Antivírus para Android e malware inédito via Repackaging: um experimento de detectabilidade

Abstract

Android devices concentrate sensitive data and constitute a priority target for malicious software, with threat detection falling primarily on consumer antivirus applications. However, the majority of techniques employed by these solutions are reactive, dependent on prior knowledge of the threat, raising questions about their effectiveness against novel, previously unknown samples. This work evaluates comparatively the detection capability of consumer antivirus tools for Android when confronted with a new, undocumented threat, constructed through malicious payload injection via repackaging of the official DuckDuckGo browser client. A controlled differential design was employed — the legitimate application version compared against its trojanzed variant, which differs from it essentially by the payload — complemented by benign controls and known malware samples. The evaluation was conducted along two dimensions: multi-engine scanning via VirusTotal and testing on a physical device with six consumer solutions. Results showed that the novel sample was not detected by any signature-based mechanism, remaining indistinguishable from a legitimate application (0 of 66 engines on VirusTotal and negative verdicts in all installed products), whereas known samples were widely recognized. The only effective barrier was Google's verification at installation time, while the manufacturer's native scan failed to detect even already-catalogued malware. We conclude that the introduction of a novel payload is sufficient to evade signature-based detection, empirically evidencing its reactive limitation and reinforcing the need for a defense-in-depth posture that does not rely exclusively on antivirus