C# Shellcode Runner vs Antivirus
The C# shellcode runner we developed earlier used VirtualAlloc, CreateThread,
and WaitForSingleObject but included un-encoded and un-encrypted
64-bit Meterpreter shellcode.
Let’s try to compile the standalone shellcode runner as a 64-bit application,
copy the compiled executable to the Windows 10 victim machine,
and perform an on-demand scan with Avira.
Nice! Our custom shellcode runner bypassed Avira’s signature detection.
A ClamAV scan is also clean, meaning our code is undetected by Clam AV as well.
While we've completed the immediate goal of simply writing our own executable,
we would like to know how effective this bypass really is.
Let’s scan our executable with AntiScan.Me.
The report indicates that 11 of the 26 engines flagged our executable.
This isn't bad for a first attempt, especially considering that these engines
executed both signature and heuristic scans.
However, there’s still room to Try Harder.
The most commonly-used technique of bypassing antivirus
is to obfuscate the embedded shellcode so we will address that next.