Acoustic Shellcodes: Evasion using audio-based shellcode transformation

In recent years, antivirus engines have become markedly better at detecting malware, and detection rates for samples that rely on conventional embedded shellcode have climbed accordingly. While shellcode has long been a go-to stealth mechanism, when embedded directly in PE artifacts it remains highly identifiable by static and heuristic scanners. In this work, we explore an unconventional channel: encoding shellcode as acoustic data within external WAV containers. Through comparative analysis with text- and image-based external payload methods, we demonstrate that the primary determinant of evasion effectiveness is payload externalization rather than encoding sophistication. Our results show that simple payload separation reduces detection rates by 71% across all methods, from 43.06% for embedded shellcode to approximately 12.50% for external variants. The biggest constraint for standard defensive tools are not the shellcode steganography techniques, as they achieve similar levels of evasion rate. The conclusion is that while audio steganography may prove to be useful in air-gapped environments, they are not especially quite useful for standard AV evasion. The research underscores that modern AV detection has evolved to focus on loader behavior rather than payload encoding, suggesting future evasion research should prioritize behavioral obfuscation over encoding complexity.