Agent Smith
Software · ATTACK:mobile:S0440
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:mobile:S0440",
"title": "Agent Smith",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0440",
"snapshot": "mobile-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a6228601-03f6-4949-ae22-c1087627a637",
"external_id": "S0440",
"domain": "mobile",
"created": "2020-05-07T15:18:34.417Z",
"modified": "2026-09-02T18:53:38.236Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CheckPoint Agent Smith",
"url": "https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:mobile:S0440 → uses → ATTACK:mobile:T1643
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4de3f794-63df-4f9e-8bd8-59796d91aa36
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1424
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5107be8a-b5fc-4442-af0d-2c92e086a912
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1418
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a821e14-8247-408b-af37-9cecbba616ec
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1628.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d6bba99-ea81-42bc-b02a-e5e98b34a688
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1630.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8634a732-1c5e-4931-a24f-cdcc2f81c788
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1404
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96490f73-d8ef-4c6b-9a3a-3c66fc963306
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1655.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df07166f-917e-4bc4-899e-d689d1d3f785
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1577
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e29d91f0-ebee-481d-9344-702c90775109
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1476
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e723fde7-7fa9-4ac8-a8ec-3fcbf097dbc8
CheckPoint Agent SmithATTACK:mobile:S0440 → uses → ATTACK:mobile:T1406.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5d24a31-53d2-4e84-9110-2da0582132cb
CheckPoint Agent Smith