T1630.001: Uninstall Malicious Application
Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by: * Abusing device owner permissions to perform silent uninstallation using device owner API calls. * Abusing root permissions to delete files from the filesystem. * Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.
Security context for executives and security teams
This Android mobile behavior matters because malware may remove itself from a device after achieving its objective or when it wants to reduce visible evidence. For leaders, the risk is not just the uninstall event; it is the potential loss of mobile forensic artifacts, reduced security reporting, and delayed confirmation of what happened on a user device.
Executive priority
Prioritize this where Android devices access enterprise resources, financial workflows, or identity/2FA processes. The supplied ATT&CK relationships show this behavior is used by multiple Android banking malware families, so security leaders should ask whether mobile posture controls, attestation, patch enforcement, and incident response processes can still make access decisions and preserve evidence when a suspicious app disappears.
Technical view
T1630.001 is an Android sub-technique of Indicator Removal on Host. ATT&CK describes three paths: abusing device owner permissions for silent uninstall, abusing root permissions to delete files, or abusing Accessibility Service to confirm an uninstall flow. Because no official detection text is provided, SOC and mobile security teams should validate coverage against the related detection strategy DET0690 and test whether EMM/MDM, mobile threat defense, and device telemetry can correlate app removal with device-owner status, root indicators, Accessibility Service abuse, and prior suspicious app presence.
Likely telemetry
- Android application install/uninstall inventory and timestamps from EMM/MDM or mobile security tooling
- Device owner / device administrator status changes and privileged management actions
- Accessibility Service enablement, permission changes, and suspicious interaction patterns around uninstall prompts
- Root or device integrity signals, including attestation failures where available
- Filesystem or application package disappearance where mobile forensic collection is available
Detection direction
- Validate that uninstall events are retained even when the app that generated prior alerts is no longer present.
- Correlate app removal with recent Accessibility Service enablement, device owner permission abuse, root indicators, or attestation failure.
- Tune triage to distinguish normal user-driven app removal from uninstall activity involving suspicious permissions or prior mobile threat alerts.
- Confirm DET0690 applicability locally; the relationship exists, but ATT&CK did not provide detection implementation details in the supplied fields.
- Watch for blind spots where personal/BYOD Android devices, unmanaged devices, or devices without mobile security agents cannot provide reliable uninstall or integrity telemetry.
Mitigation priorities
- Use security update policy as a baseline: require recent Android security patch levels and restrict enterprise access from devices that are no longer receiving updates.
- Enable remote attestation where available and block or limit enterprise access for devices that fail integrity checks.
- Provide user guidance on risky behaviors relevant to this technique, especially granting Accessibility Service, device owner, or other high-risk permissions to untrusted apps.
- Ensure incident response playbooks account for self-uninstalling mobile malware by preserving available EMM/MDM, attestation, and mobile security logs quickly.
Additional notes and limits
The relationship set is meaningful: this behavior is used by several Android malware entries in ATT&CK, including TrickMo, Cerberus, SharkBot, S.O.V.A., Escobar, BRATA, and Crocodilus. That supports treating self-uninstall behavior as a mobile threat hunting and IR readiness concern, especially for Android devices involved in sensitive access or financial workflows.
ATT&CK provides no official detection text and no tactics for this sub-technique in the supplied object. The detection strategy relationship is named but not detailed here. Local platform management, logging depth, BYOD policy, and mobile security tooling will determine whether this behavior is observable.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Uninstall Malicious Application
Adversaries may include functionality in malware that uninstalls the malicious application from the device. This can be achieved by: * Abusing device owner permissions to perform silent uninstallation using device owner API calls. * Abusing root permissions to delete files from the filesystem. * Abusing the accessibility service. This requires sending an intent to the system to request uninstallation, and then abusing the accessibility service to click the proper places on the screen to confirm uninstallation.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Mobile | T1630 | Indicator Removal on Host | This object subtechnique of Indicator Removal on Host. |
| Mobile | T1576 | Uninstall Malicious Application | Uninstall Malicious Application revoked by this object. |
Groups, software, and campaigns
S1094: BRATA
BRATA (Brazilian Remote Access Tool, Android), is an evolving Android malware strain, detected in late 2018 and again in late 2021. Originating in Brazil, BRATA was later also found in the UK, Poland, Italy, Spain, and USA, where it is believed to have targeted financial institutions such as banks. There are currently three known variants of BRATA.[1][2][3]
S1055: SharkBot
S1062: S.O.V.A.
S.O.V.A. is an Android banking trojan that was first identified in August 2021 and has subsequently been found in a variety of applications, including banking, cryptocurrency wallet/exchange, and shopping apps. S.O.V.A., which is Russian for "owl", contains features not commonly found in Android malware, such as session cookie theft.[1][2]
S0427: TrickMo
S9004: Crocodilus
Crocodilus is an Android banking Trojan that was discovered in March 2025. Crocodilus targeted users worldwide, including Turkey, Poland, Argentina, Brazil, Spain, the United States, Indonesia and India. Crocodilus has been customized based on the target location. For example, Crocodilus mimicked major Turkish and Spanish banks for users in Turkey and Spain, while users in Poland saw Facebook advertisements that promoted Crocodilus to claim bonus points.[1][2]
S0480: Cerberus
S1092: Escobar
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 27a744b1b853… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]securelist_brata_0819
Securelist. (2019, August 29). Fully equipped Spying Android RAT from Brazil: BRATA. Retrieved December 18, 2023.
Open source URL - [2]mcafee_brata_0421
Fernando Ruiz. (2021, April 12). BRATA Keeps Sneaking into Google Play, Now Targeting USA and Spain. Retrieved December 18, 2023.
Open source URL - [3]nccgroup_sharkbot_0322
RIFT: Research and Intelligence Fusion Team. (2022, March 3). SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store. Retrieved January 18, 2023.
Open source URL - [4]threatfabric_sova_0921
ThreatFabric. (2021, September 9). S.O.V.A. - A new Android Banking trojan with fowl intentions. Retrieved February 6, 2023.
Open source URL - [5]SecurityIntelligence TrickMo
P. Asinovsky. (2020, March 24). TrickBot Pushing a 2FA Bypass App to Bank Customers in Germany. Retrieved April 24, 2020.
Open source URL - [6]ThreatFabric_Crocodilus_March2025
ThreatFabric. (2025, March 28). Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices. Retrieved November 24, 2025.
Open source URL - [7]Threat Fabric Cerberus
Threat Fabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved June 26, 2020.
Open source URL - [8]Bleeipng Computer Escobar
B. Toulas. (2022, March 12). Android malware Escobar steals your Google Authenticator MFA codes. Retrieved September 28, 2023.
Open source URL - [9]NIST Mobile Threat CatalogueAPP-43Open source URL
- [10]NIST Mobile Threat CatalogueAPP-43Open source URL
- [11]mitre-attackT1630.001Open source URL
- [12]mitre-attackT1630.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.