alternative to avoid Kaspersky? about sharpshooter HOT 7 CLOSED

It looks like Kaspersky has signatured the downloader HTML - it shouldn't be too much effort to obfuscate this also. You can try w/o HTML smuggling,

from sharpshooter.

is not the html, are the files, hta, vbs, js, and others, the html that has nothing to do, there is clear in the image that is the vbs!

from sharpshooter.

Is it triggering through AMSI? It's possible it's flagging the decoded/decrypted dotnet2js blob. It should be possible to obfuscate this.

from sharpshooter.

is simply shellcode, in the end the files vbs, hta, js, execute the original shellcoede, it is useless to create a file that executes the original shellcode because it will be detected, the analysis with noditribute leaves clean but they are pure false negatives.

from sharpshooter.

Then use AV safe shellcode? 👍

from sharpshooter.

and why not obfuse the original shellcodes so that they are not detected at the time of execution?

from sharpshooter.

I don't supply any shellcode with SS, you provide the SS. If you want to obfuscate it in advance you can do.

from sharpshooter.