2 ms·
Why not both? Trivial change (like embedded timestamp in a file) for every user, and advanced polymorphism for the times when the malware is detected. I bet mo
by theamk 6y ago
Why not both? Trivial change (like embedded timestamp in a file) for every user, and advanced polymorphism for the times when the malware is detected.
I bet most researchers have tools to bin files together automatically based on the same MD5. Why make their life easier when this is so easy to defeat?
- tgsovlerkhgsel 6y agoBecause many AV systems assume that any unknown file (unknown to their cloud service) is probably doing this, and thus probably malware.