Skip to content

SpyDealer

Software · ATTACK:mobile:S0324

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:S0324",
  "title": "SpyDealer",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0324",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--86fc6f0c-86d9-473e-89f3-f50f3cb9319b",
  "external_id": "S0324",
  "domain": "mobile",
  "created": "2018-10-17T00:14:20.652Z",
  "modified": "2025-04-25T14:40:31.154Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SpyDealer"
    },
    {
      "source_name": "PaloAlto-SpyDealer",
      "url": "https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/"
    }
  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ced57a7-b674-40d4-98b8-a090963a6ade

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b41d649-bcd0-4427-baa1-15a145bace6e

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7017085c-c612-48b2-b655-e18d7822d0e7

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70367e5c-15e0-4bcd-b538-7a90c4eefd30

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1644

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935fd3e3-dd47-4c43-bdd8-1668af26395f

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd351b17-e995-4528-bbea-e1138c51476a

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be136fd1-6949-4de6-be37-6d76f8def41a

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd503879-ccb4-4d47-af5a-90fe7e37c438

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8d773ab-b0e3-484b-bdb8-c1a1ab48d218

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1624.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4019493-bd52-4011-9355-8902be6ff3f3

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4e4c3ae-4c4d-4eba-8330-022464cbf828

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6770c26-ae93-468d-acaa-ab4ffea0e047

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6a451e8-2125-4bbe-be52-e682523cd169

PaloAlto-SpyDealer

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcb3a139-f644-45c9-8123-dfea0455143a

PaloAlto-SpyDealer

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.