In recent years, stealthy Android malware has increasingly adopted sophisticated techniques to bypass automatic detection mechanisms and harden manual analysis. Adversaries typically rely on obfuscation, anti-repacking, steganography, poisoning, and evasion techniques to AI-based tools, and in-memory execution to conceal malicious functionality. In this paper, we investigate WebAssembly (Wasm) as a novel technique for hiding malicious payloads and evading traditional static analysis and signature-matching mechanisms. While Wasm is typically employed to render specific gaming activities and interact with the native components in web browsers, we provide an in-depth analysis on the mechanisms Android may employ to include Wasm modules in its execution pipeline. Additionally, we provide Proofs-of-Concept to demonstrate a threat model in which an attacker embeds and executes malicious routines, effectively bypassing IoC detection by industrial state-of-the-art tools, like VirusTotal and MobSF.

翻译：近年来，隐蔽型Android恶意软件日益采用复杂技术以规避自动检测机制并强化人工分析难度。攻击者通常依赖混淆、反重打包、隐写术、投毒、针对AI工具的规避技术以及内存执行等手段来隐藏恶意功能。本文研究了WebAssembly（Wasm）作为一种隐藏恶意载荷并规避传统静态分析与签名匹配机制的新型技术。尽管Wasm通常用于渲染特定游戏活动并与浏览器原生组件交互，我们深入分析了Android在执行流程中引入Wasm模块的可能机制。此外，我们通过概念验证展示了一种威胁模型：攻击者可嵌入并执行恶意例程，有效规避VirusTotal和MobSF等工业级先进工具的IoC检测。