There, the malicious app first checks the required permissions and then proceeds with its routine:  Steal phone number Steal accounts Steal installed app list Steal contacts Steal SMS  The stolen information will be either written into .txt or .csv formats before being uploaded to the C&C server.