Android Malware and Analysis

200

android Malware and analysis

starting services and observers, a scheduler is started for the TorService

to attempt to maintain connection every 300 seconds (5 minutes).

Image 9.11 MainService.onCreate.

We can see that in the initialization of MainService a callback

object of type ITorServiceCallback is created, which is located in the

subclass MainService$1. e important part of this class is the status-

Changed function, which we can see in the smali code is simply called

the updateStatus function of MainService.

.method public statusChanged(Ljava/lang/String;)V

.registers 3

.param p1, “value” # Ljava/lang/String;

.prologue

.line 160

iget-object ...