Makes use of the framework's foreground persistence service

Application may abuse the framework's foreground service to continue running in the foreground.

Registers a broadcast receiver at runtime (usually for listening for system events)

Acquires the wake lock

Schedules tasks to execute at a specified time

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.