UTRDCL: Stealthy DCL-Based Obfuscation and Its Attacks and Defenses in Android

Dynamic Class Loading (DCL) is a legitimate technique extensively used by Android developers to incorporate additional functionalities into applications at runtime. However, adversaries can exploit DCL as a stealthy obfuscation technique to dynamically load malicious code and evade detection. While prior studies have analyzed typical DCL-based obfuscation and the attacks it enables—such as identifying payloads on storage, inspecting DCL-related APIs, or profiling dynamic behaviors—existing solutions remain insufficient against increasingly evasive DCL threats. In this paper, we propose UTRDCL, a novel stealthy obfuscation technique that leverages system APIs instead of conventional DCL-related APIs, and employs an automated footprint cleanup strategy to minimize runtime traces. Based on UTRDCL, we construct three real-world attack instances by embedding it into existing malware and benign applications, demonstrating how it can be used to evade detection. To counter such threats, we design and implement a lightweight defense mechanism by patching a previously overlooked vulnerability in the Android system that UTRDCL exploits in this specific context. This system-level mitigation closes the attack surface leveraged by UTRDCL, offering a more fundamental defense than behavioral detection. Extensive experiments show that attacks leveraging UTRDCL can evade 11 state-of-the-art malware detectors from open-source, academic, and commercial sources. We further validate our defense mechanism on real devices, demonstrating its effectiveness in preventing UTRDCL-based attacks without introducing noticeable overhead. Our proof-of-concept of UTRDCL and its defense is publicly available at https://github.com/AnonymousFEI/UTRDCL