L
LabZero
Another problem concerns the complexity of the malware.
If packer or encrypter are used to “modify” a particular piece of malware, each of these software uses a different algorithm. Of course, once you identify that a binary has been compacted or encrypted it is necessary to know the algorithm and the encryption key. All of this makes particularly difficult to recognize malware by AV and the only option, then, is to “capture” the original code from the memory at the time of the execution, the operation is certainly not easy and very risky, including the use of proactive technologies.
The number of programs that can be exploited by cyber criminals in order to conceal the code of the malware is more and more high, and antivirus can actually become useless over that insecure, but we remember that it is only the second level of security.
If packer or encrypter are used to “modify” a particular piece of malware, each of these software uses a different algorithm. Of course, once you identify that a binary has been compacted or encrypted it is necessary to know the algorithm and the encryption key. All of this makes particularly difficult to recognize malware by AV and the only option, then, is to “capture” the original code from the memory at the time of the execution, the operation is certainly not easy and very risky, including the use of proactive technologies.
The number of programs that can be exploited by cyber criminals in order to conceal the code of the malware is more and more high, and antivirus can actually become useless over that insecure, but we remember that it is only the second level of security.