Android dropper: runtime DEX/class loading of a staged payload

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

Cleartext HTTP C2 to a hardcoded public IP literal

Embeds an http:// URL pointing at a raw public IP address, frequently on a non-standard port. Modern applications use TLS and DNS names, so a hardcoded cleartext IP endpoint usually indicates a disposable command-and-control host chosen to survive domain takedown.

Covert microphone or camera capture with exfiltration

Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

Device fingerprinting via getprop and logcat harvesting

Shells out to read system properties and dump the device log buffer. Property enumeration is used to detect emulators and profile the victim, while log harvesting can capture tokens and diagnostic data written by other applications.