[gotts]

After thinking about.. I think you must be right. Malware detection is not an easy task especially because of Ruby's dynamic nature.

Even simple open(), sleep(), eval() could be easily obfuscated.