Published 2026-06-07 by the Droidwatch Security Research team
SMS Watcher Lite (com.com.rjblackbox.swl) wears its intent on its sleeve, and the numbers agree: Malicious, 66/100, with a heavy 6 critical and 13 high findings. It opens by requesting 5 dangerous permissions — the kind of access an SMS-surveillance tool needs to do its job. As with every entry in this series, the verdict comes from static analysis only — the APK was unpacked and decompiled but never executed. See the full 10-sample roundup for context.
Sample at a glance
| Field | Value |
|---|---|
| App label | SMS Watcher Lite |
| Package | com.com.rjblackbox.swl |
| Version | 1.0 (code 2) |
| Min / target SDK | 7 / 0 |
| Size | 0.09 MB |
| SHA-256 | 0aa75f0754ecc35ad25270885d1fc38b3470b3ca48c619188745e54a0fb1e5ba |
| MD5 | 0036080b96c78b81e61c6d34447f6e8b |
| Verdict | Malicious |
| Risk score | 66 / 100 |
| ML classifier | malicious (P(mal)=1.00), model lgbm_binary |
| Findings raised | 41 (6 critical · 13 high · 14 medium) |
The verdict, in the platform's words
'SMS Watcher Lite' (package: com.com.rjblackbox.swl, v1.0, SDK 7–0) was analyzed and received a risk score of 66/100 (Malicious). SMS reading + sending permissions combined with SmsManager API references suggest capability to intercept bank OTPs and either forward them silently or relay them to a remote server, fully bypassing SMS-based 2FA.
What analysis ran
This was a static pass through Droidwatch's pipeline. The stages below produced findings on this sample (stages that found nothing are omitted):
| Stage | What it inspects | Findings |
|---|---|---|
dataflow |
Source-to-sink data-flow (PII → network/SMS sinks) | 15 |
rules |
Weighted rule engine (final scoring) | 6 |
manifest |
AndroidManifest: permissions, components, exported surface, deep links | 5 |
ipc |
IPC / component-security (exported components, PendingIntents, deep links) | 3 |
storage |
Insecure data storage (world-readable prefs, external storage, SQLite) | 2 |
attribution |
Build-path / developer / language attribution | 2 |
banking |
Banking-trojan behavioral signals (overlay, accessibility, device-admin, dropper) | 1 |
malware_classifier |
Malware-family heuristics (stalkerware/ransomware/adware/govspyware) | 1 |
framework |
Cross-platform framework fingerprinting (Flutter/RN/Unity/native) | 1 |
nsc |
Network Security Config (cleartext, trust anchors) | 1 |
certificates |
Code-signing certificate posture | 1 |
packer |
Packers / protectors, anti-analysis and root-detection (APKiD) | 1 |
callgraph |
Call Graph & Dead Code Analysis | 1 |
deobfuscation |
Base64 / obfuscated-string decoding | 1 |
ml_intelligence |
Independent ML classifier (Androguard features, CICMalDroid-trained) | 1 |
Top findings
| Finding | Severity | Category | MASVS / ATT&CK |
|---|---|---|---|
| VirusTotal: Confirmed Malicious | 🟥 Critical | reputation | — |
| Banking Trojan — High Behavioral Signal Score | 🟥 Critical | banking | — |
| Data Flow: UI Text Input (possible password) → SMS Sending (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: GPS Location → SMS Sending (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: Location Update → SMS Sending (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| Data Flow: GPS Latitude → SMS Sending (SMS/OTP Forwarding) | 🟥 Critical | privacy | MASVS-STORAGE-2 |
| 5 Dangerous Permission(s) Declared | 🟧 High | permissions | MASVS-PLATFORM-1 · T1626 |
| ML Engine: classified as 'Malicious' — family 'riskware' | 🟧 High | ml-intelligence | — |
| SMS Interception Receiver Registered | 🟧 High | permissions | MASVS-PLATFORM-1 · T1626 |
| Exported Activity Without Permission: SMSActivity | 🟧 High | ipc | MASVS-PLATFORM-1 · T1416 |
| SMS Read + Send Capability (OTP Theft Pattern) | 🟧 High | sms | MASVS-AUTH-1 · T1636.004 |
| VirusTotal: Suspicious / Low Detection | 🟧 High | reputation | — |
Why this score
The weighted rule engine's top scoring contributions:
| Rule | Severity | Points |
|---|---|---|
| VirusTotal: Confirmed Malicious | critical | +33.2 |
| Banking Trojan — High Behavioral Signal Score | critical | +26.4 |
| VirusTotal: Suspicious / Low Detection | high | +14.8 |
| Banking Trojan — Moderate Behavioral Signals | high | +11.2 |
| Silent SMS Sending Capability | medium | +6.0 |
| Contacts + Location Access | medium | +5.6 |
MITRE ATT&CK Mobile mapping
| Technique | Tactic | Why |
|---|---|---|
| T1406 Obfuscated Files or Information | Defense Evasion | Packer, protector, or anti-analysis technique detected. |
| T1412 Capture SMS Messages | Collection | Intercepting SMS messages including banking OTP codes. |
| T1422 System Information Discovery | Discovery | Malware author attribution indicators: build paths, certificate identity, langua |
| T1432 Access Contact List | Collection | Collects sensitive PII or device information. |
| T1437 Application Layer Protocol: Web Protocols | Command and Control | Using HTTP/HTTPS for C2 communication. |
| T1533 Data from Local System | Collection | Insecure local data storage exposing credentials and PII. |
Reproduce it
curl -s -X POST https://droidwatch.app/api/upload \
-H "X-Upload-Consent: 1" -F "[email protected]" | jq -r .upload_id
# then POST /api/analyze, poll /api/jobs/<id>, read the report (verdict + MITRE + STIX 2.1)
Static-only analysis; the Android dynamic Frida sandbox was not used. Sample from a public 2021 research corpus, referenced by SHA-256. Family attribution is intentionally conservative.