3 ms·
Automated malware detection typically looks for behavior during installation rather than just the payload. (You can use the payload as a hint, though.) If an i
by 13of40 5y ago
Automated malware detection typically looks for behavior during installation rather than just the payload. (You can use the payload as a hint, though.) If an installer downloads a PNG and injects the last half of it into another process, and that drops an unsigned EXE into 'all users\startup' that can capture your screen, etc. you can probably block that without pissing too many people off. If you block SCREENCAP.EXE it's a different story.
- viraptor 5y agoThat's old news. The race happens every day. AV companies upload samples to explode in a simulated environment, meanwhile malware authors started fighting back using `sleep(10000)` to avoid detection since that's longer than automation is worth running. The bad parts are not being executed until much later. Then the test environments started faking time speed ups. I think there was a good episode about that in the Risky Business podcast.
- deleted 5y ago[deleted]