This is a reminder to everyone that your malware payload does not need to be ultra-1337 for it to be effective or evasive. In a bit of irony, the more sophisticated you try to make your malware be, more the IOCs you're introducing into your code base. The goal is to write clean, simplistic, environment specific malware. If you introduce dozens of anti-debug techniques, stack spoofing, sleep obfuscation, VEH system call invocation, server-side or client-side polymorphism, and offensive EDR techniques you're only introducing more things your binary can be identified by from static analysis. If you introduce further methods, like encrypting sections of your binary on disk, you're once again only adding to the pile of shit that makes your binary stick out. Also, don't let the elitist nerds lie to you — if you handcraft your malware is x86 it WILL be caught lightning fast. Handcrafted assembly looks completely different under the microscope (Ghidra, IDA, whatever) and can make YARA rules easier to make.