4 ms·
useless. they suggested no means to execute the malware - once it is extracted the antivirus WILL detect the unmodified malware. you'd be better off zipping wit
by high_byte 5y ago
useless. they suggested no means to execute the malware - once it is extracted the antivirus WILL detect the unmodified malware. you'd be better off zipping with password or even simple XOR over the data would "evade" detection... until you run it raw.
- rjmunro 5y agoI can imagine that in some circumstances, it's possible if an evil insider downloads some random large random data files, it may trigger alarms. If they download a large Neural Network Model, that would be expected for whatever work they do - they could legitimately ask for it to be whitelisted by their firewall. They'd then have to write a small python script from memory to extract the malware, but it's pretty unlikely.
- CloselyChunky 5y agoAFAIK antivirus systems do (did?) not scan RAM, only persistent memory. So decrypting/decoding the malware in-memory and jumping into the code should avoid detection. That's how "runtime crypters" work or used to work a few years ago.