AV Emulation Detection Tricks Used by Malware

Tricks that malware developers use to detect antivirus emulators and how these differ from the sandbox emulators we use from our recent Twitch stream.

Alexie's Windows Defender research with some insights into the emulation engine used...

https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Reverse-Engineering-Windows-Defender-s-JavaScript-Engine.pdf

https://i.blackhat.com/us-18/Thu-August-9/us-18-Bulazel-Windows-Offender-Reverse-Engineering-Windows-Defenders-Antivirus-Emulator.pdf

https://github.com/0xAlexei/WindowsDefenderTools

-----
OALABS PATREON
https://www.patreon.com/oalabs

OALABS DISCORD
https://discord.gg/6h5Bh5AMDU

Twitch
https://www.twitch.tv/oalabslive

OALABS GITHUB
https://github.com/OALabs

UNPACME - AUTOMATED MALWARE UNPACKING
https://www.unpac.me/#/
-----

antivirus automated defender detect detection developers discord emulation engine github insights malware malware developers patreon research sandbox stream twitch twitch stream unpacking windows windows defender