Writing a custom shellcode runner as we did previously in
the Meterpreter Deep Dive module is a good way to embed a
stager inside an executable file.
It also avoids many artifacts that may be left behind
when using them msfvenom format, such as exe and exe‑only.
In order to assess the evasiveness of our shellcode runner,
let's upload it to VirusTotal.
VirusTotal is an online service which is backed by roughly
70 antivirus scanners and reputation services. Once our
shellcode runner has been scanned, we can review the output. Surprisingly,
only 24 out of 69 antivirus scanners flagged our file as being malicious.
This is not bad considering that we have not obfuscated the stager in any way.