Obtains sensitive information copied to the device clipboard

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Checks if the internet connection is available

Looks up external IP address via web service

Uses a legitimate IP lookup service to find the infected system's external IP.

Requests disabling of battery optimizations (often used to enable hiding in the background).