OPSWAT – MetaDefender Aether

MetaDefender Aether is OPSWAT's zero-day file analysis offering, which grew out of the vendor's Filescan Sandbox and was later called MetaDefender Sandbox before taking its current name. Each file passes through a five-layer pipeline that starts with reputation lookups on hashes, URLs, IP addresses and domains, continues with a predictive AI stage that judges file structure before anything executes, and then sends uncertain samples to an adaptive sandbox. Instead of conventional virtual machines, the sandbox relies on instruction-level emulation meant to push evasive code into revealing loader chains, dropped payloads and obfuscated scripts. A threat scoring layer correlates reputation, static and dynamic evidence into a single confidence-based verdict mapped to MITRE ATT&CK and the Malware Behavior Catalog, while machine-learning similarity search links unknown samples to known malware families and campaigns. According to the vendor, the platform runs in cloud, hybrid, on-premises and air-gapped environments and connects to the wider MetaDefender family, including Core, Cloud, email, managed file transfer, ICAP and storage products, as well as SIEM, SOAR and threat-hunting tools through structured output. It suits security operations teams and critical-infrastructure operators that want one automation-ready decision per file rather than stitching together separate sandbox, reputation and intelligence services.