MITRE ATT&CKsub-technique

T1628.001 Suppress Application Icon

Published 2022-03-30 Modified 2025-10-24 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android
Version
1.1
Created
2022-03-30

Description

A malicious application could suppress its icon from being displayed to the user in the application launcher. This hides the fact that it is installed, and can make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions. This behavior has been seen in the BankBot/Spy Banker family of malware. Beginning in Android 10, changes were introduced to inhibit malicious applications’ ability to hide their icon. If an app is a system app, requests no permissions, or does not have a launcher activity, the application’s icon will be fully hidden. Further, if the device is fully managed or the application is in a work profile, the icon will be fully hidden. Otherwise, a synthesized activity is shown, which is a launcher icon that represents the app’s details page in the system settings. If the user clicks the synthesized activity in the launcher, they are taken to the application’s details page in the system settings.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1628 Hide Artifacts technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1011 User Guidance mitigation
  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (21)

  • S1195 SpyC23 software (malware)
  • S1103 FlixOnline software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1054 Drinik software (malware)
  • S0655 BusyGasper software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0550 DoubleAgent software (malware)
  • S0525 Android/AdDisplay.Ashas software (malware)
  • S0509 FakeSpy software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0485 Mandrake software (malware)
  • S0480 Cerberus software (malware)
  • S0440 Agent Smith software (malware)
  • S0423 Ginp software (malware)
  • S0418 ViceLeaker software (malware)
  • S0419 SimBad software (malware)
  • S0411 Rotexy software (malware)
  • S0408 FlexiSpy software (tool)
  • S0406 Gustuff software (malware)
  • S0302 Twitoor software (malware)
  • S0311 YiSpecter software (malware)

References