tokens: XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome — force the device ’ s back to the home screen getnpki : get files/content from the folder named NPKI ( contains certificates related to financial transactions ) http — access a specified network using HttpURLConnection onRecordAction — simulate a number-dialed tone call — call a specified number get_apps — get all the apps installed on the device show_fs_float_window — show a full-screen window for phishing Of note is XLoader ’ s abuse of the WebSocket protocol ( supported in many browsers and web applications ) via ws ( WebSockets ) or wss ( WebSockets over SSL/TLS ) to communicate with its C & C servers .