Reflection, Dynamic Loading, Native Code, or maybe, you can make an application that is totally legitimate and functional, and wait about three months or more. Then, when you already have many users who have downloaded the app, you introduce an update to the app with the malicious code or whatever you are going to do.