Implant flagged with "AMSI_Patch_T.B14" even dropper is evading static analysis

[Mojo8898]

Defender is throwing a behavioral detection when executing

Steps to reproduce the behavior:

1. Start a stage-listener and normal listener
2. Enable defender with real-time protection enabled
3. Launch the obfuscated stage 1 dropper
4. See session spawn but get killed after a second.

I believe this likely has to do with donut loader but changing the AMSI patching flags in server/generate/donut.go and building from source did not resolve the issue.