---
title: Device Admin Malware Behavior | Guardsquare
description: Malware often aims to become a device admin app, allowing it full control over a device and its security. Learn about this and other malware behaviors.
---

[![guardsquare-logo](https://insights.guardsquare.com/hs-fs/hubfs/Logos/logo-white.png?length=536&name=logo-white.png "guardsquare-logo") ](https://23593082.hs-sites.com/)

- pricing

[Request Pricing](https://www.guardsquare.com/request-pricing?hsCtaTracking=646b0379-d596-4b1a-8526-2ccbdbb0f81b%7Ce8809087-a83f-4476-8b22-34b9572013fd)

[Login](https://customers.guardsquare.com/login?utm_referrer=https%3A%2F%2Fwww.guardsquare.com%2F)

En

- [中文](https://www.guardsquare.com/zh-hans)
- [한국어](https://www.guardsquare.com/ko)
- [Português](https://www.guardsquare.com/pt-br)
- [Español](https://www.guardsquare.com/es)

# [Mobile Application]

# Security Research Center

 Table of contents

# Device admin privileges

Malware often aims to become a device admin app. This status confers advanced capabilities such as wiping data; performing actions on the screen lock (i.e., changing the screen lock, setting password rules, monitoring screen unlock attempts, locking the screen, setting screen lock password expiration, etc.); setting storage encryption; disabling the camera, amongst others. All these actions are usually triggered remotely from a [command-and-control](https://23593082.hs-sites.com/knowledgebasetest/glossary) admin panel. Moreover, an application cannot be uninstalled as long as it is registered as an administrator.

## Obtaining device admin privileges

Obtaining device admin privileges can be achieved through:

- Nagging the user to provide privileges
- Automating through accessibility services
  
  ![Manually obtaining device admin privileges](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/admin-obtain.gif?width=250&height=511&name=admin-obtain.gif)  
  *Malware is granted device admin privileges*

## Resisting permission revocation

Once malware obtains the device admin rights, it can resist attempts at uninstallation, privilege revocation, and more.

![Unsuccessful attempt to uninstall a device admin app](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/admin-prevent-uninstall.png?width=620&height=58&name=admin-prevent-uninstall.png)

*Attempt to uninstall a malicious application that has obtained device admin rights*

*![Unsuccessful attempt to consult app settings](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/admin-prevent-app-settings.gif?width=250&height=539&name=admin-prevent-app-settings.gif)Attempt to change settings of a malicious application that has obtained device admin rights*

*![Unsuccessful attempt to revoke rights](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/admin-prevent-deactivation.gif?width=250&height=534&name=admin-prevent-deactivation.gif)*

*Attempt to deactivate a malicious application that has obtained device admin rights*

 

## [Guardsquare](https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare)

Connect with the author

** Table of contents **

![HubSpot CMS](https://cdn2.hubspot.net/hubfs/302335/hubspot-cms-logo-gray.svg "HubSpot CMS")

[General Terms](https://23593082.hs-sites.com/terms-of-use) | [Privacy Policy](https://23593082.hs-sites.com/privacy-policy) | [Cookie Policy](https://23593082.hs-sites.com/cookie-policy)

Tervuursevest 362 bus 1, 3000 Leuven, Belgium | VAT: BE0550675829 |

© 2016-2026 Guardsquare nv. All rights reserved.

<https://www.facebook.com/guardsquare> <https://twitter.com/Guardsquare> <https://www.linkedin.com/company/guardsquare/> <https://www.youtube.com/channel/UCP9s5F1ksT1E-7vSF2CDyhw> <https://github.com/Guardsquare>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsquare",
    "url" : "https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare"
  },
  "dateModified" : "2024-02-28T03:01:16.557Z",
  "datePublished" : "2024-02-13T19:34:46.000Z",
  "headline" : "Device Admin Malware Behavior | Guardsquare",
  "mainEntityOfPage" : {
    "@id" : "https://23593082.hs-sites.com/knowledgebasetest/behaviors/device-admin",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    }
  }
}
```