MetaDefender Aether™ v3.2.0 Release: Introducing Five-Layer Zero-Day Detection

MetaDefender Aether 3.2.0 for Linux introduces a new pre-execution decision point and a set of analysis and detection improvements. The main architectural change is Predictive Alin AI as Layer 2, positioned between Threat Reputation and Dynamic Analysis.

MetaDefender Aether is OPSWAT’s unified zero-day detection solution designed to combine adaptive sandboxing, threat intelligence, threat scoring, and machine-learning similarity search in a coordinated detection pipeline. Version 3.2.0 adds predictive static analysis without removing any existing analysis stage.

The five layers are:

1. Threat Reputation: Checks files and infrastructure against known intelligence
2. Static Analysis: Uses Predictive Alin AI to assess malicious intent before execution
3. Dynamic Analysis: Emulates suspicious and unresolved files to expose runtime behavior
4. Threat Scoring: Correlates evidence into a confidence-based risk score and verdict
5. Threat Hunting: Connects samples to related malware families, infrastructure, and campaigns

The former Layers 2, 3, and 4 become Layers 3, 4, and 5. The new layer does not force every file through another long analysis stage. It helps decide how much additional inspection each file needs.

The five-layer pipeline applies progressively deeper analysis based on the evidence available for each file. Known threats can be identified early, high-confidence predictions can receive a pre-execution verdict, and ambiguous files can continue to emulation and threat hunting without weakening the final decision.

Threat Reputation identifies known threats and attacker infrastructure. MetaDefender Aether checks available intelligence for file hashes, URLs, IP addresses, and domains using online or offline reputation sources. Files without a conclusive reputation result continue to Static Analysis. Offline reputation also supports regulated and air-gapped environments where cloud intelligence may be unavailable.

Predictive Alin AI analyzes structural, semantic, and behavioral file indicators before execution, detonation, or runtime monitoring. The AI-powered malware detection engine delivers machine-learning verdicts in milliseconds and can run online or fully offline.

Layer 2 supports two primary outcomes:

• Deflection: High-confidence clean files can avoid unnecessary sandbox analysis

• Detection: High-confidence malicious files can be identified and blocked before execution, including files traditional antivirus engines may not recognize

For supported high-risk executable files, Predictive Alin AI is engineered for P90 verdict times of 50 milliseconds and P99 verdict times below 100 milliseconds. Files that do not meet the required confidence threshold continue to Dynamic Analysis rather than relying on a weak static verdict.

Predictive Alin AI also extends static inspection to supported AI and machine learning model files. The analysis helps identify embedded arbitrary code that may execute when a model is loaded.

Dynamic Analysis sends suspicious and unresolved samples to MetaDefender Aether’s emulation-based adaptive sandbox. MetaDefender Aether emulates instructions, file operations, scripts, and relevant operating system interactions instead of relying on a conventional virtual machine.

Instruction-level emulation helps expose malware that uses anti-VM checks, delayed execution, malformed structures, or environmental conditions to disrupt automated analysis. MetaDefender Aether can reveal runtime behavior, loader chains, hidden payloads, and indicators of compromise.

Newly discovered indicators can feed the local reputation database and improve future Layer 1 decisions. Sandbox-confirmed zero-day discoveries can also contribute to future Predictive Alin AI model retraining, creating a learning loop between pre-execution prediction and behavioral confirmation.

Threat Scoring correlates evidence from reputation, static analysis, and dynamic analysis into a confidence-based risk score. The scoring engine consolidates signals such as persistence, process injection, payload delivery, suspicious file modification, and command-and-control activity.

The resulting verdict can support policy enforcement and help analysts prioritize threats that require immediate investigation. A consolidated score also reduces the need to interpret disconnected findings across multiple analysis tools.

Predictive Alin AI adds a fast checkpoint before resource-intensive dynamic analysis. The layer reduces unnecessary sandbox demand while adding another opportunity to identify malicious intent before runtime behavior appears.

The previous architecture moved unresolved files from Threat Reputation directly into Dynamic Analysis. Version 3.2.0 can now route each file according to confidence:

• High-confidence clean files can move forward without unnecessary emulation

• High-confidence malicious files can be stopped before detonation

• Uncertain files continue to the adaptive sandbox for deeper inspection

The routing model focuses Dynamic Analysis on files where behavioral evidence adds the most value. MetaDefender Aether still performs deep emulation when a file requires it.

MetaDefender Aether 3.2.0 produces clearer threat classifications supported by the evidence available for each sample. The improved attribution model is designed to reduce ambiguous or heavily qualified tags that require analysts to reconcile multiple signals manually.

Clearer attribution gives security teams more direct information about a threat’s likely identity and intent. The additional context also supports Threat Scoring, Threat Hunting, and downstream response.

MetaDefender Aether 3.2.0 improves detections across blockchain-based infrastructure concealment, malformed executables, document-based payload delivery, destructive malware, and social engineering. The release also expands malware configuration extraction and local reputation coverage.

EtherHiding conceals malicious instructions, URLs, or attacker-controlled infrastructure in blockchain transactions and smart contracts. Decentralized services can make conventional blocking and takedown more difficult. New detection logic helps analysts identify activity associated with EtherHiding and inspect the infrastructure referenced by an analyzed sample.

Malformed .NET assemblies can be engineered to make parsers, decompilers, or automated analysis tools fail before reaching malicious code. MetaDefender Aether now adds detection for malformed .NET structures associated with analysis disruption and evasion.

Remote template injection allows an Office document to retrieve a remote template that contains active malicious content. The technique separates the initial document from the payload and can make the original file appear less suspicious during basic inspection.

MetaDefender Aether 3.2.0 rebuilds its link detection and URL classification pipeline for remote template analysis. The update improves the distinction between genuine remote template injection and ordinary embedded links, addresses two sources of false classification, and detects malicious IP addresses concealed through octal encoding.

Wiper malware is designed to destroy, corrupt, or make data and systems unavailable. New detection engineering improves identification of destructive malware that may offer no recovery path. Earlier detection is especially valuable in critical infrastructure, government, and manufacturing environments where operational availability is a priority.

ClickFix campaigns use fake browser errors, verification prompts, and CAPTCHA-style interfaces to persuade users to execute malicious commands. MetaDefender Aether 3.2.0 expands OCR (Optical Character Recognition)-based CAPTCHA identification, including support for obfuscated but visually rendered fake CAPTCHAs.

The analysis considers what a user sees on the rendered page even when the underlying content is structured to evade text-based detection.

Files enter organizations through email, managed file transfer, cloud applications, web uploads, removable media, software updates, and supply chain workflows. MetaDefender Aether 3.2.0 helps IT and OT security teams inspect these files before they reach users or protected systems.

High-confidence decisions reduce unnecessary sandbox analysis and analysis latency, helping high-volume file workflows keep moving while uncertain samples receive deeper inspection. Consolidated verdicts, clearer attribution, and campaign context help SOC teams spend less time correlating disconnected findings and focus investigations on the threats that require action.

A continuous feedback loop between prediction, emulation, reputation, and threat hunting allows new evidence to strengthen future detection and file decisions.

Learn more about MetaDefender Aether or contact OPSWAT to discuss upgrading to version 3.2.0.