Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1042794" data-attributes="member: 99014">What other users have observed about CyberCapture is true, it is not resistant to evasion and many times reports malware as safe only for behavioural blocking to remove it after. This means that they are able to properly classify the malicious behaviour but they haven’t been able to get to it.CyberCapture is a small supplement in the whole Avast ecosystem (last line of defence) and is neither as essential nor it is well developed as business solutions that have been perfecting emulation for more than a decade. Eset LiveGuard is not any better. It has been confirmed by Marcos (Eset forum admin) that LiveGuard doesn’t simulate user activity for example. That was discussed on one of my statuses.[USER=32260]@Andy Ful[/USER] not all vendors need the MOTW, some like Norton, Trend Micro, Check Point and McAfee use sensors to detect downloading behaviour/downloaded files. These do not depend on MOTW at all and will perform their scan flow regardless whether it is presented. Avast has decided to minimise the number of files emulated due to the substantial cost. [USER=91446]@Anthony Qian[/USER] CyberCapture is not local at all. DeepScreen is local and attempts to perform local emulation whilst the behaviour is processed through online classifiers. CyberCapture attempts to place the malware in a more controlled environment. The logic upon the initial design was that human analysis will be performed when the automated one fails. Maybe this still is the case but human analysis will take some time.</blockquote>

[QUOTE="Trident, post: 1042794, member: 99014"] What other users have observed about CyberCapture is true, it is not resistant to evasion and many times reports malware as safe only for behavioural blocking to remove it after. This means that they are able to properly classify the malicious behaviour but they haven’t been able to get to it. CyberCapture is a small supplement in the whole Avast ecosystem (last line of defence) and is neither as essential nor it is well developed as business solutions that have been perfecting emulation for more than a decade. Eset LiveGuard is not any better. It has been confirmed by Marcos (Eset forum admin) that LiveGuard doesn’t simulate user activity for example. That was discussed on one of my statuses. [USER=32260]@Andy Ful[/USER] not all vendors need the MOTW, some like Norton, Trend Micro, Check Point and McAfee use sensors to detect downloading behaviour/downloaded files. These do not depend on MOTW at all and will perform their scan flow regardless whether it is presented. Avast has decided to minimise the number of files emulated due to the substantial cost. [USER=91446]@Anthony Qian[/USER] CyberCapture is not local at all. DeepScreen is local and attempts to perform local emulation whilst the behaviour is processed through online classifiers. CyberCapture attempts to place the malware in a more controlled environment. The logic upon the initial design was that human analysis will be performed when the automated one fails. Maybe this still is the case but human analysis will take some time. [/QUOTE]

Verification