3 ms·
Malware. Most binaries that I have seen in the wild use cosmo/ape binary format to have "free obfuscation" that is hard to analyze by antivirus and EDR softwar
by cookiengineer 3y ago
Malware.
Most binaries that I have seen in the wild use cosmo/ape binary format to have "free obfuscation" that is hard to analyze by antivirus and EDR software due to its mutating self-extracting pkzip-like behavior.
Well, and of course CLI tools. I guess it's the same selling points that fit golang as well - aside from cosmo's binary format having a universal header.
- krackers 3y ago>hard to analyze by antivirus Isn't it just a matter of updating the AV to be aware of this format? It's not like APE is the only "weird" binary format that exists, since there's stuff like UPX (which is indeed flagged by many AVs).