![](bg2.png)
for detecting malware and trojans. But these coun-
termeasures are not enough: as a matter of fact, ac-
cording to a McAfee report issued in 2022
2
, cyber-
criminals are always active in trying to defraud mo-
bile users. In addition to the more deceptive phishing
approach, a new way has just been devised to mislead
mobile game cheaters by adding dangerous code to
an existing open-source game hacking tool. Follow-
ing a survey released by financesonline.com
3
, there
is a not-specified population between the ages of 6
and 15 who spend time gaming on mobile devices
with the permission of their parents. This element
makes it considerably easier for attackers to hit their
intended target. From these considerations it emerges
the need to develop new ways to protect the personal
and sensitive user’s mobile information, by boosting
researchers, from both industrial and academic sides,
to focus on a new way to perpetrate attacks on the
mobile environment to develop more security fea-
tures by anticipating malware writers. With this in
mind, in this paper, we introduce a novel malware
model able to overcome the security mechanisms pro-
vided by Android operating systems and the free and
commercial antimalware detection approach. In the
proposed model the malicious payload is delivered
through an image where the code is hidden through
steganography. Once the payload source code is re-
trieved is automatically compiled with dynamic com-
pilation, thus loaded into memory through dynamic
loading and invoked at run-time by exploiting reflec-
tion, a mechanism provided by Android and modern
object-oriented programming languages.
Our model relies on the combined exploitation
of three mechanisms native provided by the Android
programming language: dynamic compiling, reflec-
tion, and dynamic loading, to allow a series of source
code snippets to combine into a running application
and execute, to dynamically alter the normal flow of
program execution. Moreover, the source code snip-
pets are hidden into images by exploiting steganog-
raphy (Johnson and Jajodia, 1998). The most pop-
ular steganography technique, which is usually used
with picture and sound carrier files, is known as Least
Significant Bit Substitution (LSBS) or overwriting.
This method consists of overwriting the bit with the
lowest arithmetic value going to modify the original
output slightly enough to be unlikely to be detected
by human senses (Siper et al., 2005). Although the
LSBS technique may turn out to be efficient, modern
steganography applications change the last bit ran-
2
https://www.mcafee.com/blogs/mobile-
security/mcafee-2022-consumer-mobile-threat-report/
3
https://financesonline.com/mobile-gaming-
demographics/
domly. The latter is performed to obstacle adver-
saries.
We implemented the new attack model we pro-
pose into the StegWare Android malware, to demon-
strate the possibility to perform this kind of attack in
a real-world environment.
The remaining of the paper proceeds as follows:
in Section 2 we present the novel malware model; in
Section 3 we discuss the StegWare implementation;
the StegWare experimental analysis is presented in
Section 4; in Section 5 we report the current state-
of-art literature on the dynamic loading and dynamic
compilation adoption for malicious purposes and, fi-
nally, in the last section conclusions and future re-
search plans are drawn.
2 THE MALWARE MODEL
In this section, we describe the proposed approach be-
hind the proposed novel malware model. In Figure 1
we show the malware architecture, which is explained
in detail below.
In the proposed novel malware model, we con-
sider a scenario where an image is delivered to the
users, for instance through the browser or an instant
messaging application such as WhatsApp or Tele-
gram. Once the image is received and stored into the
Android application, the following steps will be acti-
vated, as shown in Figure 1:
1. Payload Search: to search for malicious images,
a service has been implemented that analyzes all
the multimedia files in the memory of the device,
searching for a specific file with a specific name.
Thus the malware model is continuously and ac-
tively looking for images from different sources;
2. Payload Extraction: once an image is gathered,
the model tries to extract the source code from
the image (whether available). For image de-
coding, an ImageSteganography object is instan-
tiated to which a bitmap image is given as input.
Then, another object is instantiated, but this time
of type TextDecoding, to which the TextDecoding-
Callback parameter is given as input. After these
operations, the decoding task of the TextDecoding
object will be executed on the ImageSteganogra-
phy object and, after the override operation of the
onCompleteTextDecoding method, it will be pos-
sible to see the Java code hidden inside the image
passed as input;
3. Payload Execution: using the output of the pre-
vious step, the malicious Java code hidden inside
the image will be processed by the approach in
ICISSP 2023 - 9th International Conference on Information Systems Security and Privacy
742