[GH-ISSUE #611] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A #366

Closed
opened 2026-02-27 15:50:04 +03:00 by kerem · 16 comments
Owner

Originally created by @seancroberts on GitHub (Jun 20, 2017).
Original GitHub issue: https://github.com/quasar/Quasar/issues/611

I've been trying to remove features to find out where the offending code or API call is located, but no luck so far.
I've stripped out the recovery, key-logging, and webcam\video features and the output file form building Client.exe gets quarantined.

Anyone have any idea what I can do to STOP having Window Defender see this file as a threat?

Originally created by @seancroberts on GitHub (Jun 20, 2017). Original GitHub issue: https://github.com/quasar/Quasar/issues/611 I've been trying to remove features to find out where the offending code or API call is located, but no luck so far. I've stripped out the recovery, key-logging, and webcam\video features and the output file form building Client.exe gets quarantined. Anyone have any idea what I can do to STOP having Window Defender see this file as a threat?
kerem 2026-02-27 15:50:04 +03:00
  • closed this issue
  • added the
    invalid
    label
Author
Owner

@EnricoVogt commented on GitHub (Jun 20, 2017):

Whitelist the client on windows defender

<!-- gh-comment-id:309672235 --> @EnricoVogt commented on GitHub (Jun 20, 2017): Whitelist the client on windows defender
Author
Owner

@seancroberts commented on GitHub (Jun 20, 2017):

Thanks and yes, I know that adding client.exe to our firewall’s white-list will fix the problem, but I would still like to know which specific code or call is triggering Windows Defender.

Does anyone happen to know?

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

From: EVmailto:notifications@github.com
Sent: Tuesday, June 20, 2017 3:46 AM
To: quasar/QuasarRATmailto:QuasarRAT@noreply.github.com
Cc: seancrobertsmailto:sean_c_roberts@hotmail.com; Authormailto:author@noreply.github.com
Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611)

Whitelist the client on windows defender


You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHubhttps://github.com/quasar/QuasarRAT/issues/611#issuecomment-309672235, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AP6yZmGb3qvzVv-pciUrpujfw9vscmf_ks5sF3i_gaJpZM4N--Af.

<!-- gh-comment-id:309737942 --> @seancroberts commented on GitHub (Jun 20, 2017): Thanks and yes, I know that adding client.exe to our firewall’s white-list will fix the problem, but I would still like to know which specific code or call is triggering Windows Defender. Does anyone happen to know? Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: EV<mailto:notifications@github.com> Sent: Tuesday, June 20, 2017 3:46 AM To: quasar/QuasarRAT<mailto:QuasarRAT@noreply.github.com> Cc: seancroberts<mailto:sean_c_roberts@hotmail.com>; Author<mailto:author@noreply.github.com> Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611) Whitelist the client on windows defender — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<https://github.com/quasar/QuasarRAT/issues/611#issuecomment-309672235>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AP6yZmGb3qvzVv-pciUrpujfw9vscmf_ks5sF3i_gaJpZM4N--Af>.
Author
Owner

@EnricoVogt commented on GitHub (Jun 20, 2017):

I think (not really sure) that Windows Defender has a Signature based detection. So you can try to Obfuscate the client build .. maybe its working. I dont know

<!-- gh-comment-id:309778699 --> @EnricoVogt commented on GitHub (Jun 20, 2017): I think (not really sure) that Windows Defender has a Signature based detection. So you can try to Obfuscate the client build .. maybe its working. I dont know
Author
Owner

@seancroberts commented on GitHub (Jun 21, 2017):

I seem to have it working now without Windows Defender not seeing the client as a threat.

Most of the code that SEEMED to trigger that was located in and around ClientData – and functions related to the .exe copying itself to ProgramData and then using encryption

<!-- gh-comment-id:310034969 --> @seancroberts commented on GitHub (Jun 21, 2017): I seem to have it working now without Windows Defender not seeing the client as a threat. Most of the code that SEEMED to trigger that was located in and around ClientData – and functions related to the .exe copying itself to ProgramData and then using encryption
Author
Owner

@gozilla-paradise commented on GitHub (Jul 5, 2017):

@seancroberts What's about other AV? Are they detect after you have modified that piece of code?

<!-- gh-comment-id:312971342 --> @gozilla-paradise commented on GitHub (Jul 5, 2017): @seancroberts What's about other AV? Are they detect after you have modified that piece of code?
Author
Owner

@seancroberts commented on GitHub (Jul 5, 2017):

Once I got rid of the code that attempted to rename or hide the client.exe, Windows Defender (W10, 64-bit and W7, 32-bit) did not identify client.exe as malware nor did it try to quarantine the file.

I intend to use parts of the Quasar RAT code as a part of my legitimate domain support responsibilities, so there is no need to hide or rename client.exe.

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

From: AlienHackmailto:notifications@github.com
Sent: Tuesday, July 4, 2017 8:42 PM
To: quasar/QuasarRATmailto:QuasarRAT@noreply.github.com
Cc: seancrobertsmailto:sean_c_roberts@hotmail.com; Mentionmailto:mention@noreply.github.com
Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611)

@seancrobertshttps://github.com/seancroberts What's about other AV? Are they detect after you have modified that piece of code?


You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/quasar/QuasarRAT/issues/611#issuecomment-312971342, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AP6yZuBH5B3LhB3f69NEq3RMeO9hYLqyks5sKtv9gaJpZM4N--Af.

<!-- gh-comment-id:312998413 --> @seancroberts commented on GitHub (Jul 5, 2017): Once I got rid of the code that attempted to rename or hide the client.exe, Windows Defender (W10, 64-bit and W7, 32-bit) did not identify client.exe as malware nor did it try to quarantine the file. I intend to use parts of the Quasar RAT code as a part of my legitimate domain support responsibilities, so there is no need to hide or rename client.exe. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: AlienHack<mailto:notifications@github.com> Sent: Tuesday, July 4, 2017 8:42 PM To: quasar/QuasarRAT<mailto:QuasarRAT@noreply.github.com> Cc: seancroberts<mailto:sean_c_roberts@hotmail.com>; Mention<mailto:mention@noreply.github.com> Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611) @seancroberts<https://github.com/seancroberts> What's about other AV? Are they detect after you have modified that piece of code? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://github.com/quasar/QuasarRAT/issues/611#issuecomment-312971342>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AP6yZuBH5B3LhB3f69NEq3RMeO9hYLqyks5sKtv9gaJpZM4N--Af>.
Author
Owner

@santoshcxs commented on GitHub (Jul 26, 2017):

@seancroberts Please let us know the code changes you have done, for Windows Defender not seeing the client as a threat.

<!-- gh-comment-id:317953772 --> @santoshcxs commented on GitHub (Jul 26, 2017): @seancroberts Please let us know the code changes you have done, for Windows Defender not seeing the client as a threat.
Author
Owner

@Clevelus commented on GitHub (Aug 19, 2017):

It is necessary to refine the ways of hiding the process. It is useless if any modern antivirus immediately detects it.
Also, you need to add a setting that allows you to disable this mechanism, since it is not needed by some users.

<!-- gh-comment-id:323547779 --> @Clevelus commented on GitHub (Aug 19, 2017): It is necessary to refine the ways of hiding the process. It is useless if any modern antivirus immediately detects it. Also, you need to add a setting that allows you to disable this mechanism, since it is not needed by some users.
Author
Owner

@seancroberts commented on GitHub (Aug 28, 2017):

"It is necessary to refine the ways of hiding the process," writes Clevelus...
I am not interested in hiding the process - my intended use for parts of Quasar RAT are for my legitimate work-related admin responsibilities.
I find no value in being able to get passwords from browser settings, turn on web cams without alerting users, logging keys, nor hiding the process I'm trying to run.
I find incredible value in being able to see and manipulate a remote desktop and I find value in being able to access a computer's command console remotely.
The rest of what I need I can already do - run remote programs, silently or interactively, as local system or as the logged on user by installing a remote service, allowing it to interact with the desktop and then doing a little session\handle\API magic.
I have a remote registry editor that has full remote registry visibility through WMI, and it's also through WMI that I can report on just about anything on a computer system... all agent-less\client-less.
At the moment I am trying to see if I can implement remote desktop functionality using the same service I use to execute remote programs, but if I have to, I'll install the service and have it run a client temporarily.
So far, the one function I want but can't implement without a client is the remote command-console.
If anyone wants to work with me on any of this, please let me know because I would love to collaborate.

<!-- gh-comment-id:325248450 --> @seancroberts commented on GitHub (Aug 28, 2017): "It is necessary to refine the ways of hiding the process," writes Clevelus... I am not interested in hiding the process - my intended use for parts of Quasar RAT are for my legitimate work-related admin responsibilities. I find no value in being able to get passwords from browser settings, turn on web cams without alerting users, logging keys, nor hiding the process I'm trying to run. I find incredible value in being able to see and manipulate a remote desktop and I find value in being able to access a computer's command console remotely. The rest of what I need I can already do - run remote programs, silently or interactively, as local system or as the logged on user by installing a remote service, allowing it to interact with the desktop and then doing a little session\handle\API magic. I have a remote registry editor that has full remote registry visibility through WMI, and it's also through WMI that I can report on just about anything on a computer system... all agent-less\client-less. At the moment I am trying to see if I can implement remote desktop functionality using the same service I use to execute remote programs, but if I have to, I'll install the service and have it run a client temporarily. So far, the one function I want but can't implement without a client is the remote command-console. If anyone wants to work with me on any of this, please let me know because I would love to collaborate.
Author
Owner

@sndcode commented on GitHub (Sep 8, 2017):

@seancroberts
what EXACTLY did you do to make the client compiling with windows defender ON ?
Maybe you could also just share your modified software `?

<!-- gh-comment-id:328089937 --> @sndcode commented on GitHub (Sep 8, 2017): @seancroberts what EXACTLY did you do to make the client compiling with windows defender ON ? Maybe you could also just share your modified software `?
Author
Owner

@seancroberts commented on GitHub (Sep 8, 2017):

I rem’d-out or removed all code having to do with the client renaming itself or trying to hide its executable.

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

From: Sandaasumailto:notifications@github.com
Sent: Friday, September 8, 2017 8:30 AM
To: quasar/QuasarRATmailto:QuasarRAT@noreply.github.com
Cc: seancrobertsmailto:sean_c_roberts@hotmail.com; Mentionmailto:mention@noreply.github.com
Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611)

@seancrobertshttps://github.com/seancroberts
what EXACTLY did you do to make the client compiling with windows defender ON ?


You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/quasar/QuasarRAT/issues/611#issuecomment-328089937, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AP6yZp6D4I07I2MK6x6HplVrn79jlgMjks5sgTLtgaJpZM4N--Af.

<!-- gh-comment-id:328092971 --> @seancroberts commented on GitHub (Sep 8, 2017): I rem’d-out or removed all code having to do with the client renaming itself or trying to hide its executable. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: Sandaasu<mailto:notifications@github.com> Sent: Friday, September 8, 2017 8:30 AM To: quasar/QuasarRAT<mailto:QuasarRAT@noreply.github.com> Cc: seancroberts<mailto:sean_c_roberts@hotmail.com>; Mention<mailto:mention@noreply.github.com> Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611) @seancroberts<https://github.com/seancroberts> what EXACTLY did you do to make the client compiling with windows defender ON ? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://github.com/quasar/QuasarRAT/issues/611#issuecomment-328089937>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AP6yZp6D4I07I2MK6x6HplVrn79jlgMjks5sgTLtgaJpZM4N--Af>.
Author
Owner

@life-coder commented on GitHub (Sep 17, 2017):

"remote command-console" What do you mean by this?

Also note that you can hide it from scans, but using any anti virus that checks behaviour. Like G-Data, bitdefender etc. It WILL be blocked since it probably installs? Into windows dir? And it makes a network connection, that will trigger any av with behaviour checks

<!-- gh-comment-id:330103100 --> @life-coder commented on GitHub (Sep 17, 2017): "remote command-console" What do you mean by this? Also note that you can hide it from scans, but using any anti virus that checks behaviour. Like G-Data, bitdefender etc. It WILL be blocked since it probably installs? Into windows dir? And it makes a network connection, that will trigger any av with behaviour checks
Author
Owner

@seancroberts commented on GitHub (Sep 18, 2017):

Running cmd.exe on a remote computer, and having the input and output redirected to a local computer.

So, on a remote computer, one could both run commands like “dir” or “gpupdate /force” or “ipconfig” and see the output text on a local computer.

QuasarRAT has this functionality and I want to use\replicate it in my own program.

Sent from Mailhttps://go.microsoft.com/fwlink/?LinkId=550986 for Windows 10

From: matteke-gamesmailto:notifications@github.com
Sent: Sunday, September 17, 2017 6:58 PM
To: quasar/QuasarRATmailto:QuasarRAT@noreply.github.com
Cc: seancrobertsmailto:sean_c_roberts@hotmail.com; Mentionmailto:mention@noreply.github.com
Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611)

"remote command-console" What do you mean by this?

Also note that you can hide it from scans, but using any anti virus that checks behaviour. Like G-Data, bitdefender etc. It WILL be blocked since it probably installs? Into windows dir? And it makes a network connection, that will trigger any av with behaviour checks


You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://github.com/quasar/QuasarRAT/issues/611#issuecomment-330103100, or mute the threadhttps://github.com/notifications/unsubscribe-auth/AP6yZo5dCfDGAU-w6PCDWBg27iOQqYQ0ks5sjbI9gaJpZM4N--Af.

<!-- gh-comment-id:330200523 --> @seancroberts commented on GitHub (Sep 18, 2017): Running cmd.exe on a remote computer, and having the input and output redirected to a local computer. So, on a remote computer, one could both run commands like “dir” or “gpupdate /force” or “ipconfig” and see the output text on a local computer. QuasarRAT has this functionality and I want to use\replicate it in my own program. Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows 10 From: matteke-games<mailto:notifications@github.com> Sent: Sunday, September 17, 2017 6:58 PM To: quasar/QuasarRAT<mailto:QuasarRAT@noreply.github.com> Cc: seancroberts<mailto:sean_c_roberts@hotmail.com>; Mention<mailto:mention@noreply.github.com> Subject: Re: [quasar/QuasarRAT] Client, on build, being detected by Windows Defender as: Backdoor:Win32/Xiclog.A (#611) "remote command-console" What do you mean by this? Also note that you can hide it from scans, but using any anti virus that checks behaviour. Like G-Data, bitdefender etc. It WILL be blocked since it probably installs? Into windows dir? And it makes a network connection, that will trigger any av with behaviour checks — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://github.com/quasar/QuasarRAT/issues/611#issuecomment-330103100>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AP6yZo5dCfDGAU-w6PCDWBg27iOQqYQ0ks5sjbI9gaJpZM4N--Af>.
Author
Owner

@mkramer74 commented on GitHub (Sep 24, 2017):

@seancroberts - Is it possible to get your sources ?

Regards,
michael

<!-- gh-comment-id:331698914 --> @mkramer74 commented on GitHub (Sep 24, 2017): @seancroberts - Is it possible to get your sources ? Regards, michael
Author
Owner

@Rottweiler commented on GitHub (Oct 3, 2017):

After obfuscating everything but the names in the assembly I think I can safely assume it’s the assembly names

<!-- gh-comment-id:333818113 --> @Rottweiler commented on GitHub (Oct 3, 2017): After obfuscating everything but the names in the assembly I think I can safely assume it’s the assembly names
Author
Owner

@MaxXor commented on GitHub (Oct 9, 2017):

Whitelist the file.

<!-- gh-comment-id:335273924 --> @MaxXor commented on GitHub (Oct 9, 2017): Whitelist the file.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Quasar#366
No description provided.