Reply to thread

Message: <blockquote data-quote="MacDefender" data-source="post: 977672" data-attributes="member: 83059">Yeah, traditional examples for consumer AVs include “behavior blocking” (monitoring Win32 API calls made by a process), as well as less exciting approaches like inspecting memory contents or network activity using a signature scanner. The latter, in particular, was seen quite a bit for ESET in the Malware Hub. A lot of malware is broken into two stages…. The first stage is a highly obfuscated and difficult to detect stub that’s meant to fetch the real payload and help it evade detection. The second stage tends to be recycled from existing malware and contains a lot more complex code that’s difficult to hide from signature scanner. Though ESET detected almost everything upon static scan (level 2 or earlier), some of the detections were at runtime either thanks to the network scanning or looking at temporary files during execution.</blockquote>

Top