[BUG] Virustotal detects discord webhook url

[voidgod888]

ShadowSniff Build/Version

2.0.0 or more specifically commit number 408

What happened?

the webhook is showing in Contacted URLs in virustotal i really dont know if that ok at this stage of development so yes.

Operating System Details

Windows 11 x64

Execution Context

yes in virustotal but i know the anti vm is in work in progress so yes

Persistence Status

im not sure

Exfiltration Behavior

the data was exfiltration successfully

Antivirus / Defender Reaction

6 detection

[voidgod888]

[sqlerrorthing]

6 of 72 detects without any crypt is good in my opinion, especially detects from noname av

[sqlerrorthing]

and idk how to protect the webhook url.
bc this is dst url. but this crypted for static analysis by obfstr, the telegram credits too.

[voidgod888]

6 of 72 detects without any crypt is good in my opinion, especially detects from noname av

i know i didnt say anything bad it really good

[voidgod888]

and idk how to protect the webhook url. bc this is dst url. but this crypted for static analysis by obfstr, the telegram credits too.

well im not a rust coder but i can suggest you check out EvilBytecode or more specifically his repo in go if you know golang https://github.com/EvilBytecode/Ebyte-Go-Morpher

[sqlerrorthing]

& n the stealer doesnt build the log in the filesystem like in temp path. they use virtual filesystem here

[sqlerrorthing]

https://github.com/EvilBytecode/Ebyte-Go-Morpher

in my opinion this useless, the static analysis already obfuscated.
i cant hide requests from.. like... HTTPDebugger or MITMProxy, also Virustotal. only antivm will help.

[KiExitDispatcher]

s1 is known not noname, ebyte go morpher is to obfuscate strings and more. it can be useful in maldev