The Retriever Trojan uses the following namespace: using pcchekapp.grp.ammar.samaneh; Android.The malware begins by creating a web service object and uses the following URL within its configuration: http:// service.chrome-up[.]date:8080 /WebService.asmx It then calls a function called “SetLog2”, which sets variables for the system’s IP address, MAC address and hostname