[Mandala]

this is only from personal experience especially against WD "xD"

WD for endpoint actually does work

[vobka]

this is only from personal experience especially against WD "xD"

Yes WD's cloud sandbox is very picky for executable that is not signed, same executable with no changes besides valid cert has no issue. If you are more informed please do share im very open to changes.

---

Have you checked what creates the detection?

The stub’s memory allocation method (VirtualAlloc + RWX) is getting nuked.

Comment out code until you are not getting detected and slowly start narrowing down the point. After this you can try to throw off the heuristics unless its completely ruined by AV. Such as WD will flag for persistence when trying to run key to the binary from where the call is coming from.

Thinking of switching to indirect syscalls + RW -> RX remapping and wishing it works. To be honest, I did not want to write my own crypter, but maybe it will be easier than trying to modify existing crypters.

Interesting, ive always had a flag after execution, never from allocating even with RWX