MITRE ATT&CKsub-technique

T1630.001 Uninstall Malicious Application

Published 2022-03-30 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android
Version
1.1
Created
2022-03-30

Description

Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by: • Abusing device owner permissions to perform silent uninstallation using device owner API calls. • Abusing root permissions to delete files from the filesystem. • Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1630 Indicator Removal on Host technique

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1001 Security Updates mitigation
  • M1002 Attestation mitigation
  • M1011 User Guidance mitigation

Referenced by MITRE ATT&CK · uses (7)

  • S9004 Crocodilus software (malware)
  • S1094 BRATA software (malware)
  • S1092 Escobar software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1055 SharkBot software (malware)
  • S0480 Cerberus software (malware)
  • S0427 TrickMo software (malware)

References