aol.pm

Compromise Client Software Binary

Technique · ATTACK:mobile:T1645

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1645",
  "title": "Compromise Client Software Binary",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1645",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4f14e30b-8b57-4a7b-9093-2c0778ea99cf",
  "external_id": "T1645",
  "domain": "mobile",
  "created": "2022-03-30T19:53:27.791Z",
  "modified": "2025-10-24T17:48:45.611Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "Android-VerifiedBoot",
      "url": "https://source.android.com/security/verifiedboot/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-27.html",
      "external_id": "APP-27"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02b5cb07-9eb5-4e47-a4df-9c3985ad70fc

SecureList BusyGasper

ATTACK:mobile:M1003 → mitigates → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--049c39ab-c036-457a-9b8f-4318416658b8

ATTACK:mobile:S0293 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e9edc13-7af7-43c4-8ec2-636b1f8cb7f1

Lookout-BrainTest

ATTACK:mobile:S0294 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18afa4ad-4fd7-47ad-acdb-3b298b640d3c

Lookout-Adware

ATTACK:mobile:S0550 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2908f0f6-2408-41a1-aaab-cf3e7db06aad

Lookout Uyghur Campaign

ATTACK:mobile:M1004 → mitigates → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44da429b-9dee-43c9-9397-445c6f9e647e

ATTACK:mobile:S0289 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69718f1d-7761-41ae-b9d0-12c45f6b4ac4

Lookout-Pegasus

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70367e5c-15e0-4bcd-b538-7a90c4eefd30

PaloAlto-SpyDealer

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d72c60b-d5d1-4b50-a01f-3882ddb335d9

Lookout-Monokle

ATTACK:mobile:M1001 → mitigates → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcc8eb7a-d2a8-41d2-832e-f435e51c685a

ATTACK:mobile:M1002 → mitigates → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfd0d9cb-27e2-42a2-9207-764bb1491962

ATTACK:mobile:S0316 → uses → ATTACK:mobile:T1645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7ae7fb1-c363-4969-a4af-e2dd44a3c064

Lookout-PegasusAndroid

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.