🚀 go-pugleaf

Hmm.  MtE detection is difficult, but there are a few things that one
can look out for in order to help you get a staart if you are writing
an MtE detector, without having "big labs" and stuff.
 
One, as someone kindly pointed out at one time, I forgot where I saw
it, but the MtE can only generate certain code.  It can't generate a
variety of instructions, and any program which begins with these
instructions cannot possibly be infected.
 
Two, the MtE always has certain markers.  For example, the end of the
decrypting algorythm always ends with JNZ.
 
If you have a disasssembler, or even debug, you can spend a few hours
and figure out how to take care of a variety of infections.