Indicator Removal on Host: Uninstall Malicious Application

ID	Name
T1630.001	Uninstall Malicious Application
T1630.002	File Deletion
T1630.003	Disguise Root/Jailbreak Indicators

Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by:

Abusing device owner permissions to perform silent uninstallation using device owner API calls.
Abusing root permissions to delete files from the filesystem.
Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.

ID: T1630.001

Sub-technique of: T1630

Tactic Type: Post-Adversary Device Access

ⓘ

Tactic: Defense Evasion

ⓘ

Platforms: Android

ⓘ

MTC ID: APP-43

Version: 1.1

Created: 30 March 2022

Last Modified: 12 May 2026

Procedure Examples

ID	Name	Description
S1094	BRATA	BRATA can uninstall itself and remove traces of infection.^[1]^[2]
S0480	Cerberus	Cerberus can uninstall itself from a device on command.^[3]
S9004	Crocodilus	Crocodilus has the ability to uninstall itself from the device.^[4]
S1092	Escobar	Escobar can uninstall itself and other applications.^[5]
S1062	S.O.V.A.	S.O.V.A. can uninstall itself.^[6]
S1055	SharkBot	SharkBot has C2 commands that can uninstall the app from the infected device.^[7]
S0427	TrickMo	TrickMo can uninstall itself from a device on command by abusing the accessibility service.^[8]

ID	Mitigation	Description
M1002	Attestation	Attestation can detect rooted devices. Mobile security software can then use this information and take appropriate mitigation action. Attestation can detect rooted devices.
M1001	Security Updates	Security updates typically provide patches for vulnerabilities that enable device rooting.
M1011	User Guidance	Inform users that device rooting or granting unnecessary access to the accessibility service presents security risks that could be taken advantage of without their knowledge.

ID	Name	Analytic ID	Analytic Description
DET0690	Detection of Uninstall Malicious Application	AN1801	For Android, detect Uninstall Malicious Application from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; File Deletion via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App deletes package files or local state immediately before package inventory disappearance — pre-removal evidence cleanup]; OS API Execution via Application Vetting / Instrumented Dynamic Analysis [Dynamic API/runtime trace: App invokes PackageInstaller uninstall or pm uninstall for own package or companion package NOT IN $ProtectedPackageList$ without user-initiated UI flow matching]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.