Covert microphone or camera capture with exfiltration

Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

Device fingerprinting via getprop and logcat harvesting

Shells out to read system properties and dump the device log buffer. Property enumeration is used to detect emulators and profile the victim, while log harvesting can capture tokens and diagnostic data written by other applications.

Root, emulator and instrumentation-framework detection

Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.