Abstract
Android has dominated the smartphone market share with 82.8% compared to other platforms such as iOS, Windows, Blackberry OS and others in the world. This growth makes the android being most targeted by mobile malwares. There are many ways to infect users with malicious applications such as by uploading the infected apps at the third party store, repackaged application and drive-by-download. This paper presents the commonly and widely used of permissions and APIs by the mobile botnet to exploit the smartphones. Experiment has been conducted in a controlled lab environment and by doing static analysis and reverse engineered the apps source code. The identified permissions and APIs in this experiment are crucial prior forming the mobile botnet detection model.