IKARUS scan.engine by IKARUS Security Software GmbH uses advanced, high-performance scanning technologies to analyze various types of content. It supports cross-platform malware detection with on-premise analysis without cloud uploads. The scan engine maintains consistently high detection rates regardless of the operating system for which malware was designed and remains effective even in offline mode. It uses multi-stage and modular methods to analyze file types and content, regardless of transmission type or content appearance. The code is examined statically, with heuristic analysis, and dynamically in self-developed sandbox environments. Actions, reactions, and file accesses are observed and evaluated. Compressed archives are unpacked for analysis, and the scan engine can handle unlimited nesting to check each file individually. Password-protected files can be decrypted and scanned using password lists. All file scans and analyses occur on-premises, ensuring no customer data needs to be uploaded to the cloud. The scan engine is designed for speed, reliability, and scalability, supporting resource-efficient operation with multithreading capabilities. It is highly scalable with minimal processing times, even with high data volumes, and offers consistently high detection rates across all operating systems. The scan engine can examine any container format to any recursion depth, decomposing and unpacking files as many times as needed until fully analyzed. Telemetry can automatically extract code snippets from suspicious files for further analysis, and metadata is forwarded to the IKARUS analysis team for additional processing.
