I’m not sure if current design uses this, but I think Software Analyzer should submit detected files to avast! virus lab in order to further enhance Evo-Gen, Software Analyzer itself and also CyberCapture. Currently, I have a feeling it’s only detecting stuff and deleting it locally, but it’s not really sending any data to avast! labs to help improve their protection capabilities.
I’ve been saying this for ages and after doing extensive tests on behavior blockers recently, this is the future. If you work hard and maintain this component it can be incredibly efficient. Yesterday I’ve tested ThreatFire behavior blocker from 6 years ago. It hasn’t received any updates since then and it was still detecting and blocking one of the most recent ransomware samples using behavior analysis only. Now, imagine having such system that is being upgraded and maintained on daily basis. And if it’s possible to automate behavior patterns detection and distributing that to users via VPS updates, it could be unstoppable.