0/62

Threat

com.samsung.unifiedtp

Tethering Provision

Analyzed on 2022-05-27T14:56:55.716161

18

permissions

1

activities

5

services

3

receivers

8

domains

File sums

MD5 4b4ffc3ba2d76e733f80034e9cda7bed
SHA1 20718612c93ed6f9ccc4972cf82d46f1fc10e697
SHA256 24fe72ca8b025c7c71209aed6d1ed4ddd044ff7bb1dafc761167a4ed5fe19a00
Size 1.56MB

APKiD

Information computed with APKiD.

/tmp/tmp5j2hjm66!classes.dex
compiler
  • r8

SSdeep

Information computed with ssdeep.

APK file 49152:YND+B5Rw/t2sFebjKHT1GGuMBgD/AZVakRiBgv:YZ+BPw/t2s8SgG2D/G84
Manifest 192:LsODwmcOiCOeY3f8oydAgTli9MDzlCOrsG/qSzWitlSGxJouw9UVo688AdZu:YODw…
classes.dex 24576:oeYl0GYAvdvF2fADyarmOkUqWfW0w3iCC+B9d4JgGd23nra5ZPbh7itY89XAXQX…

Dexofuzzy

Information computed with Dexofuzzy.

APK file 3072:HWqiFvFlNhltGwzumiSoHUL0K3OjG/mPZsDBHuANVFe/PT7kh3H1udf81AUXUBw2…
classes.dex 3072:HWqiFvFlNhltGwzumiSoHUL0K3OjG/mPZsDBHuANVFe/PT7kh3H1udf81AUXUBw2…

APK details

Information computed with AndroGuard and Pithus.

Package com.samsung.unifiedtp
App name Tethering Provision
Version name 1.0.07.6
Version code 100706100
SDK 26 - 30
UAID b36f60986cbd666db75830e1cd5988ec345a430d
Signature Signature V1 Signature V2
Frosting Not frosted
Blocks found within V2 signature:
  • 0x7109871a: Unknown

Certificate details

Information computed with AndroGuard.

MD5 d087e72912fba064cafa78dc34aea839
SHA1 9ca5170f381919dfe0446fcdab18b19a143b3163
SHA256 34df0e7a9f1cf1892e45c056b4973cd81ccf148a4050d11aea4ac5a65f900a42
Issuer Email Address: android.os@samsung.com, Common Name: Samsung Cert, Organizational Unit: DMC, Organization: Samsung Corporation, Locality: Suwon City, State/Province: South Korea, Country: KR
Not before 2011-06-22T12:25:12+00:00
Not after 2038-11-07T12:25:12+00:00

File Analysis

Information computed with MobSF.

Findings Files
Certificate/Key files hardcoded inside the app. SEC-INF/buildConfirm.crt

Manifest analysis

Information computed with MobSF.

High Clear text traffic is Enabled For App[android:usesCleartextTraffic=true]
The app intends to use cleartext network traffic, such as cleartext HTTP, FTP stacks, DownloadManager, and MediaPlayer. The default value for apps that target API level 27 or lower is "true". Apps that target API level 28 or higher default to "false". The key reason for avoiding cleartext traffic is the lack of confidentiality, authenticity, and protections against tampering; a network attacker can eavesdrop on transmitted data and also modify it without being detected.
High Broadcast Receiver (com.samsung.unifiedtp.ui.TetheringProvisionReceiver) is not Protected.An intent-filter exists.
A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible to any other application on the device. The presence of intent-filter indicates that the Broadcast Receiver is explicitly exported.

Activities

Information computed with AndroGuard. 

com.samsung.unifiedtp.ui.TetheringProvisionActivity

Receivers

Information computed with AndroGuard. 

com.samsung.unifiedtp.ui.TetheringProvisionReceiver
com.samsung.unifiedtp.carrier.att.DunStatusReceiver
com.samsung.unifiedtp.carrier.att.DunFailCaseReceiver

Services

Information computed with AndroGuard. 

com.samsung.unifiedtp.ui.SilentJobIntentService
com.samsung.unifiedtp.carrier.att.PeriodicJobService
com.samsung.unifiedtp.carrier.att.DunCheckService
com.samsung.unifiedtp.carrier.att.UnmeteredDataJobService
com.samsung.unifiedtp.carrier.att.MeteredDataJobService

Sample timeline

Oldest file found in APK Jan. 1, 2009, midnight
Latest file found in APK Jan. 1, 2009, midnight
Certificate valid not before June 22, 2011, 12:25 p.m.
First submission on VT April 24, 2021, 11:06 p.m.
Last submission on VT April 24, 2021, 11:06 p.m.
Upload on Pithus May 27, 2022, 2:56 p.m.
Certificate valid not after Nov. 7, 2038, 12:25 p.m.

NIAP analysis

Information computed with MobSF.

FCS_RBG_EXT.1.1 The application use no DRBG functionality for its cryptographic operations.
Random Bit Generation Services
FCS_STO_EXT.1.1 The application does not store any credentials to non-volatile memory.
Storage of Credentials
FCS_CKM_EXT.1.1 The application generate no asymmetric cryptographic keys.
Cryptographic Key Generation Services
FDP_DEC_EXT.1.1 The application has access to ['network connectivity'].
Access to Platform Resources
FDP_DEC_EXT.1.2 The application has access to no sensitive information repositories.
Access to Platform Resources
FDP_NET_EXT.1.1 The application has user/application initiated network communications.
Network Communications
FDP_DAR_EXT.1.1 The application implement functionality to encrypt sensitive data in non-volatile memory.
Encryption Of Sensitive Application Data
FMT_MEC_EXT.1.1 The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options.
Supported Configuration Mechanism
FTP_DIT_EXT.1.1 The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product.
Protection of Data in Transit
FCS_HTTPS_EXT.1.1 The application implement the HTTPS protocol that complies with RFC 2818.
HTTPS Protocol
FCS_HTTPS_EXT.1.2 The application implement HTTPS using TLS.
HTTPS Protocol
FCS_HTTPS_EXT.1.3 The application notify the user and not establish the connection or request application authorization to establish the connection if the peer certificate is deemed invalid.
HTTPS Protocol
FIA_X509_EXT.2.1 The application use X.509v3 certificates as defined by RFC 5280 to support authentication for HTTPS , TLS.
X.509 Certificate Authentication

Code analysis

Information computed with MobSF.

Low
CVSS:7.5
The App logs information. Sensitive information should never be logged.
MASVS: MSTG-STORAGE-3
CWE-532 Insertion of Sensitive Information into Log File
Files: 
 com/samsung/unifiedtp/util/Utils.java
 com/samsung/unifiedtp/carrier/att/MeteredDataJobService.java
 com/samsung/unifiedtp/carrier/vzw/VzwProvisioningModel.java
 com/samsung/unifiedtp/ui/TetheringProvisionErrorAlert.java
 com/samsung/unifiedtp/carrier/network/soap/SoapManager.java
 com/samsung/unifiedtp/ui/TetheringProvisionReceiver.java
 org/kxml2/io/KXmlParser.java
 com/samsung/unifiedtp/ui/SilentJobIntentService.java
 org/kobjects/crypt/Crypt.java
 com/samsung/unifiedtp/carrier/att/DunCheckService.java
 com/samsung/unifiedtp/carrier/att/DunFailCaseReceiver.java
 com/samsung/unifiedtp/util/SingleLiveEvent.java
 com/samsung/unifiedtp/util/TpLog.java
 com/samsung/unifiedtp/carrier/att/AttUtils.java
 com/samsung/unifiedtp/ui/TetheringProvisionActivity.java
 com/samsung/unifiedtp/carrier/network/http/HttpRequest.java
 com/samsung/unifiedtp/carrier/att/DeviceStateListener.java
 com/samsung/unifiedtp/carrier/dummy/DummyProvisioningModel.java
 com/samsung/unifiedtp/ui/TetheringProvisionViewModel.java
 com/samsung/unifiedtp/carrier/att/UnmeteredDataJobService.java
 com/samsung/unifiedtp/carrier/att/PeriodicJobService.java
 com/samsung/unifiedtp/carrier/unsupported/UnsupportedProvisioningModel.java
 com/samsung/unifiedtp/carrier/tfv/TfvProvisioningModel.java
 com/samsung/unifiedtp/carrier/network/soap/SoapResult.java
 com/samsung/unifiedtp/carrier/att/DunStatusReceiver.java
 com/samsung/unifiedtp/carrier/att/AttProvisioningModel.java
Medium
CVSS:7.4
Files may contain hardcoded sensitive information like usernames, passwords, keys etc.
MASVS: MSTG-STORAGE-14
CWE-312 Cleartext Storage of Sensitive Information
M9: Reverse Engineering
Files: 
 com/samsung/unifiedtp/util/Constants.java
 com/samsung/unifiedtp/carrier/network/soap/SoapRequest.java
 io/reactivex/internal/schedulers/SchedulerPoolFactory.java
Medium
CVSS:4.3
IP Address disclosure
MASVS: MSTG-CODE-2
CWE-200 Information Exposure
Files: 
 com/samsung/unifiedtp/BuildConfig.java
Medium
CVSS:5.9
SHA-1 is a weak hash known to have hash collisions.
MASVS: MSTG-CRYPTO-4
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
M5: Insufficient Cryptography
Files: 
 com/verizon/loginenginesvc/clientsdk/internal/Settings.java
Medium
CVSS:7.5
The App uses an insecure Random Number Generator.
MASVS: MSTG-CRYPTO-6
CWE-330 Use of Insufficiently Random Values
M5: Insufficient Cryptography
Files: 
 org/kobjects/crypt/Crypt.java
Pygal United States: 700

Map computed by Pithus.

Domains analysis

Information computed with MobSF.

US www.w3.org 128.30.52.100
US quickaccess.verizonwireless.com 162.115.18.89
US www.openmobilealliance.org 104.26.9.105
US xml.apache.org 151.101.2.132
US mobile.vzw.com 137.188.82.210
US xmlpull.org 74.50.61.58
US www.wireless-village.org 172.67.131.214
- entitlement.mobile.att.net 172.26.39.4

URL analysis

Information computed with MobSF.

http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://entitlement.mobile.att.net/mhs1
http://entitlement.mobile.att.net/teth
https://mobile.vzw.com/hybridClient/mvm/hotspot
https://quickaccess.verizonwireless.com/ws/device/service
https://quickaccess.verizonwireless.com/ws/device/service/hasFeature
https://quickaccess.verizonwireless.com/ws/device/service/isPrepay
Defined in com/samsung/unifiedtp/carrier/network/NetworkConstants.java
http://xml.apache.org/xml-soap
Defined in org/ksoap2/serialization/MarshalHashtable.java
http://xmlpull.org/v1/doc/
http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/
Defined in org/kxml2/io/KXmlParser.java
http://xmlpull.org/v1/doc/
http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/
Defined in org/kxml2/io/KXmlParser.java
http://xmlpull.org/v1/doc/
http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/
Defined in org/kxml2/io/KXmlParser.java
http://xmlpull.org/v1/doc/features.html#indent-output
http://www.w3.org/XML/1998/namespace
Defined in org/kxml2/io/KXmlSerializer.java
http://xmlpull.org/v1/doc/features.html#indent-output
http://www.w3.org/XML/1998/namespace
Defined in org/kxml2/io/KXmlSerializer.java
http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/
Defined in org/kxml2/wap/WbxmlParser.java
http://www.w3.org/XML/1998/namespace
http://www.w3.org/2000/xmlns/
Defined in org/kxml2/wap/WbxmlParser.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://www.wireless-village.org/CSP
http://www.wireless-village.org/PA
http://www.wireless-village.org/TRC
http://www.openmobilealliance.org/DTD/WV-CSP
http://www.openmobilealliance.org/DTD/WV-PA
http://www.openmobilealliance.org/DTD/WV-TRC
www.wireless-village.org
Defined in org/kxml2/wap/wv/WV.java
http://xmlpull.org/v1/doc/properties.html#xmldecl-standalone
Defined in org/kxml2/kdom/Document.java
http://xmlpull.org/v1/doc/features.html#process-docdecl
http://xmlpull.org/v1/doc/features.html#process-namespaces
http://xmlpull.org/v1/doc/features.html#report-namespace-prefixes
http://xmlpull.org/v1/doc/features.html#validation
Defined in org/xmlpull/v1/XmlPullParser.java
http://xmlpull.org/v1/doc/features.html#process-docdecl
http://xmlpull.org/v1/doc/features.html#process-namespaces
http://xmlpull.org/v1/doc/features.html#report-namespace-prefixes
http://xmlpull.org/v1/doc/features.html#validation
Defined in org/xmlpull/v1/XmlPullParser.java
http://xmlpull.org/v1/doc/features.html#process-docdecl
http://xmlpull.org/v1/doc/features.html#process-namespaces
http://xmlpull.org/v1/doc/features.html#report-namespace-prefixes
http://xmlpull.org/v1/doc/features.html#validation
Defined in org/xmlpull/v1/XmlPullParser.java
http://xmlpull.org/v1/doc/features.html#process-docdecl
http://xmlpull.org/v1/doc/features.html#process-namespaces
http://xmlpull.org/v1/doc/features.html#report-namespace-prefixes
http://xmlpull.org/v1/doc/features.html#validation
Defined in org/xmlpull/v1/XmlPullParser.java

Permissions analysis

Information computed with MobSF.

High android.permission.WRITE_SETTINGS modify global system settings
Allows an application to modify the system's settings data. Malicious applications can corrupt your system's configuration.
High android.permission.READ_PRECISE_PHONE_STATE Allows read only access to precise phone state. Allows reading of detailed information about phone state for special-use applications such as dialers, carrier applications, or ims applications.
High android.permission.READ_PHONE_STATE read phone state and identity
Allows the application to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on.
High android.permission.READ_PHONE_NUMBERS Allows read access to the device's phone number(s). This is a subset of the capabilities granted by READ_PHONE_STATE but is exposed to instant applications.
Low android.permission.INTERNET full Internet access
Allows an application to create network sockets.
Low android.permission.ACCESS_WIFI_STATE view Wi-Fi status
Allows an application to view the information about the status of Wi-Fi.
Low android.permission.ACCESS_NETWORK_STATE view network status
Allows an application to view the status of all networks.
Low android.permission.RECEIVE_BOOT_COMPLETED automatically start at boot
Allows an application to start itself as soon as the system has finished booting. This can make it take longer to start the phone and allow the application to slow down the overall phone by always running.
Low android.permission.CHANGE_WIFI_STATE change Wi-Fi status
Allows an application to connect to and disconnect from Wi-Fi access points and to make changes to configured Wi-Fi networks.
Low android.permission.WAKE_LOCK prevent phone from sleeping
Allows an application to prevent the phone from going to sleep.
Medium android.permission.MODIFY_PHONE_STATE modify phone status
Allows the application to control the phone features of the device. An application with this permission can switch networks, turn the phone radio on and off and the like, without ever notifying you.
android.permission.TETHER_PRIVILEGED Unknown permission
Unknown permission from android reference
android.permission.MANAGE_USB Unknown permission
Unknown permission from android reference
android.permission.OVERRIDE_WIFI_CONFIG Unknown permission
Unknown permission from android reference
android.permission.READ_PRIVILEGED_PHONE_STATE Unknown permission
Unknown permission from android reference
android.permission.CONNECTIVITY_INTERNAL Unknown permission
Unknown permission from android reference
com.verizon.api.ACCESS Unknown permission
Unknown permission from android reference
com.samsung.unifiedtp.permission.PROVISION_HOTSPOT_TRIGGER Unknown permission
Unknown permission from android reference

Threat analysis

Information computed with Quark-Engine.

Confidence:
100%
Find a method from given class name, usually for reflection
Confidence:
100%
Method reflection
Confidence:
100%
Load class from given class name
Confidence:
100%
Retrieve data from broadcast
Confidence:
100%
Read sensitive data(SMS, CALLLOG, etc)
Confidence:
100%
Send notification
Confidence:
100%
Monitor the broadcast action events (BOOT_COMPLETED)
Confidence:
100%
Query the ICCID number
Confidence:
100%
Method reflection
Confidence:
100%
Initialize class object dynamically
Confidence:
80%
Check the active network type
Confidence:
80%
Read file and put it into a stream
Confidence:
80%
Get declared method from given method name
Confidence:
80%
Check the current network type
Confidence:
80%
Query the phone number

Behavior analysis

Information computed with MobSF.

Android notifications 
       com/samsung/unifiedtp/util/Utils.java
Certificate handling 
       org/ksoap2/transport/HttpsServiceConnectionSE.java
Get phone number 
       com/samsung/unifiedtp/util/Utils.java
Get sim provider details 
       com/samsung/unifiedtp/util/Utils.java
Get sim serial number 
       com/samsung/unifiedtp/util/Utils.java
Get system service 
       com/samsung/unifiedtp/util/Utils.java
       com/samsung/unifiedtp/carrier/vzw/VzwProvisioningModel.java
       com/samsung/unifiedtp/carrier/att/DunFailCaseReceiver.java
       com/samsung/unifiedtp/carrier/att/UnmeteredDataJobService.java
       com/samsung/unifiedtp/carrier/att/PeriodicJobService.java
       com/samsung/unifiedtp/carrier/att/DunCheckService.java
       com/samsung/unifiedtp/carrier/att/AttUtils.java
       com/samsung/unifiedtp/carrier/att/DunStatusReceiver.java
       com/samsung/unifiedtp/carrier/att/AttProvisioningModel.java
       com/samsung/unifiedtp/carrier/network/http/HttpRequest.java
       com/samsung/unifiedtp/carrier/att/DeviceStateListener.java
       com/samsung/unifiedtp/carrier/tfv/TfvProvisioningModel.java
Http connection 
       org/ksoap2/transport/ServiceConnectionSE.java
       com/samsung/unifiedtp/carrier/network/http/HttpRequest.java
Https connection 
       org/ksoap2/transport/HttpsServiceConnectionSE.java
Inter process communication 
       com/samsung/unifiedtp/ui/SilentJobIntentService_MembersInjector.java
       com/samsung/unifiedtp/util/Utils.java
       com/samsung/unifiedtp/carrier/vzw/VzwProvisioningModel.java
       com/samsung/unifiedtp/ui/TetheringProvisionErrorAlert.java
       com/samsung/unifiedtp/ui/TetheringProvisionReceiver.java
       com/verizon/loginenginesvc/IResponseCallback.java
       com/samsung/unifiedtp/ui/SilentJobIntentService.java
       com/samsung/unifiedtp/carrier/att/DunCheckService.java
       com/samsung/unifiedtp/carrier/att/DunFailCaseReceiver.java
       com/samsung/unifiedtp/di/component/ActivityComponent.java
       com/samsung/unifiedtp/carrier/att/DunStatusReceiver.java
       com/samsung/unifiedtp/ui/TetheringProvisionActivity.java
       com/samsung/unifiedtp/di/component/DaggerActivityComponent.java
       com/verizon/loginenginesvc/ILoginEngineService.java
       com/verizon/loginenginesvc/clientsdk/internal/LoginSvcClient.java
Java reflection 
       org/kobjects/util/ChainedRuntimeException.java
       org/xmlpull/v1/XmlPullParserFactory.java
Message digest 
       com/verizon/loginenginesvc/clientsdk/internal/Settings.java
Sending broadcast 
       com/samsung/unifiedtp/util/Utils.java
       com/samsung/unifiedtp/ui/SilentJobIntentService.java
Starting activity 
       com/samsung/unifiedtp/carrier/att/DunFailCaseReceiver.java
       com/samsung/unifiedtp/ui/TetheringProvisionErrorAlert.java
       com/samsung/unifiedtp/carrier/att/DunStatusReceiver.java
Starting service 
       com/verizon/loginenginesvc/clientsdk/internal/LoginSvcClient.java
Tcp socket 
       com/samsung/unifiedtp/carrier/network/http/HttpRequest.java

Control flow graphs analysis

Information computed by Pithus.

The application probably dynamically loads code

The application probably gets different information regarding the telephony capabilities

The application probably gets the serial number of the SIM card

The application probably gets the phone number associated to the SIM card

The application probably gets the network connections information

The application probably makes OS calls

The application probably sends data over HTTP/S

The application probably gets memory and CPU information

The application probably creates an accessibility service

The application probably listens accessibility events