MITRE ATT&CKtechnique

T1407 Download New Code at Runtime

Published 2017-10-25 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Defense Evasion
Platforms
Android, iOS
Version
1.5
Created
2017-10-25

Description

Adversaries may download and execute dynamic code not included in the original application package after installation. This technique is primarily used to evade static analysis checks and pre-publication scans in official app stores. In some cases, more advanced dynamic or behavioral analysis techniques could detect this behavior. However, in conjunction with Execution Guardrails techniques, detecting malicious code downloaded after installation could be difficult. On Android, dynamic code could include native code, Dalvik code, or JavaScript code that utilizes Android WebView’s `JavascriptInterface` capability. On iOS, dynamic code could be downloaded and executed through 3rd party libraries such as JSPatch.

Related

Tactic · MITRE ATT&CK (1)

  • TA0030 Defense Evasion tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1006 Use Recent OS Version mitigation

Referenced by MITRE ATT&CK · uses (40)

  • S9004 Crocodilus software (malware)
  • S1241 RatMilad software (malware)
  • S1094 BRATA software (malware)
  • S1083 Chameleon software (malware)
  • S1079 BOULDSPY software (malware)
  • S1061 AbstractEmu software (malware)
  • S1055 SharkBot software (malware)
  • S0655 BusyGasper software (malware)
  • S0577 FrozenCell software (malware)
  • S0555 CHEMISTGAMES software (malware)
  • S0549 SilkBean software (malware)
  • S0550 DoubleAgent software (malware)
  • S0551 GoldenEagle software (malware)
  • S0545 TERRACOTTA software (malware)
  • S0544 HenBox software (malware)
  • S0539 Red Alert 2.0 software (malware)
  • S0536 GPlayed software (malware)
  • S0535 Golden Cup software (malware)
  • S0529 CarbonSteal software (malware)
  • S0507 eSurv software (malware)
  • S0505 Desert Scorpion software (malware)
  • S0506 ViperRAT software (malware)
  • S0494 Zen software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
  • S0478 EventBot software (malware)
  • S0480 Cerberus software (malware)
  • G0112 Windshift group
  • S0432 Bread software (malware)
  • S0422 Anubis software (malware)
Show all 40 ›

References