Skip to content

AbstractEmu

Software · ATTACK:mobile:S1061

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:S1061",
  "title": "AbstractEmu",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1061",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--2aec175b-4429-4048-8e09-3ef6cbecfc64",
  "external_id": "S1061",
  "domain": "mobile",
  "created": "2023-02-06T18:48:41.442Z",
  "modified": "2025-04-16T21:22:06.208Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "lookout_abstractemu_1021",
      "url": "https://www.lookout.com/blog/lookout-discovers-global-rooting-malware-campaign"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--006b3910-e9c3-4de8-ba49-dff36b1a3308

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1633.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--021ca5c4-7e8a-439b-8c2e-38f817db63e3

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1623.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0727ac06-5b46-4f79-abe9-63c1b923d383

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09d08f16-9e4d-4279-9a8c-bdda7afdb37d

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1422.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--112966ab-6e28-482b-8bea-ed9f4ed17064

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1422

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c67b72f-7389-4c21-9347-2b1bba07aaaf

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1633

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23ecc134-0623-45ec-b8b5-52516483bda1

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1404

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25655385-5b0d-4700-a59f-d5d043625b84

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1437.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d37400f-80f9-4500-9357-185650e5a7b2

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dd9e0aa-e4dc-4776-9580-5a765c2cc08d

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1429

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--644a19d3-c94f-40d9-87ac-02ef20b14eda

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1646

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bb4de7d-1ef9-4bc8-8d34-62e176d4188a

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1629.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75ed2348-279f-4485-97a3-9a5ada27d799

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d72c224-0cf5-4b9b-a98a-76ee3a406803

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a46c3b05-07d5-461c-b1b1-4a81912b79f8

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1533

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad723fb0-7439-407e-9bf5-1cb3fd7df8aa

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1512

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b309c25a-6baf-4874-829d-63712a38652c

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7c8abf7-d4e4-40a4-aa2a-ee995a6f4f10

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7f876d4-99f2-41ac-993c-57a3f2b4e0eb

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1626.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d64c4924-76f0-4b2e-858d-b0df733334d0

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbeff88d-441f-47f9-8afc-60400ee3ab97

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e457921c-4a0b-4d6e-92e7-553929ddf943

lookout_abstractemu_1021

ATTACK:mobile:S1061 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eba4b561-84c9-4d49-a8b8-1842c3ed94f3

lookout_abstractemu_1021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.