Skip to content

Software Packing

Subtechnique · ATTACK:mobile:T1406.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:T1406.002",
  "title": "Software Packing",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1406/002",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--51636761-2e35-44bf-9e56-e337adf97174",
  "external_id": "T1406.002",
  "domain": "mobile",
  "created": "2022-03-30T19:20:37.864Z",
  "modified": "2026-05-12T15:12:00.632Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "defense-evasion"
  ],
  "source_references": [

  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0432 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b1e5e78-9ee1-4fc3-9fe7-dc069b59e77d

ATTACK:mobile:T1406.002 → subtechnique-of → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6661823b-4fdd-4879-ad5d-64c9a4b12519

ATTACK:mobile:S0406 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67c2b73d-cd51-4894-a7bd-fdd5d14b33a2

Talos Gustuff Apr 2019

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78417fce-5aaa-4ad3-a2f1-279fa18bfe45

threatfabric_sova_0921

ATTACK:mobile:S1225 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb2fcc6e-2728-4961-96f4-583e24c45e28

TrendMicro_CherryBlos_July2023

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc2c709d-89cf-46b9-98d3-385e33c23e34

ThreatFabric_Crocodilus_June2025

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1406.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfdf329f-8fc3-4dcb-89b4-c3f1095cd77a

mcafee_brata_0421

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.