[tgv]

Isn't the risk then that they'll first start scanning for "Scarecrow", or is that hidden somehow?

Also somewhat surprised the source isn't available. That makes trusting it harder, especially to the people it's aimed at.

[jstanley]

Well then you just need to put scarecrow on your honeypot boxes.

[jabroni_salad]

ah, so I shall use scarecrow in my analysis machines since the malware will think I'm just pretending to examine it :)

If you start down this path you will end up in mindgame hell.