Revealing the Antivirus Quarantined: Using PowerShell to enable Analysis
summary
PowerShell scripts demonstrate how to recover quarantined binaries from three AVs by reversing each vendor’s format: eSafe .vir base64 with backup.bit metadata, McAfee .bup XOR key 0x068 producing details.out and file_0.out, and Windows Defender RC4 with a static key under ProgramData\Microsoft\Windows Defender\Quarantine. Built examples parse metadata, decode or decrypt bytes, restore original filenames, and produce raw samples for analysis; plans include merging utilities into a single cross‑platform PowerShell tool and adding more AV formats.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:10Antivirus and malware history
- 11:06Modern antivirus capabilities
- 17:28Quarantine in incident response
- 21:00PowerShell unquarantine
- 28:49McAfee unquarantine
- 32:01Defender unquarantine
- 35:56Antivirus analysis tools
- 38:26Cybersecurity projects
- 41:37Q&A
related talks
28mAVLeak: Fingerprinting Antivirus Emulators for Advanced Malware Evasion
40mAnalyzing Windows Malware on Linux: Getting Started Tips and Examples
01h 40mDefending against PowerShell attacks - in theory, and in practice
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
27mUsing PowerShell as a Reverse Engineering Tool
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
41mHow AI Is Changing the Malware Landscape
25mCommSec D1 - A Deep Dive Into Malicious Documents