Checks Android system properties for emulator presence.

Checks known Qemu pipes.

Checks for known pipes used by the Android emulator to communicate with the host.

Obtains sensitive information copied to the device clipboard

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

Queries information about running processes on the device

Application may abuse the framework's APIs to collect information about running processes on the device.

Declares services with permission to bind to the system

Legitimate hosting services abused for malware hosting/C2

Queries information about active data network

Queries the mobile country code (MCC)

Reads information about phone network operator.

Requests cell location

Uses Android APIs to to get current cell information.

Requests dangerous framework permissions