Cleartext HTTP C2 to a hardcoded public IP literal

Embeds an http:// URL pointing at a raw public IP address, frequently on a non-standard port. Modern applications use TLS and DNS names, so a hardcoded cleartext IP endpoint usually indicates a disposable command-and-control host chosen to survive domain takedown.

Covert microphone or camera capture with exfiltration

Opens audio or camera capture outside any user-facing recording feature and pairs it with file staging and network transmission. The absence of a foreground recording interface alongside these primitives indicates surveillance rather than a legitimate media function.

Root, emulator and instrumentation-framework detection

Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.