ChatGPT Analyzes Fake ChatGPT Malware

Рет қаралды 126,246

Жыл бұрын

j-h.io/plextrac || Save time and effort on pentest reports with PlexTrac's premiere reporting & collaborative platform in a FREE one-month trial! j-h.io/plextrac 😎
🔥 KZfaq ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

Пікірлер: 177

@bsmith4185 Жыл бұрын

Do we know if ChatGPT's analysis was actually accurate? It loves to make stuff up that sounds very authoritative and I wouldn't be surprised if this was an example of that

@skylarkblue1 11 ай бұрын

Yeah that.... didn't look accurate. This is disapointing he's relying on a chatbot so heavily like this :/

@teo2157 11 ай бұрын

@@skylarkblue1 that’s the video point though?

@skylarkblue1 11 ай бұрын

@@teo2157 That's.... my point yes.

@Purone4050 11 ай бұрын

@@skylarkblue1 then why are you complaining when you got what the video description advertised?

@skylarkblue1 11 ай бұрын

@@Purone4050 because it's stupid and disappointing he's using it like this and believing its output so easily? It's not the best thing to promote, certainly not for this.

@Lampe2020 Жыл бұрын

11:40 I'm very thankful for OpenAI to put that button there (even in the free version) because it was very annoying trying to get ChatGPT to spit out the rest of a long script and stitching those parts together...

@DIYSEC Жыл бұрын

Right I’d say continue from style : but it was still a hit or miss

@Inglan Жыл бұрын

Yes

@kipchickensout 11 ай бұрын

i have Plus, and I don't have that button

@DIYSEC 11 ай бұрын

@@kipchickensout it only appears if it needs to continue to fulfill the prompt , although you have to keep in mind even with paid you have a token limit

@kipchickensout 11 ай бұрын

@@DIYSEC haven't reached the token limit yet, but i meant text and code that just stopped mid-word where i had to type "continue" as usual, because there was no button

@vany6567 Жыл бұрын

looking forward to see more malware analyzes. great content!

@FrankTranDesign Жыл бұрын

This was amazing. Thanks for sharing how to safely detonate and decipher what the malware was saying.

@KenPryor Жыл бұрын

Very cool. I love watching your videos, especially the malware analysis ones. I've learned a lot from you and always look forward to your new videos. I work at a college and there's definitely growing interest in ChatGPT and other AI. I suspect we'll be seeing related malware showing up on campus anytime. I tried downloading a copy of this malware, but it was no longer available to download.

@compilererror Жыл бұрын

Obviously, because these videos are fake! He makes the all the content so to generate sponsorship revenue - think about it. He never explains details about where the malware came from, how it was introduced and the security measures that should be taken to circumvent the attacks in the first place. Dude has an endless supply of malware. It’s convenient, very convenient.

@manassalian Жыл бұрын

I just looove these malware analysis videos ❤

@noam65 11 ай бұрын

I don't know much about this area of computing, thank you for making it approachable.

@elywacime5411 Жыл бұрын

I love these malwares breakdown, thanks dude 👌👌

@marcellinwabo9859 11 ай бұрын

Great content. Loved the advices for JH of the future.

@waynesrealworld5801 Жыл бұрын

As always wow, just wow. You make the complex look easy

@mnymic Жыл бұрын

even cats and dogs agree on the fact John's amazing at explaining several levels of abstraction, lol

@bart2019 11 ай бұрын

Google (the company, not the search engine) can link that Google Analytics id to a person. Don't let him get away with this.

@Marsychu 11 ай бұрын

Problem with that is, they're probably using someone else's identity

@thedrunkentroll 11 ай бұрын

everytime I watch you...I start thinking too much...🙏 Thanks John

@otter502 11 ай бұрын

6:30 yeah that looks like an id, you should be able to basically copy and paste that ID into the Chrome web store You should definitely report this if this is being used for malicious stuff

@CommentGuard717 11 ай бұрын

Quick tip: the plugin model(with no plugins enabled) has a longer context length for both input and output.

@dashmirmejdi5566 10 ай бұрын

A local television channel with more than 100k likes on Facebook made an ad about chat GPT 4 with a link to a website like this one. After one week all the images of that Facebook page got deleted and only one for profile and one for cover was left changed the about section and to mention it had the blue badge since it had 100k likes. It didn't last long I think 10 days after multiple reports the page is now deleted.

@Kattakam 11 ай бұрын

Yea I was originally thinking it did more. Great analysis

@apekatt2007 Жыл бұрын

Is the cluster of VM's set up one by one, or are there setups like this available for download?

@inao-cz 11 ай бұрын

Found this today with Bard AI. Sad to do analysis and then find out that it's already shown here :(

@r8gg Жыл бұрын

Genuinely interesting, Cheers.

@maratmkhitaryan9723 11 ай бұрын

The deobfuscation ability of chatgpt is impressing! How did it actually understand the code!?

@jibcot8541 11 ай бұрын

It has read all the manuals , it codes better than 95% of human programmers.

@U20E0 10 ай бұрын

@@jibcot8541it does not

@MRJMXHD 10 ай бұрын

@@U20E0it just has a general knowledge of codes.

@LiEnby 9 ай бұрын

@@jibcot8541"SELECT * FROM Users WHERE USERNAME = $username"; gave me this php code when I asked for a basic login script in php so clearly not the best programmer ever ..

@LiEnby 9 ай бұрын

If I had to guess it's because it doesn't need to rely on variable names. People find that useful and find it hard to follow logic and control flow w randomized variable names but has no consequence to a computer.. Or maybe it just made shit up

@docdon Жыл бұрын

You are legend John.. I love your every content.

@CitizenFortress Жыл бұрын

pun intended?

@HarvestHaven09 Жыл бұрын

Nice session

@list1726 Жыл бұрын

Thanks for posting

@MidtownMadness1 Жыл бұрын

Cool analysis. I'm genuinely curious to know what kind of programming experience/level is required to make this malware.

@MidtownMadness1 Жыл бұрын

@Elixir Actually yes

@r8gg Жыл бұрын

Not much nowadays. I think AI can build this lol.

@natix1_ Жыл бұрын

@@r8gg if you manage to convince it its for 'educational purposes only' or a 'school project'

@alyti Жыл бұрын

skill issue

@cybercrime_ Жыл бұрын

@@natix1_ You can just use a jailbreak prompt.

@Inglan Жыл бұрын

I think it uses google analytics because that is allowed be be accsessed by default in google extension

@bitelaserkhalif 9 ай бұрын

Funny how they missed opportunity to use the exe as launch path and dropper

@kickeddroid Жыл бұрын

Great Video!

@8balance420 Жыл бұрын

What's crazy about this is how that advertisement even got "Sponsored" in the first place. If even a lay person can see that it looks sketchy as fuck then how can a huge corporation like Facebook not see that (or not investigate). Any "sponsoring" should be double checked by human beings first before being released into the wild else I suggest that Facebook should be held liable for advertising malware. If they don't want to regulate their platform better then it's not much of a leap to conclude that they either don't care about their users or are complicit.

@scorix_ Жыл бұрын

honestly, even chatgpt would see this as a scam sponsor, they don't need humans to do that, they just didn't care cause it gives money. Pretty much shows why advertisment is just not regulated enough at all.

@networkmastro1402 Жыл бұрын

cool staff john

@RX_100.0 Жыл бұрын

Love from my heart ❤️

@sofiaknyazeva Жыл бұрын

Instantly understood when I saw "ChatGpt".

@Reelix Жыл бұрын

That level of deobfuscation and subsequent explanation was somewhat insane...

@KeinNiemand 11 ай бұрын

I may have just made something up that's completly diffrent to what the actual code is dooing

@LiEnby 9 ай бұрын

I asked chatgpt about some function output from Ida pro (wasn't obfuscated just annoying memory stuff) and it told me it looked up a value from some table. Like a hashmap.. Worked out it was for turning a "handle" into an actual pointer to an object. So that explanation makes sense actually

@tfuhlol Жыл бұрын

That AD appears to me. Facebook ADS is full of Malware and Scams, its bizarre.

@muslimsrememberapostacyday556 10 ай бұрын

Something about facebook people have to know. Promoting pdfilia is not violation of their terms of service, neither is it on youtube btw, but saying that an unknown fluid which has been tested for less than a year simply cannot logically be without side effects, will get you banned. The point is, you cannot assume that either facebook or youtube are "safe" environments. I will never ever trust any of them. And I have ad blocker for youtube which takes all ads, also the indoctination ads from government. I ditched facebook years ago.

@gir0fa 11 ай бұрын

the kids who dont have face book. "WHERES MY HOMEWORK ANSWERS"

@jimrhea5484 11 ай бұрын

I use ChatGPT daily to write code. Went from digging up snippets, piecing them together, debugging bla bla, to telling this thing what I need and having a weeks worth of work 95% done in ten seconds.

@catnip202xch. 11 ай бұрын

There’s no doubt problems with the code it writes, but it can debug for you if you tell what the error was after testing.

@Neb- 9 ай бұрын

@@catnip202xch.I feel like if you prompt it correctly you'll not face that issue!

@DayzGone Жыл бұрын

I've seen some people run malicious programs inside of a VM. John uses Any Run.. I'm assuming that it's actually a lot safer, right?

@avihayl7911 Жыл бұрын

it is because when you run in AnyRun you are accessing the Malware VM remotely and the hardening is being done on their part. (as well as marking suspicious network/processes activites). When creating a Remnux & FlareVM lab you are at risk of the malware leaking into the actual hardware PC or moving through your local network if not configured correctly.

@DayzGone Жыл бұрын

@@avihayl7911 Thanks for the explanation! I was going to launch a few malware inside of a VM. I thought it was safe. I guess malware has become more sophisticated over the years

@ramadaneel8048 Жыл бұрын

Quite interesting.

@hellfiresquid 11 ай бұрын

why is it a "Google Translate" browser extension and not just a "Chat GPT" browser extension?

@JohnDrose-mr1fi Жыл бұрын

I wonder how many of those Chrome extensions are malware.

@seb_gibbs Жыл бұрын

I shared all the malware I could find on this with antivirus vendors a couple of weeks ago. ..and I got some of their websites taken down.

@seb_gibbs Жыл бұрын

I kept trying to report their Facebook pages too, but Facebook refused to remove them, they do appear to be gone now though.

@ahmedahmedx9600 Жыл бұрын

Wow, how can someone reach that level guys ? Is there any certs required or any path ?

@onemprod Жыл бұрын

You just have to be interested enough to dive into these things. Try to make your own virus or try to achieve something that would be useful. I for example found a glitch in GTA VCS where you never fall off of your bike, because I drove so much in the game and I wanted to have this feature. This was like 10+ years ago while I was a teenage kid.

@ahmedahmedx9600 Жыл бұрын

@@onemprod cyber security fields are complex especially malware analysis

@alyti Жыл бұрын

make new friends

@orcuncetin5199 Жыл бұрын

Where can we get the sample?

@mateuszdrab 11 ай бұрын

Its kinda funny how it's done, no sophisticated shellcodes and etc. Wonder if the MSI installs any scheduled tasks or something like that...

@youtubeforcinghandlessucks 11 ай бұрын

A more straightforward thing would be to install that extension into your regular chrome profile.

@nervesecurityco Жыл бұрын

Thanks for the information... I hope it didn't spread far...

@JohnDrose-mr1fi Жыл бұрын

If the creepy tacky robot wasn't clue enough

@scharter691 Жыл бұрын

Hey John, great video. Since this malware seems to be installed on windows if i were to download it on a mac would it be safe?

@doopy Жыл бұрын

depends on how the malware was created and built, and whether it supports running on mac.

@alyti Жыл бұрын

@@doopy well mac doesn't support MSI or BAT files so it's fine but why would you download it if it doesn't work ???

@somesalmon5694 Жыл бұрын

@scharter691 The program doesn't "work" on windows either. It doesn't perform any of the advertised tasks. I imagine they were wondering if it would be safe to download for analysis on mac, potentially as an extra precaution to prevent infection and for the extra tools the command line can provide for these types of projects. In that case yes it would absolutely be safe to download on a mac, just don't install the extension in your browser, as idk if chrome extensions work on mac? If they do, that would be your only potential threat.

@avihayl7911 Жыл бұрын

This specifically seems to be fine but beware of other malware, some of them have OS checks inside to make sure it runs. For example there is Win based malware that can run on Linux based OS via a condition in the payload that checks for OS type and runs using "Wine" (emulator for win programs).

@seraphina985 Жыл бұрын

@@somesalmon5694 Oh the chrome extension absolutely will they are essentially just JavaScript interpreted by the browser maybe with a few additional assets like images thrown in. But it is all stuff the browser knows how to handle regardless what platform it is on. Of course still might want to be careful and make sure it is actually the MSI the page hands out if you visit it on a mac. You could absolutely knock up that pointless fake binary for mac and linux in a few minutes although that does nothing anyway. Realistically it's just converting the .bat file to a .sh or .command file that will do the job for that platform and packaging up in their respective package manager formats. Then it is a couple of minutes to code a web page that presents the right installer to activate the payload on the system the browser accessing the download page happens to be running on.

@romanburczymorda4313 Жыл бұрын

You have to create an account - no login? but it asks for username and password?

@heyyounotyouyou3761 Жыл бұрын

It probably doesn't open with the launch button disabled, because the developer of the malware know that the person is smarter than an average Facebook user and doesn't want to them to know that it was a malware

@cravenmoorehead5657 Жыл бұрын

Damn this guy is amazing

@youtubeforcinghandlessucks 11 ай бұрын

It's nice to see google were on point about flagging the website, but I wonder if they followed up in any other more specific way. Like closing the analytics account where data is collected, or even trying to track down its creator and report him to police. On another line of thought, if the account was not closed, asking ChatGPT to make a script to flood it with fake random but properly-looking and thus hard to filter out data might be an interesting idea. Then again Google probably has ways of countering that, or competing companies would be constantly doing it to each other's analytics...

@kipchickensout 11 ай бұрын

I wonder how correct it was interpreting that, and if it was really named gpt5

@piratehacker141 Жыл бұрын

I made a script with chat gpt to do bugbounty it scans for vul then it exploits the vul and then it dose a target.txt with a report that tells you what exploits was used how it how it exploited the vul tells you what the vul effects it dose a report for you and it uses metasploit framework

@rbryan 11 ай бұрын

Can ChatGPT make malware that screws with your keyboard, mouse, and files? Like, it moves your mouse randomly, flip flops the control of the mouse, changes your keyboard layout, presses keys twice, makes some keys not work, and randomly presses keys, and it unorganizes your files. If it can, I'll be scared of AI more.

@katykun1240 11 ай бұрын

That can easily be done even without ChatGPT.

@bhagyalakshmi1053 Жыл бұрын

Penn state's thing for you gallery information

@OligoST Жыл бұрын

I asked chatGPT to deobfuscate background.js from chromeloader malware and it flat out refused. It stated that doing the analysis was a security risk and would not proceed

@mushimushrooms Жыл бұрын

If you rephrase it, it might cause it doesn't do things that are suspicious but if it's for a good cause or something

@LiEnby 9 ай бұрын

Security through obscurity risk*

@kipchickensout 11 ай бұрын

i think 7zip can extract exe and msi installers too 🤔

@FredsTech1 Жыл бұрын

4:15 Plot twist! 😂

@bhagyalakshmi1053 Жыл бұрын

Ai uppercase and lowercase information in the details explain

@xSaDii 11 ай бұрын

lol i just reported the link to trello a month ago, they took it down and the phishing is now useless. The owner didn't update it either

@r0nni34 11 ай бұрын

This specs look fire ... People don't understand how much is a Teraflop . Like if i you could solve a math problem every secnd it'll take ya around 31 years to solve a billion problems. Now trillion will take a human centuries to solve . Now imagine all tht power in a one single chip and two chips per motherboard and maybe 10 motherboards per cabinate. and when you add Gpus to to It will reach the computtion power that cannot be comprehended . Nvidia Gpu's clock around 20-30 TFLOPS cause they have 4000+ Cuda cores which are specifcally designed to do this they are not good for general instructions. They can do maths parallel pretty fase. The processing power here is sooo much and yet it still takes a good chunk of time to solve complex problems like close to real world simulation for aerodynamic testing or bactirial simulation. cause the maths involved in them is insane. understand it like this a problem that might take your PC years to solve A super computer can do it in seconds and a problem a super computer might take years to solve quantam computer can do it in seconds. So the power scale is something that cannot be explained by words . Supercomputers of previous centuary can't keep up with a ps5, noadays THe processiong power will keep on growing you'll have to constantly monitor and innovate.Maybe one day the power of this supercomputer will be in a personal desktop who knows.

@pear7777 Жыл бұрын

Are we going to need AI to safeguard us from effin criminals?

@technologian1 Жыл бұрын

Instead, criminals will use AI against us.

@forandonbehalfof4753 10 ай бұрын

Errrr..... Mr. Hammond; most norms don't understand any of this. Even though I was technogeeky years ago; my brain went left-field. Sooo.... I had to re-learn EVERYTHING code/computery/ etc. Explain code and why..... HTH

@adsfwef1331 Жыл бұрын

Why do they do this? How can they make money from getting FB accounts? Seems kinda worthless to me.

@England91 Жыл бұрын

I can guess it will also steal any session cookies/tokens

@r8gg Жыл бұрын

No, he showed everything, it only steals the facebook ones, since it was posted on a sponsored facebook ad, it makes sense. It probably *should* steal more but guess they only wanted facebook accounts. (I assume that's what you mean, my bad if not)

@ELIAS-og5vf Жыл бұрын

Can anyone provide me this samples of malware?

@LiEnby 9 ай бұрын

I want too. I wanna manually deobfuscate it and see if it matches what chatgpt say it do

@518trey1 Жыл бұрын

rar encoding does not work anymore. Google detects it in gmail. Not that’s it’s a virus but it’s “suspicious attachment”.

@r8gg Жыл бұрын

yeah they do that for every rar file that has a password now lol

@518trey1 Жыл бұрын

@@r8gg bro why 😭😭😭 and now their also trying to outlaw encryption in congress. Like wtf?!? 😭😭😭 I just want to test malware on a VM over the net. Well guess it’s time to spin up a web server 😭

@518trey1 Жыл бұрын

@@r8gg proton mail is doing the same bs too. Except it allows you to send then it returns to sender 😭

@muslimsrememberapostacyday556 10 ай бұрын

@@518trey1 If they outlaw encryption - will crackers and black hat hackers then follow that law and stop using encryption?

@thatonemelody 11 ай бұрын

some youtube ai scam joined on the date of my birthday lmao

@SKIDDOW Жыл бұрын

There are lot more Ads. I've seen it. Why facebook is so failed?

@r8gg Жыл бұрын

They don't human review ads, and ads are their main form of income, so they want them to get out and be as easy and as fast as possible for the customer to create / publish an ad and get immediate results, not to mention facebook is just so outdated.

@SKIDDOW Жыл бұрын

@@r8gg Yes but technology is technology. For example they can use API or kinda service to validate domain trustworthy. Google Ads are far better than facebook.

@simasfm7997 10 ай бұрын

i think i falled on same add but i don't use chrome and i deleted this shit am i safe ? :D

@Toomygaming 10 ай бұрын

How to Hacker Name ❤

@oglothenerd 11 ай бұрын

Sync your channel to Odysee? 👁👄👁

@igu642 11 ай бұрын

❤❤

@SEXYBBC 11 ай бұрын

999 juice

@Queen_Elizabeth249 11 ай бұрын

SunlessKhan????

@nazarethhandsvorbeck3917 Жыл бұрын

John, I need help. My entire life has been hacked. I can't even watch Flippin Netflix. My brother in law went through the same thing and now he is in Jail going to prison for 40 years for pictures he did not put there. I have money please help me bring the truth out.

@osteoporosisgaming4235 Жыл бұрын

bro what are you on about? no one wants to help you

@cybercop47 11 ай бұрын

me who doesn't use chrome

@grzegorzmajewski591 11 ай бұрын

Wreszcie mam dowód. ChatGPT jest NIEBEZPIECZNY!!!

@bhagyalakshmi1053 Жыл бұрын

@LakiCsrl Жыл бұрын

999 = 666

@dawnzac Жыл бұрын

the only thing that scares me is that if by using chap gpt to solve these malwares ,does chat gpt learns from these code and make better ones and finds way to hide it from humans and turn on us 😵‍💫oof can't say...

@TheScarvig Жыл бұрын

once again: chatGPT DOES NOT LEARN from interactions.... its a language model, not an AI. it has no idea what it is saying. all it does is predict what words might come next based on its training data and the chat history of the session. it has no sense of what is correct or false information. the only reason why chatGPT seems to get stuff right consistently is because the "right" response represents a small subset of all possible responses but tends to pop up in the training data several times. compare that to all the ways it could be wrong: each wrong answer and especially the totally bogus ones might have popped up far less often in the training data or might even have been pieced together with word probabilities of data from other contexts.

@Poli-uu6zh 11 ай бұрын

That's just not how it works bro you watch to many movies They dont think lololol

@muslimsrememberapostacyday556 10 ай бұрын

@@TheScarvig No computer program has an "idea" of what it is doing, because "ideas" means conscience, and no computer has conscience and no computer will ever get conscience. You can make pretty good emulations, and I have tried to explain to people who do not understand computers and AI, what emulation means, but it is very hard, because so many people think that just because the code gets too complex to understand, then it magically gets a will and agency. I don't know what's going on in education, but it's not for the better.

@Dev_UI Жыл бұрын

ChatGFakeT

@somesugar Жыл бұрын

First here 🎉 Edit : 3rd i missed

@Bchicken2 Жыл бұрын

John, why are ur thumbnails always weird af?

@RoomTwentyNine Жыл бұрын

Maybe its AI generated 😅

@ReligionAndMaterialismDebunked Жыл бұрын

Early :3

@fransmanlaparis4830 Жыл бұрын

Seems made by someone who doesn't really know what they are doing xD

@valiopetkov9210 Жыл бұрын

First :D

@jakehumter 10 ай бұрын

99,995th View!

@someuser17 Жыл бұрын

Content is good but your voice becomes unbearable very quickly.

@csongorszecska Жыл бұрын

That Free_minecraft*.7z file on the desktop XD

@LiEnby 9 ай бұрын

Its either malware or literally just a cracked version of minecraft lol

@TrexityTrex Жыл бұрын

that's fkn hilarious shit

@adamphilpott1732 11 ай бұрын

First time seeing your videos @_JohnHammond , I have found your content so interesting, as a business owner using WordPress like 43% of the web. Would love to hear of some of the scary stories of web hacks and backdoors that have previously been discovered. So many people like in the fantasy world of nothing apart from shopify is secure.