I guess that a regular app would not have the necessary low level access (that I assume is required) to do anything like that. So that (another guess) means th

I guess that a regular app would not have the necessary low level access (that I assume is required) to do anything like that. So that (another guess) means that the android phone needs to be under complete control of the malware. Is that common or are my guesses/assumptions wrong?