Code obfuscation and EDR evasion using LLVM-IR Room: B11-00.13 We will see how LLVM intermediate representation can escape EDR vigilance and give headache to malware analyst.

Custom Malware Communication Protocol Room: B11-00.13 This presents a custom network protocol used by a malware to communicate with their server. This protocol combines both open-source libraries and custom parts to conceal the communication. This presentation will cover the structure of the protocol, helping us understand the data being transferred.