aol.pm

Mandrake

Software · ATTACK:mobile:S0485

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:S0485",
  "title": "Mandrake",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0485",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--52c994fa-b6c8-45a8-9586-a4275cf19307",
  "external_id": "S0485",
  "domain": "mobile",
  "created": "2020-07-15T20:20:58.846Z",
  "modified": "2025-04-25T14:40:26.424Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "oxide"
    },
    {
      "source_name": "briar"
    },
    {
      "source_name": "ricinus"
    },
    {
      "source_name": "darkmatter"
    },
    {
      "source_name": "Bitdefender Mandrake",
      "url": "https://www.bitdefender.com/files/News/CaseStudies/study/329/Bitdefender-PR-Whitepaper-Mandrake-creat4464-en-EN-interactive.pdf"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1655.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07c727a6-6323-477a-bb55-34e130959b4e

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1636.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bc73d69-e769-4d0f-9d44-368c94225b6e

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1633.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a2f6cdc-7c52-4f6e-9182-bc5b16a638dd

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22708018-defd-4690-8b0f-fe47e11cb5d6

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1541

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24951cfe-d3ce-4802-86ff-028fc9cbbe53

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1409

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27b8153c-130e-44a7-84a9-840f4c23e2ea

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1509

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--657f1d8c-3982-4ee5-95dc-c8ec3164cb2e

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1582

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--734fa2bf-17af-4e54-8d83-4cf9759e4ba9

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74eb8469-1cce-40f8-8b6b-486338e8cfbe

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1629.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8611661c-04b4-4a82-9669-2d0e26b7b3f3

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1406

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f2ff9c5-249d-4a9a-bdc6-0cef887eaefc

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1629.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fa03a70-ad00-4148-ae5e-8315f3e618d2

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1481.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a34f3873-3df7-4e93-915c-fc2b4af3444d

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1516

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af55d12a-5f58-4135-90d0-f465a66f7a3f

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1430

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba5fc090-d420-4006-9dc0-57b75260b5f6

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1418

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baa82c0a-b51c-4d4a-ae1d-6d6fd637f78d

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1417.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb34aff0-9af9-463b-a1aa-7f5ec7b84630

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1632.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd1e016a-1ebb-4f30-9342-998f656dd8b8

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1628.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c574251b-93ad-4f55-8b84-2700dfab4622

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1407

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce82a76-5390-473d-9e7c-9450d1509d1d

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1637.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddb5ba6d-0549-44bd-a669-972bd48e927b

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1630.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ece70dca-803c-4209-8792-7e56e9901288

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1426

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eceeb39e-887c-4a9b-a93b-a6fd768e455a

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1544

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0a0005e-cc38-4f7a-ba49-21a4c48ae1a1

Bitdefender Mandrake

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1636.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fda8fe32-6121-4b81-9aa0-4e9596db88b1

Bitdefender Mandrake

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.