Making Finfisher Malware Undetectable

To be clear, running any sample that's clean on VT will probably trigger your AV based on many run-time heuristics - VT is showing scan-time results, not run-time results. These 'crypters' are also effectively worthless - as soon as your sample hits a few computers an AV will upload the sample (or someone will upload it to VirusTotal, and it will subsequently get analyzed) and it will be flagged.

You can almost try this 'at home' - upload a file to VirusTotal and try to get it to match two or three AV's detections. It will then be flagged by at least ten AVs next week. This is because VirusTotal shares all uploaded files with antivirus products.

Kind of scary, but would need successful execution to be really bad. I really like the idea of sandbox analysis, as well as the challenge of writing a program which can detect when running in-sandbox :)

The name of one of the protectors is 'Themida', not "Themeda". Aside from that, nice article. I wonder how many of the antiviruses complained when you actually tried to execute your packed file? There should be a second round of heuristics then which would catch the malware after it's unpacked to disk.