Yeah! I have to run for a bit but I'll be back. There's an incredible article about Flame I detailed a bit here: https://news.ycombinator.com/item?id=15046089

Yeah! I have to run for a bit but I'll be back. There's an incredible article about Flame I detailed a bit here: https://news.ycombinator.com/item?id=15046089 https://news.ycombinator.com/item?id=15046089 It depends entirely whether you have persistent access to the target. If your target is airgapped, your only option is to know something about the target machine (i.e. have a spy on the inside) that gives you enough info to encrypt the virus. For example, they could install a special program so that it's listed in C:\Program Files, then the virus decrypts using the string "${mac_addr}${x}" for x in [list of installed programs]. So as an analyst, you won't have any idea what the magic program name was. That technique was likely Stuxnet, not Flame, so that article might not contain any info about it. But it's amazing in its own way. If you have any other questions too, I love chatting about this stuff.