- Home
- Techniques
- Mobile
- Suppress Application Icon
Suppress Application Icon
A malicious application could suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed, and to make it more difficult for the user to uninstall the application. Hiding the application's icon programmatically does not require any special permissions.
This behavior has been seen in the BankBot/Spy Banker family of malware.[1][2][3]
Procedure Examples
| Name | Description |
|---|---|
| Agent Smith |
Agent Smith can hide its icon from the application launcher.[11] |
| Cerberus |
Cerberus hides its icon from the application drawer after being launched for the first time.[12] |
| FlexiSpy |
FlexiSpy is capable of hiding SuperSU's icon if it is installed and visible.[4] FlexiSpy can also hide its own icon to make detection and the uninstallation process more difficult.[5] |
| Ginp | |
| Gustuff | |
| Rotexy | |
| SimBad | |
| ViceLeaker |
ViceLeaker includes code to hide its icon, but the function does not appear to be called in an analyzed version of the software.[9] |
Mitigations
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Detection
The user can examine the list of all installed applications, including those with a suppressed icon, in the device settings.
References
- Lukáš Štefanko. (2018, December 11). Android Trojan steals money from PayPal accounts even with 2FA on. Retrieved July 11, 2019.
- Lukáš Štefanko. (2017, February 22). Sunny with a chance of stolen credentials: Malicious weather app found on Google Play. Retrieved July 11, 2019.
- NJCCIC. (2017, March 2). BankBot/Spy Banker. Retrieved July 11, 2019.
- K. Lu. (n.d.). Deep Technical Analysis of the Spyware FlexiSpy for Android. Retrieved September 10, 2019.
- FlexiSpy. (n.d.). FlexiSpy Monitoring Features. Retrieved September 4, 2019.
- T. Shishkova, L. Pikman. (2018, November 22). The Rotexy mobile Trojan – banker and ransomware. Retrieved September 23, 2019.
- Group-IB. (2019, March 28). Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications. Retrieved September 3, 2019.
- Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.
- L. Arsene, C. Ochinca. (2018, August 20). Triout – Spyware Framework for Android with Extensive Surveillance Capabilities. Retrieved January 21, 2020.
- ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.
- A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
- Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.