MITRE ATT&CKsoftware (malware)
S0485 Mandrake
- Domain
- mobile
- Platforms
- Android
- Aliases
- oxide, briar, ricinus, darkmatter
- Version
- 1.0
- Created
- 2020-07-15
Description
Mandrake is a sophisticated Android espionage platform that has been active in the wild since at least 2016. Mandrake is very actively maintained, with sophisticated features and attacks that are executed with surgical precision.
Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.
Related
Uses · MITRE ATT&CK (25)
- T1655.001 Match Legitimate Name or Location sub-technique
- T1481.002 Bidirectional Communication sub-technique
- T1417.002 GUI Input Capture sub-technique
- T1637.001 Domain Generation Algorithms sub-technique
- T1629.001 Prevent Application Removal sub-technique
- T1629.003 Disable or Modify Tools sub-technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1628.001 Suppress Application Icon sub-technique
- T1630.002 File Deletion sub-technique
- T1632.001 Code Signing Policy Modification sub-technique
- T1633.001 System Checks sub-technique
- T1582 SMS Control technique
- T1544 Ingress Tool Transfer technique
- T1541 Foreground Persistence technique
- T1516 Input Injection technique
- T1517 Access Notifications technique
- T1513 Screen Capture technique
- T1509 Non-Standard Port technique
- T1406 Obfuscated Files or Information technique
- T1407 Download New Code at Runtime technique
- T1409 Stored Application Data technique
- T1418 Software Discovery technique
- T1426 System Information Discovery technique
- T1430 Location Tracking technique