Listening to App Changes

The app integrating Malwarelytics for Android can register an observer for app changes.

The observer notifies the app about these changes:

• A new app is installed
• An app was changed - The app was either updated or some of its components were enabled or disabled.
• An app was uninstalled

The exact function of the listener slightly differs based on the version of Android operating system. The older versions of Android allow to spot an app change and deliver an observer callback immediately. On newer versions of Android the callbacks are delivered with a delay.

Install and change callbacks deliver analyzed threat info. Uninstall callback cannot provide such detailed info because the app is already gone, only the package name is provided.

Registering App Observer

When smart protection is enabled apps are observed automatically.

For direct observation the SDK offers ApkThreatObserver of app changes that can be registered:

antivirus.registerApkThreatObserver(threatObserver)

When the observer is no longer necessary, it’s possible to unregister it:

antivirus.unregisterApkThreatObserver(threatObserver)