Hacker News Reader

>most malware isn't obfuscated or using novel techniques, a lot of it is just spyware capabilities you clicked through to accept

How does an antivirus tell the difference between e.g. TeamViewer and a repackaged app with a RAT?

View on HN

here's one way I love to think about it, A RAT will go all the way to try and persist, hide from AV, load other components from some remote endpoint. It will trigger so much events that can be detected by an AV. on the other hand, TeamViewer will not try to hide what Its doing, there's also a lot more stuff at play here since this is just heuristic analysis, AVs tend to be more complex and incorporate more methods of analysis like signature-based detection and integrity checking, etc...

Reply on news.ycombinator.com