I'm sure you already know this, but 128 bytes is the length of a digital signature for a 1024 bit modulus. Converting those 128 bytes (+1 for padding) using base64 encoding gives you 172 characters. Also 0x010001 is a commonly used exponent for RSA parameter sets.

Don't mind me, just sharing the absolute love for these malware analysis videos.

Hacker mission: find as many ways as possible to sneakily hide IEX

That was very interesting. I really enjoyed watching you take this whole thing apart. It never ceases to amaze just how far malware creators go to conceal and drop their payloads into people's machines.

These videos are incredible. Loved seeing another one being premiered today! Keep up the good work Hohn Jammond

Man I am obsessed with these videos

If you want to replace single letter variables, you can use the word-boundaries from regex: \< (start of a word) and \> (end of a word). So you should be able to replace $d\> with $data

Between these unpeeling videos, and your deep dive into the dark web, this is more fun than watching Mr. Robot.

getting iex outta comspec was the aha moment for me :D thanks john for feeding us regularly with nerd bites

Thank you a lot John Hammond. I always learn something new in your videos and I really appreciate your content! Hope to see more of this powershell obfuscation!

I've been absolutely devouring your videos over the past weeks. Keep them coming!

I'm so excited for this. After watching your first Malware analysis I was HOOKED! I've watched all 4-5 videos multiple times. It's gotten to the point where I can recite your words exactly. It's so exciting watching you go through the code, peeling back layers, and going off on a tangent trying to look something up. Seriously John, I'm addicted at this point. I kinda wish I would've stumbled upon your channels 5 years from now, because then there would've been a catalogue to fill my desires. Oh well, at least I can add this video to my repeat cycles, and watch it 10 times over, just like the other ones.

Hi John I really enjoy your videos. You are awesome! Am really hoping you are using somekind of the proxy when checking if the malicious domain is still up. You can hide your IP in the video, but you cannot hide it from the server owner logs...

Damn this is a good video. I like to see more malware analysis tutorials (walkthroughs)

This program is really clever and super interesting, this series is great!

Watching your videos is making me want to learn Python, not to mention get more experienced in Linux.

Hello John! I actually learned something new for myself, so thank you :) This video has helped me a lot!

came across this video while researching Lemon Duck, a Great breakdown and walkthrough. Can you recommend any solutions on how to remove the malware from an infected machine?

So interesting !! Would be interesting if you talk about who could do such malware. Do you think a single person could have developed it? Or is it more likely a team? How long would it take for a single person to develop such complex malware?

Hi, John! I heard they ported PowerShell to MacOS and GNU/Linux too. I can't say why exactly they think it'd be important to have it somewhere else than on MS Windows, still they did it. Probably to allow OS-independent malware, lol. Thanks for the videos, liked them a lot.

This is a fantastic video. Well done, sir.

I have been waiting for more malware analysis in my life..

These videos are awesome, keep up the great work!!!

This is the video I never knew I was waiting patiently for...until now

Man.. idk how got to view this channel, but now it's on my Top-Tier list channels to watch, quite addicting :D

Talos always have great and comprehensive reports.

this is your best video imo, so funny, and informative.

test1 could come from an earlier IEX? I'm learning a lot from your unpeelings, keep up the good work!

In reference to replacing the back ticks... Can't you just replace them with an empty box? That would remove them.

wouldn't surprise me if the attacker is keeping an eye on connections to the URL, after so many hits or if certain probing command come in it probably turns off to hide itself

Awesome video. A quick question. Where do I get a copy so as I would like to go though the process myself.

I love all the malware analysis video so much ! thanks !

Love watching these on my way into work ☺️

5:30 If you're going to do that rather than just deleting all backticks, maybe use `([^abnt"']) instead of `(.)

Love how you break these down

I’m new to Cub Sec and I’m doing it as a hobby. How do you get your hands on the payload without it executing so you can break it down?

just a advice. Start the malware at the end of the video to see what's going on :)

I think maybe you need to try curl the a.jsp and report.jsp with user agent lemon duck

What if you were to curl the jsp file with the lemon-duck header?

I watched every second of this and have literally no idea what is happening. good stuff!

I dont have a pc and pretty much no backround in IT stuff but i really enjoy watching this

John "I could just replace this with nothing, but I'd rather do some fancy RegEx expression" Hammond. Rolls off the tongue!

Loved the breakdown, thx for the tasty recepty John!

Isn't it possible the jsp page need a parameter value set to do anything?

Great deobfuscation walkthrough! IEX still the way to go so it seems

Please configure your sublime that it automatically wrap the text. It would be easier for the viewers

You shouldn't be getting a cached page if you already are including random data in the query. Maybe the date serves another purpose.

I'd say the idea of a crypto worm is nothing new to the whole idea. The thought of even attaching backdoors not mainly to alter information but to sap the hardware capabilities of a targeted system. Computer evolved over the conception of increased amounts of stress testing, that being said insights that the machine can handle more task automated by services and regulated thru the registers. The service of a crypto miner is to solve calculations of equations that maintain the blockchain's structure. Which it's self a symbolic link to a hash dump of data (bytes, ints, func, etc); The direction of a numeral scale of which character is switch with another cryptic character to a chain of undifferentiated value. Which holds meaning of the reason a coin hold limited capacity due to the different, individual, and separate values, in example if a blockchain was a configuration of hybals 0000 - 1111 it would only hold 16 coins. Then we divide the value by 2 which in turn increase capacity of 32 different values but only 1 coin will equal the concurrent value of 2 different values. The worm purpose is to grow. Hermaphrodism, self-replicating which in turns is in meaning of a manifestation of a virus, yet the worm needs data to consume so the data is the blockchain itself but to a signature of grasp, drop, split and divide like a middleman within the transaction of transferred bitstreams that identify the blockchain.

Sadly everyone is so much smarer at computers, BUT! I feel at home in analysis, because John Hammond is my go to with my morning coffee.🌻

20:20 I guess john never heard of "soft wrap" or "word wrap"😂‎

Great Video! I love it!!! keep it up.

Games incorporate lemon into code to then get hash rate from all users discretely

I actually had this on my computer good to know what it was doing.

Love your videos sir.

The whole reason this script looks at the graphics card (and hash rates) are because if those exist, it wants to use them. You can generate more hashes (earn more money) with a graphics card vs a cpu. Not sure if you pick up on this later, only 41min in lol.

always a blast !!

If only these bad actors commented their code :)

I understand like 5%, but I love it!

I'm a simple man I see a John Hammond video I click like

Omg so cool! I want that sneak skill. It's like make IEX out of someone's computer

great video! more... MORE.

16:59 I did that mistake luckily for me it was only targeting phones

I love these

Epic Games Launcher looked like a valid at Port 43669, maybe they wann do stuff with it

02:55 - 04:40 >> en.wikipedia.org/wiki/Tetris >> I can bet, this game been the 1st code you cracked by seeing how you moving those bricks. Impressed

What’s the new setup looking like?

I want this Malware sample all the domains got taken down :( damn

you know it's super cheezy to have that cmatrix background for your website when it contains no useful data

Bro please share that code so we can also do along with you

55:48 THE RETURN OF MEMECATZ ༼ つ ◕_◕ ༽つ

Always Enjoy Your Vids

This things got more layers than an onion😂

i swear i have some kind of coin miner malware on my PC.. even after formatting a bunch of times and running all kinds of scans, theres something, I dont know where but its there, and It's so well hidden.. maybe im just being paranoid? nah.. I'm only getting 140 FPS in League of legends, useto get 240, it just doesnt make sense.. sneaky fuckers man

Can u give me a guide step by step about reverse engineering. like i want to enter in malware analysis and cracking software so where i should start beginning to advance

it would be good if you share the sample with us.. For study.

John, my friend. 7:30am, I'm still dreaming that I am Chris Hemsworth. So early lol.

1st rule of business - add ; into everything to thwart easy line detection :D

when John Hammond will quit reverse engineer malwares and will do reverse engineering of dinosaurs DNA?

I don't know about yall but when someone brings Ooknib 6mook to the hootenanny in my town, everybody's goin hogwild

Whonder where you get this "bad stuff". I want to practice too :(

I dont really see the point of the obfuscation lol there's always some simple way to deobfuscate since they will have to eval or iex... you just end up pinpointing where that is and voila.

how much preparation you make on video before recording I mean what you do with the sample you downloaded before recording

what's the point of the malware code being hidden? why does it matter if the code is going to execute anyways?

when i saw to thumbnail i thought it said "demon luck" lol

instead of "$d" which probably wouldn't work, you could probably try "^*$d=*"

judging by the amount of spam in this comment section I'd hazard a guess and say that you're been hit by, you've been struck by, an automated system that goes only off title keywords

11:14 he checked date on hand watches even though he he has it in the top right corner on screen

Docker files and java file refreshing

Stupid question but why doesn't the (.) create a copy of the character in front of the '? Like ob'ject to objject?

nice vid!

>deadbeef "i've beaten a dead horse"

super awesome

dream to seee in live🛑to john sir😔

Please don't play with prehistoric DNA :D

Duck is my SQL server files Bank

Apologies for the delays. Was talking to the crows just now. Go talk with them+

39:19 43669 is an azure thing to collect data i tihnk

How is this vírus spread? ANd gratulation for this video!

I'm gonna take a 4 hour nap I guess

Limin duck bust what install docker. Talos ? Ceco ? Assembly code file's