Remote Engine

We are excited to announce MetaDefender Aether 3.0.0, OPSWAT’s next-generation unified zero-day detection solution. With this release, the proven MetaDefender Sandbox dynamic analysis engine is now fully integrated into MetaDefender Aether as Layer 2, strengthening Aether’s multi-layered detection architecture and delivering deeper, faster, and more scalable threat analysis at the perimeter.

Improvements

• E-PUB support - Added support for EPUB files, to ensure broader compatibility with widely used e‑reading formats.

• Verdict Renaming – Updated verdicts to provide clearer guidance on how to interpret analysis results and take appropriate actions based on potential threat levels

Bug Fixes

• Duplicate Tags - Tags originating from multiple sources were being shown repeatedly in the UI. The fix ensures that tags are properly deduplicated so each one appears only once.

Improvements

• Stability & Security - Updated core dependencies to enhance performance and security.

Bug Fixes

• Fixed zlib support – zlib files are now correctly processed by the Archive Engine instead of the Adaptive Sandbox, ensuring proper handling and improved efficiency.

What's New

• Full Report Downloading – Introduced the ability to download generated reports from the Remote Engine directly via the Core UI.

What's New 🎉

• Load Balancing / Failover: Implemented Round Robin load balancing and failover to ensure even traffic distribution and high availability during node failures.

• Scan Execution Profiles: Users can now select from predefined scan profiles or create custom profiles, enabling a more streamlined and flexible scanning experience tailored to specific needs.
  

• YARA result triggering: Sandbox scans can now be automatically initiated based on curated rules embedded within the Adaptive Sandbox’s YARA engine, allowing for intelligent, rule-driven threat escalation. YARA Trigger

• Enhanced file type support: The file type selector has been updated to more accurately reflect the full range of formats supported by the Adaptive Sandbox engine, improving usability and clarity.

• Result updated with scan preferences: Selected scan settings are now displayed in the Result tab, making it easier to troubleshoot and understand how each scan was configured and executed.
  

• Threat Indicator details: Report is extended with Threat Indicators details, providing better and easier assessment of the file.

• Updated IOC details: Improved IOC details UI

• Dependency handling: Visual C++ Redistributable is no longer required, making it easier to install and update the engine on the fly.

• Min-Max Analysis timeout changed: Minimum and Maximum Analysis Timeout changed to 60-86400, for better handling of Large Files.

• .Dll files are signed: Windows .Dll files are now signed for better security

• Enhanced Archive handling: Archive File handling improved to reduce Scan times.

• Deep CDR Triggers options added: New Deep CDR Trigger option is added to Workflow configs for a more granular setup option.

• Improved Error Handling: More Errors messages are available for easier problem solving.

• Fixed dependency check for Visual Studio Redistributable on Windows

• Ensured support for Ubuntu 22.04

• Added verdict to IOCs on the UI

• Sandbox standalone version 2.0.0 compatibility

• Improved error reporting

• Added HTTP redirection support

• Improved engine performance and stability

• New IOC types for Crypto wallets

• Crypto Wallet IOCs will not be displayed on the UI until a new Filescan Standalone version is released

• Fixed global config “reset to defaults” feature

• Updated logging for MetaDefender Core support package

• Fixed global config reset to default values feature

• Fixed report generation for files including Email IOCs

• YARA matches displayed on MDCore UI

• Scan results are extended with the list of IOCs

• Private scanning option added, enabled by default

• Reputation lookup support added and enabled by default

• Reputation lookup verdict improvements

• Improved Microsoft Office file handling

• Security and performance improvements

• First versions of Embedded and Remote engines for MetaDefender Core customers