--c6d7f454-8dc1-4928-a668-f71aba491e45","references":[{"source_name":"MerkleScience_Godfather_April2023","description":"Merkle Science. (2023, April 25). The Godfather Android Malware: Threat under the lens. Retrieved July 16, 2025.","url":"https://www.merklescience.com/blog/the-godfather-android-malware-threat-under-the-lens"},{"source_name":"ZimperiumOrtegaPratapagiri_GodFather_Jun2025","description":"Ortega, F. Pratapagiri, V. (2025, June 18). Your Mobile App, Their Playground: The Dark Side of Virtualization. Retrieved July 16, 2025.","url":"https://zimperium.com/blog/your-mobile-app-their-playground-the-dark-side-of-the-virtualization"}]},{"id":"S1241","name":"RatMilad","url":"https://attack.mitre.org/software/S1241","kind":"malware","description":"[RatMilad](https://attack.mitre.org/software/S1241) has collected device information such as model, brand, buildId, Android version and manufacturer.(Citation: ZimperiumGupta_RatMilad_Oct2022) ","relationship_id":"relationship--904221c2-2486-4e0b-905f-5327ee299097","references":[{"source_name":"ZimperiumGupta_RatMilad_Oct2022","description":"Gupta, N. (2022, October 5). We Smell A RatMilad Android Spyware. Retrieved August 27, 2025.","url":"https://zimperium.com/blog/we-smell-a-ratmilad-mobile-spyware"}]},{"id":"S9005","name":"DocSwap","url":"https://attack.mitre.org/software/S9005","kind":"malware","description":"[DocSwap](https://attack.mitre.org/software/S9005) has checked for the `LOCAL_MAC_ADDRESS` permission and has the ability to send system information.(Citation: EnkiWhiteHat_KimsukyDOCSWAP_Dec2025)(Citation: S2W_DocSwap_Mar2025) ","relationship_id":"relationship--1c7d2614-c1a6-4193-8053-e5ca8a15437f","references":[{"source_name":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","description":"EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026.","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source_name":"S2W_DocSwap_Mar2025","description":"Kim, H., S2W TALON. (2025, March 13). Detailed Analysis of DocSwap Malware Disguised as Security Document Viewer. Retrieved January 12, 2026.","url":"https://medium.com/s2wblog/detailed-analysis-of-docswap-malware-disguised-as-security-document-viewer-218a728c36ff"}]},{"id":"S9006","name":"VajraSpy","url":"https://attack.mitre.org/software/S9006","kind":"malware","description":"[VajraSpy](https://attack.mitre.org/software/S9006) has requested for `android.permission.READ_PHONE_STATE` to collect information about the device.(Citation: K7Dhanalakshmi_VajraSpy_April2022) ","relationship_id":"relationship--7c8dadca-5cc0-40d0-a946-afa99c99cbaf","references":[{"source_name":"K7Dhanalakshmi_VajraSpy_April2022","description":"Dhanalakshmi. (2022, April 19).  VajraSpy – An Android RAT. Retrieved November 5, 2025.","url":"https://labs.k7computing.com/index.php/vajraspy-an-android-rat/"}]}],"actors":[{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has included system information enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--6ca3e3d9-2db9-4bed-98a0-417ff1e6a78e","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]}],"mitigations":[],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use owned test devices or emulators, disposable app accounts and test data. Verify platform/version instrumentation; desktop test procedures do not establish mobile coverage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1426":"/ttp-simulation/techniques/mobile/T1426/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"mobile/T1426","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0112","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","api":"android.hardware.camera2.CameraManager.openCamera","result":"permission_denied","thread":"main"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0123","collector":"illustrative-lab-collector","observation":{"package":"test.example.lab","state_before":"background","state_after":"foreground","source":"own_app_callback"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}}]}}