Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 710636">Yeah! That is exactly my point <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />VoodooAi still works though, and a lot of malicious software nowadays is packed, I&#039;ve seen a lot of UPX lately over other packers like Themida in the wild... VoodooAI takes into account factors like the entropy level, so it will still flag a lot of malware.On that note, a lot of malware authors are not just going to change overnight and adapt to fooling static Ai systems, because they prefer to rely on techniques like packing. The logic behind it is that they will be trying to fool AV solutions, which while are vulnerable to static scan evading via techniques like packing (prevent hash checksum and standard generic signatures), although they don&#039;t understand that some AVs have good memory scanning anyway so it will be defeated regardless. VoodooShield isn&#039;t a priority to malware authors, so the only time you&#039;re likely to see such Ai fool tricks is in PoC testing for the next 1-2 or more years. AVs are the goal of interest to malware authors, not projects like VoodooShield. Which is also a benefit to those who currently use it.</blockquote>

[QUOTE="Deleted member 65228, post: 710636"] Yeah! That is exactly my point :) VoodooAi still works though, and a lot of malicious software nowadays is packed, I've seen a lot of UPX lately over other packers like Themida in the wild... VoodooAI takes into account factors like the entropy level, so it will still flag a lot of malware. On that note, a lot of malware authors are not just going to change overnight and adapt to fooling static Ai systems, because they prefer to rely on techniques like packing. The logic behind it is that they will be trying to fool AV solutions, which while are vulnerable to static scan evading via techniques like packing (prevent hash checksum and standard generic signatures), although they don't understand that some AVs have good memory scanning anyway so it will be defeated regardless. VoodooShield isn't a priority to malware authors, so the only time you're likely to see such Ai fool tricks is in PoC testing for the next 1-2 or more years. AVs are the goal of interest to malware authors, not projects like VoodooShield. Which is also a benefit to those who currently use it. [/QUOTE]

Verification