Search Results

I used to work with malware samples and what we used to have was a repository that every body on the team could mount on his laptop. … Thats fine but you could mount the malware files incorrectly and give them execution permissions that is not a good idea. …

You can download whatever you want, the problem is the program that you are using for download that content. For example a browser downloads and then process the content, that's the main problem. If y …

Polymorphic means that the body of the malware/exploit change o every iteration, this in general is doing by using encryption methods, basic or advanced. … On the other hand, Metamorphic means that some parts of the malware/exploit can change but in general without using encryption methods. …

I suggest you to understand what is a JA3 signatures from the authors (https://github.com/salesforce/ja3), but looks that is a false positive on the Joe Sandbox.

In Linux is possible, if you have a rootkit that is installed as a kernel module then you have access to kernel memory as well as the user space, also because in general user space programs make syste …

From my point of view you can start with Metasploit and check the encoders that exist there, such as shikata-ga-nai, etc.... There are some articles interested https://www.cs.unm.edu/~crandall/ccsdaco …

My father is even worse than yours. The proposed solution is to install firewalls on your network devices and deny all the incoming traffic to them. This will prevent some crazy spread on your network …

In the case of the back-doors you need to study the characteristics and the behavior of some of them and create your own characteristics, probably a network traffic features in combination of normal malware …

Not all the cases for detect malware are covered by a NIDS and depends on the features of the system in place, but from the perspective of the network you can detect a very high percentage of malware. … Obviously, depends a lot of the type of malware you want to detect, for example if a user downloads from a site a executable file with malware over a TLS connection a NDIS is not effectively, that's why …

Some AVs just do detection based on signatures so in this case your malware will be not detected. … Others AVs have behavioral capabilities that allows them to analyze the behavior of your binary, for example based on syscalls paths or other heuristics, and decide if is malware and in some cases send …

Another technique that you can add to your list is the use of honeypots, in general malware tries to spread over the home network in order to find other victims, honeypots helps to detect this. …

I will suggest you to look to https://www.clamav.net/, is an open source implementation, so you can check and see how works an AV in general. Of course, the commercial AVs will tell you how good they …

my experience with machine learning systems that detects "things" in your case is malware, is that these systems needs to have a lot of samples for learn what is malware from what is not. … For example if somebody sends you an email with an executable, what is the probability that the executable is malware? Will you take the risk your system? …

Other option that you have is to use metamorphism and polymorphic techniques. This will allow you to by pass some AV engines, depending on your code and on what you are doing but will be tedious for s …