Loads dropped Dex/Jar

Runs executable file dropped to the device during analysis.

Locks the device screen

Application may abuse the framework's APIs to lock the legitimate user out of the device.

Makes use of the framework's Accessibility service

Retrieves information displayed on the phone screen using AccessibilityService.

Acquires the wake lock

Makes use of the framework's foreground persistence service

Application may abuse the framework's foreground service to continue running in the foreground.

Requests enabling of the accessibility settings.

Requests modifying system settings.

Changes the wallpaper (common with ransomware activity)