For post-trigger analysis, our entire framework is managed
through Celery [13], which provides job management with the
ability to deploy in a distributed setting. In our implementation
the app UI exploration as well as the recording of redirection
chains with a real browser happens in tandem. Once this stage is
completed, any recorded redirection chains are queued through
a REST API into the Celery-managed queue together with
information about the application and part of the code that
was responsible for the triggering of the intent that led to the
redirection chain. Tasks are pulled from the queue to perform
further analysis on the landing pages and scan the files and
URLs with VirusTotal as described above. The whole system
has proper retry and timeout mechanisms in place and could
run for multiple months without significant need of human
attention.