Android dropper: runtime DEX/class loading of a staged payload

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

Boot-triggered restart with disguised foreground service

Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

Contact harvesting with SMS self-propagation

Reads the device contact list and sends messages to the retrieved numbers, the distribution mechanism behind SMS worm campaigns. The victim's own address book becomes the delivery channel, which is why these campaigns spread rapidly within a region.

Covert microphone or camera capture with exfiltration

Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

Encrypted or packed staged payload inside Android package

Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.

Root, emulator and instrumentation-framework detection

Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

Checks if the Android device is rooted.