Download New Code at Runtime

Anubis can download attacker-specified APK files.^[5]

Original samples of BrainTest download their exploit packs for rooting from a remote server after installation.^[6]

Bread has utilized JavaScript within WebViews that loaded a URL hosted on a Bread-controlled server which provided functions to run. Bread downloads billing fraud execution steps at runtime.^[7]

BusyGasper can download a payload or updates from either its C2 server or email attachments in the adversary’s inbox.^[8]

CarbonSteal can dynamically load additional functionality.^[9]

Cerberus can update the malicious payload module on command.^[10]

CHEMISTGAMES can download new modules while running.^[11]

Desert Scorpion has been distributed in multiple stages.^[12]

DoubleAgent has downloaded additional code to root devices, such as TowelRoot.^[9]

Dvmap can download code and binaries from the C2 server to execute on the device as root.^[13]

eSurv’s Android version is distributed in three stages: the dropper, the second stage payload, and the third stage payload which is Exodus.^[14]

EventBot can download new libraries when instructed to.^[15]

Exodus One, after checking in, sends a POST request and then downloads Exodus Two, the second stage binaries.^[16]

FrozenCell has downloaded and installed additional applications.^[17]

Golden Cup has been distributed in two stages.^[18]

GoldenEagle can download new code to update itself.^[9]

GPlayed has the capability to remotely load plugins and download and compile new .NET code.^[19]

HenBox can load additional Dalvik code while running.^[20]

Judy bypasses Google Play's protections by downloading a malicious payload at runtime after installation.^[21]

Mandrake can download its second (Loader) and third (Core) stages after the dropper is installed.^[22]

RCSAndroid has the ability to dynamically download and execute new code at runtime.^[23]

Red Alert 2.0 can download additional overlay templates.^[24]

SilkBean can install new applications which are obtained from the C2 server.^[9]

Skygofree can download executable code from the C2 server after the implant starts or after a specific command.^[25]

SpyDealer downloads and executes root exploits from a remote server.^[26]

TERRACOTTA can download additional modules at runtime via JavaScript eval statements.^[27]

Triada utilizes a backdoor in a Play Store app to install additional trojanized apps from the Command and Control server.^[28]

ViperRAT has been installed in two stages and can secretly install new applications.^[29]

Windshift has included malware functionality capable of downloading new DEX files at runtime during Operation BULL.^[30]

WolfRAT can update the running malware.^[31]

Zen can dynamically load executable code from remote sources.^[32]

ZergHelper attempts to extend its capabilities via dynamic updating of its code.^[33]

Application vetting techniques could (either statically or dynamically) look for indications that the application downloads and executes new code at runtime (e.g., on Android use of DexClassLoader, System.load, or the WebView JavaScriptInterface capability, or on iOS use of JSPatch or similar capabilities). Unfortunately, this is only a partial mitigation, as additional scrutiny would still need to be applied to applications that use these techniques, as the techniques are often used without malicious intent, and because applications may employ other techniques such as to hide their use of these techniques.

On Android 10 and above devices, applications that target Android API level 29 or higher cannot execute native code stored in the application's internal data storage directory, limiting the ability of applications to download and execute native code at runtime.^[34]