Free Coding Tool Distributes Malware

  Рет қаралды 125,649

John Hammond

John Hammond

2 ай бұрын

jh.live/n8n || Build automated workflows between applications, and integrate JavaScript or Python code whenever you need to -- with n8n! jh.live/n8n
Free Cybersecurity Education and Ethical Hacking with John Hammond
📧JOIN MY NEWSLETTER ➡ jh.live/email
🙏SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎FOLLOW ME EVERYWHERE ➡ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/discord ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware
🔥KZfaq ALGORITHM ➡ Like, Comment, & Subscribe!

Пікірлер: 156
@_JohnHammond
@_JohnHammond 2 ай бұрын
To be clear, the website freecodingtools[.]org no longer includes this malicious payload in their obfuscator. They reached out to me over email and explained this was due to a previous breach of their servers, but this has since been fixed. Free Coding Tools made it clear they never intended to distribute malware, and I had no intention to suggest that they did. ✌
@ZSquirrel678
@ZSquirrel678 2 ай бұрын
Firefox flagging as malware, would be interesting if you find anything on it
@UltimatePerfection
@UltimatePerfection Ай бұрын
That's good to hear it wasn't done on purpose. Too bad their security sucks enough for them to get hacked like that.
@advertslaxxor
@advertslaxxor Ай бұрын
@@UltimatePerfection And that their practices suck enough that they don't mention it on their website!!
@jamalabdisalam8578
@jamalabdisalam8578 Ай бұрын
bit late of them, once something like this happens they should be done as a service.
@cozajeden
@cozajeden Ай бұрын
@@UltimatePerfection I hope that they learned their lesson and improved security.
@amateurprogrammer25
@amateurprogrammer25 2 ай бұрын
very polite i think of the people who wrote this malware to leave the comments in their code when they shipped it, to help future security researchers
@scragar
@scragar Ай бұрын
I don't think they wrote the malware, not really. The script looks like the output generated by a few tools to write installer wrappers for you. The only thing unique to their application over any other admin application to run at startup(for legit reasons like providing a VPN or checking a hardware device/driver) is the naming, and often that's pregenerated from a prefix by tools to ensure that it doesn't conflict with other logic sharing the script.
@furttech
@furttech Ай бұрын
i always comment my malware... dont want others to think i am a troglodyte.. :) // this prints a message console.log("a message");
@cj.wijtmans
@cj.wijtmans Ай бұрын
its a bunch of libraries and tools they used to make the malware not the malware itself.
@Sparks621
@Sparks621 2 ай бұрын
There are so many flaws with the obfuscator website's logic. If I'm trying to PROTECT my intellectual property, the LAST thing I'm gonna do is take it and paste it into some random stranger's website. And then running the "obfuscated" code on any of my machines is even more mind-boggling. It's almost as bad as the low-budget nigerian ransomware meme where they just leave a text file on your desktop asking you nicely to encrypt all your files and give them the key. You'd have to be truly unhinged to fall for this.
@serkhetreo2489
@serkhetreo2489 2 ай бұрын
Abeg why u add Nigerian there😢😂
@Tonksec
@Tonksec 2 ай бұрын
@sparks621 Nigerians are 10 percent in NSA.
@0LoneTech
@0LoneTech Ай бұрын
Are we just ignoring that the primary function of obfuscated code is to disguise malware?
@inverlock
@inverlock Ай бұрын
@@serkhetreo2489 scammers lie about who they are in their emails they send to elderly folks to try and trick them. Pretending to be a Nigerian Prince is the most famous example.
@DallasGraves
@DallasGraves Ай бұрын
EXACTLY!
@realMattGavin
@realMattGavin Ай бұрын
I stop watching John for a few month maybe longer.... He had 250k subs... When did he hit 1 milion? 😮 Congrats john!
@scbtripwire
@scbtripwire Ай бұрын
You can tell a base64 encoded string is not what it claims when the string generated is WAY too long compared to the original code.
@rembautimes8808
@rembautimes8808 2 ай бұрын
Good that n8n sponsors content creator. Will keep a look out for it
@DeNikow
@DeNikow Ай бұрын
Last time I had to deobfuscate an obfuscated python script I just turned the exec function into a print. Seems a bit easier.
@Hellscaped
@Hellscaped Ай бұрын
doesnt work when its multilayered, that only works when its a monolayer obfuscator
@jordanmatthew6315
@jordanmatthew6315 2 ай бұрын
Man programmed viruses are so amazing, just the sheer mental process in order to make it happen - its like being a detective at a crime scene piecing everything together the deeper we go . . . . i love it.
@dipereira0123
@dipereira0123 Ай бұрын
I cant express in words how fascinating your content is =) keep it up!
@samwood3691
@samwood3691 Ай бұрын
This is awesome (and scary AF). Great to see a peek into some malware. Subscribed
@lalanotlistening
@lalanotlistening 2 ай бұрын
Hi John! I love your vids! I learn tons from them and always find them interesting. 🙂 I have some audio-related feedback I hope is welcome: I think there is an overly aggressive compressor somewhere in the vocal processing chain. I think relaxing the settings on this to preserve more natural dynamic range will reduce listening fatigue in your audience and may result in longer watch times. Thanks for another banger vid!
@loptatyson8095
@loptatyson8095 2 ай бұрын
Yep. With my Sony headphones it's easier to hear, I can lower the volume but I still hear the voice on steroids somehow. But I guess most listeners don't hear / don't care .....
@nordgaren2358
@nordgaren2358 2 ай бұрын
The volume is normalized to KZfaqs standard. Stop listening to things on full volume.
@lalanotlistening
@lalanotlistening 2 ай бұрын
@@nordgaren2358 I’m not talking about normalization, which is just a flat volume adjustment across the board, I’m talking about compression, which modifies loudness by different amounts over time to bring the loudness of quiet sounds and the loudness of loud sounds closer together.
@danielsanichiban
@danielsanichiban 2 ай бұрын
Definitely too dense
@nordgaren2358
@nordgaren2358 2 ай бұрын
@@lalanotlistening voiceovers are compressed. That's how it is. They need to be. It's for clarity.
@infohazard
@infohazard 2 ай бұрын
i wish you would digg deeper in it. love the long videos
@MAX-nv6yj
@MAX-nv6yj 2 ай бұрын
This will be interesting to watch. Thanks John
@elytra8
@elytra8 2 ай бұрын
You deserve more viewers!
@electrified0
@electrified0 16 күн бұрын
It should come as no surprise that executing unverified code is extremely dangerous. Anyone doing obfuscation should be using one of the many open source options you can run locally on your machine with full confidence that it's not stealing your code or injecting anything naughty.
@MyCodingDiarie
@MyCodingDiarie 2 ай бұрын
Your channel is like a hidden gem on KZfaq. So glad I found it!
@Grommish
@Grommish 2 ай бұрын
HID = Human Interface Device? Could it also be a keystroke logger?
@raspy_on_osu
@raspy_on_osu Ай бұрын
could also be Hardware ID, but i think that's usually HWID instead
@cj.wijtmans
@cj.wijtmans Ай бұрын
keylogger and perhaps a usb file downloader or usb identity/crypto device stealer,
@kleinesfilmroellchen
@kleinesfilmroellchen Ай бұрын
The weird HTML looks like part of the Brotli compression scheme's static tables. Since Brotli is optimized for Web content it contains things like JS and HTML keywords in its tables. I'm guessing that this is part of the bundled Tor client's Brotli implementation, since the standard Tor client is based on Firefox and Firefox has native Brotli support as an HTTP transfer encoding
@JeffTiberend
@JeffTiberend Ай бұрын
You have me hooked. This so fascinating and scary.
@fascinatingtome
@fascinatingtome 2 ай бұрын
Once you've noticed the lack of a pop filter you can't go back
@nordgaren2358
@nordgaren2358 2 ай бұрын
Yet nobody can point out timestamps that need editing
@skylarkblue1
@skylarkblue1 2 ай бұрын
@@nordgaren2358 As I read this, another pop that was super annoying happened, 14:26 it's constant through the video.
@iusegentoobtw
@iusegentoobtw Ай бұрын
it has a windscreen on it already. An additional pop-filter is silly in this context. Also, the audio sounds great.
@skylarkblue1
@skylarkblue1 Ай бұрын
@@nordgaren2358 Well I did try, seems like the comment got deleted. Hm.
@xorinzor
@xorinzor Ай бұрын
That HTML page looks like one of the pages you sometimes find in google results from completely random domains that just try to match on some keywords and get you to click on them. It probably then tries to redirect to some scam site, or download a file. My guess is it's not intended to be deployed on regular desktops, but perhaps will be used when it detects a webserver process running.
@AaronFord-bn7dm
@AaronFord-bn7dm 2 ай бұрын
Then I’m your number two fan!!
@furttech
@furttech Ай бұрын
i wonder on the C# hid device library... could that be used for parsing keystrokes>?.. detecting 2factor like ubikey.. detecting hard wallet?
@Z3rgatul
@Z3rgatul Ай бұрын
It can be used to get keyboard/mouse inputs (however there are a lot of ways to do this) It can be used to detect any USB devices
@furttech
@furttech Ай бұрын
I have seen this a few times before on "free tools".... An attacker will embed a script into a compromised server, package or tool. This was a creative method for propagation. I wonder how long this was active...?
@aldak8635
@aldak8635 2 ай бұрын
The icons that you found, looked like ms sql icons. Maybe a light sql client?
@FeckOffTeaCup
@FeckOffTeaCup 2 ай бұрын
*Sees title* Me: "It's VSCode, isn't it?" *Watches* Me: "Damn it."
@ZM-dm3jg
@ZM-dm3jg 2 ай бұрын
Another Dev on my team hated VSCode. Now he's been fired for low productivity while I got a raise.
@owlmostdead9492
@owlmostdead9492 2 ай бұрын
@@ZM-dm3jg And everybody clapped
@wafinashwan8242
@wafinashwan8242 2 ай бұрын
Neovim and emacs maybe the best editors
@Master120
@Master120 2 ай бұрын
​@@wafinashwan8242 Neovim is no joke, i used to use VSCode, i tried Neovim and it really makes you do things faster, also doesn't spy on you.
@AgentM124
@AgentM124 2 ай бұрын
Really enjoyed the last 2 minutes of the video. Sketch.
@cpallphotog
@cpallphotog 11 күн бұрын
The miner section, I wonder if this was a decoy or its main purpose. Was it setting machines up to be mining bots?
@TheGamer_Zero
@TheGamer_Zero Ай бұрын
What keyboard is that!?
@GRHmedia
@GRHmedia 2 ай бұрын
I suspect given the compilers and such they offer there.Someone may have used one of the online tools to infect them.
@chrisclark5135
@chrisclark5135 2 ай бұрын
Amazing, John! Thanks so much!
@tutacat
@tutacat Ай бұрын
I think these websites may have advertently or inadvertently used the same infected pypi module. Or X website also hosted their module on their own website. Or a site was exploited.
@NinoValbiskoni
@NinoValbiskoni 2 ай бұрын
keep it up 🎉
@YoutubeWatcher264
@YoutubeWatcher264 Ай бұрын
Bouncy castle is an old cryptography library
@makkam7575
@makkam7575 Ай бұрын
Just thinking about it I have 2 things in mind. 1. How dumb are you to create an obfuscator for an interpreted language like python where at the end of obfuscation you can have the original variable names. At least obfuscate those and do some random stuff 2. The scary part is the at 127 rounds of deobfuscation necessary to get to the "raw" code. Theoratically the actual malware execution steps could be split and executed during the steps of deobfuscation which can make it hell to debug and reverse engineer
@smedley76
@smedley76 Ай бұрын
Sounds like it does similar to that one package that got found in aur
@paulthomann5544
@paulthomann5544 Ай бұрын
"... obfuscation, this method makes it difficult for hackers to gain access to your sensitive source code." - free coding tools python obfuscator page shown at 13:57 . Obviously it does not. All it does is make it hard/impossible for much less technical people to read the code. Such as the users of that page :P I of course hate malware in the wild and anyone who spreads it. But to be honest, there's kind of a satisfying instant karma component to seeing "security by obscurity" used against the very people subscribing to that mind virus :D
@hharris712
@hharris712 Ай бұрын
About 35 minutes how did you write multiple lines at the same time, think it was 25 and what was the editor
@jamalabdisalam8578
@jamalabdisalam8578 Ай бұрын
using a obfuscator site is something else, if you want to hide your intellectual property there are better ways, e.g. create a web app.
@Nightritual1332
@Nightritual1332 Ай бұрын
Longer the video the better. I enjoy watching your videos
@borgo_yz
@borgo_yz 18 күн бұрын
Just to let you know, i got a malware from this some time ago... Edit: I removed the malware by deobfuscating that .pyw file and came to the conclusion that my antivirus blocked it because for example in the task scheduler or windows defender exclusions the specified paths didn 't exist, i still removed everything tho
@sakuchi4914
@sakuchi4914 Ай бұрын
This is such a cool vector of attack, that exclusively pointing towards cyber researchers. Should really be more mindful when doing this :V
@bestnewb
@bestnewb 2 ай бұрын
the legion of the bouncy castle...
@februalist4686
@februalist4686 15 күн бұрын
i love long videos John
@MrRecorder1
@MrRecorder1 Ай бұрын
Ah yes... good obfuscators blow up my 20 byte script to a 40 MB file when starting with a string like `print("Hello World")`. Nothing strange about. Let's just copy-paste that whole thing!
@jvsonyt
@jvsonyt 2 ай бұрын
Who owns the website?
@Hybrid_Netowrks
@Hybrid_Netowrks Ай бұрын
John the KING
@kishirisu1268
@kishirisu1268 Ай бұрын
Looks like php viruses in wordpress 10 years ago.
@mehraproductionkathua9343
@mehraproductionkathua9343 Ай бұрын
Sorry for that what are u say I m understand so may I request KZfaq pls translate to hindi language becoze I m not understand . This is option is very important us Like mx player etc enother apps Regard mehra production
@vojtechhron1528
@vojtechhron1528 2 ай бұрын
wow thats cool
@Im_Blue
@Im_Blue Ай бұрын
Casio ❤
@bakedbeings
@bakedbeings Ай бұрын
I don't know why we're shouting!
@user-ow1vi4op4u
@user-ow1vi4op4u 12 күн бұрын
"Thangs MR JOHN HAMMOND"??
@BsktImp
@BsktImp Ай бұрын
Just makes my point that unless you're someone who can use a disassembler, understand source code and even decode hardware I/O voltages you cannot trust anything. Anyone got a cave going spare? 🤣
@K5RTO
@K5RTO 2 ай бұрын
great vid
@perroes
@perroes Ай бұрын
anyone knows if anaconda could have pulled a malicious package by default?
@cvall1710
@cvall1710 Ай бұрын
John: We could open Ghidra on this code chat... SQUIRELL! Lets look at this over here in ILSPY... SQUIRELL! WHOA guys look at this sketchy code running over here...SQUIRELL! Pick a lane John XD Love, Love, Love your videos. Dont change.
@PlayXVIP
@PlayXVIP Ай бұрын
Bro is a top tier genius how in the hell. I feel sorry for any future ex girlfriends 😂
@user-ow1vi4op4u
@user-ow1vi4op4u 12 күн бұрын
"WOW"
@motbus3
@motbus3 Ай бұрын
Maybe their code detects if specific libraries or snippets of code exists and only activate on those situations
@Sypaka
@Sypaka Ай бұрын
This may be a wild guess of me. They drop a TOR exit node, which can only be used by certain users. The discord webhook thing should tell them, when a node is up AND also sends keypresses using the HID lib. So they mine XMR on the victim and also use their bandwidth exclusively for shady stuff.
@imbadatcod7208
@imbadatcod7208 2 ай бұрын
why do you only use one finger to type with your right hand?
@jonohiggs
@jonohiggs 2 ай бұрын
@38:20 System.Reflection.Emit.ILGeneration - Very interesting to see there, I don't think it is a standard include for dotnet and would allow JIT compile of any code within the malware that is further obfucated or was being sent back via TOR
@Z3rgatul
@Z3rgatul Ай бұрын
It can be used for legit purposes, like generating serializers on the fly as classes in dynamic assemblies.
@InuYasha-SitBoy
@InuYasha-SitBoy 2 ай бұрын
the author put in so much work but ruined it by using desktop runtime
@U20E0
@U20E0 2 ай бұрын
the HTM file looks like a weird n-gram cipher with a corpus of HTML and Chinese ( maybe??? ) I don't know what's happening with all of the missing spaces and the random dump of Unicode though.
@parshva3516
@parshva3516 Ай бұрын
10:58 what's this terminal? Anyone?
@nordgaren2358
@nordgaren2358 Ай бұрын
Terminator
@EnLopXf
@EnLopXf 2 ай бұрын
LOLBAS next upload Jhon
@TheGamer_Zero
@TheGamer_Zero Ай бұрын
Did you think about running the script in a virtual environment. Maybe the website will allow access to the script.
@julianweber1113
@julianweber1113 Ай бұрын
I wanna guess what the malware shall do: 1. After setting everything up, it connects to the Wallet via Tor due the specific notes 2. Cryptomining 3. Reporting status to a hidden dc server (maybe also due the noted Tor notes)
@GoatZilla
@GoatZilla Ай бұрын
Lord this isn't 42min worth of material
@9remi
@9remi 2 ай бұрын
w video man
@richbaird9407
@richbaird9407 Ай бұрын
wayback suggests the change to remove the malware happened on Feb 18
@donnabuckalew-wagner6431
@donnabuckalew-wagner6431 2 ай бұрын
❤❤❤❤❤❤❤❤❤
@tutacat
@tutacat Ай бұрын
The amount of scammers using discord as a free less-traceable server is unnerving
@MdHannan-qg8pq
@MdHannan-qg8pq Ай бұрын
❤❤❤❤
@BuyMore88
@BuyMore88 Ай бұрын
When John disapears for 4 days you already know he's balls deep in terminals and sublime text editors contracted to figure out what no-one else can in the latest and biggest breaches yet! (CHANGE HEALTH THATS YOU, SORRY! I'm ready for the video John! You are friggin genius tbh man; You can learn a shitton watching your videos and I appreciate them btw & fyi! 👌✌👍🤜🤛
@fadiallo1
@fadiallo1 2 ай бұрын
Yes yes yes implode yes
@wafinashwan8242
@wafinashwan8242 2 ай бұрын
2 hours ago
@drew5367
@drew5367 2 ай бұрын
Dag
@centdemeern1
@centdemeern1 2 ай бұрын
Why is there a whole lot of nothingness at the end of the video
@DM-qm5sc
@DM-qm5sc 2 ай бұрын
Look at the keyboard and type with only one finger? I was told that you cant be successful unless you dont look at the keyboard and type over 75 wpm
@outtakontroll3334
@outtakontroll3334 Ай бұрын
you were lied to
@SkyRiderJavelin
@SkyRiderJavelin Ай бұрын
Take too long to get the point
@YTChannel344
@YTChannel344 Ай бұрын
It's called Ob-fuss-cator not Ob-fuse-cator.
@pmcgee003
@pmcgee003 Ай бұрын
Noooo
@carsonjamesiv2512
@carsonjamesiv2512 2 ай бұрын
3rd!😃
@nchapkanski
@nchapkanski Ай бұрын
You destroy the Channel,where is the CTF Videos,i start watching you Long Time ago ,only for CTF ,and now ,i have Not watching anymore ,do more CTF Videos
@_JohnHammond
@_JohnHammond Ай бұрын
Would you like just anything from CTF time, or like TryHackMe/HackTheBox/practice wargame sites?
@nchapkanski
@nchapkanski Ай бұрын
@@_JohnHammond hackthebox
@NyscanRohid
@NyscanRohid Ай бұрын
"obfyewwscate", you say?
@MagicPlants
@MagicPlants 2 ай бұрын
why are you yelling?
@UltimatePerfection
@UltimatePerfection Ай бұрын
One more reason people should stop using Python for anything important.
@jamalabdisalam8578
@jamalabdisalam8578 Ай бұрын
more importantly a good reason to stop using code you let a foreign agent encode without having an idea what it's turned into.
@0LoneTech
@0LoneTech Ай бұрын
Python is not the issue. It's designed to promote legible code, the exact opposite of obfuscation, which on the other hand is highly suspect. Trusting someone else with manipulating your programs like this is also absurd from any security perspective, which are the only ones where the operation could be motivated to begin with.
@UltimatePerfection
@UltimatePerfection Ай бұрын
@@0LoneTech Exactly. And this is why it's a favorite language of the spineless beancounting PHBs dreaming of replacing his staff with graduates that will do the same work for less. A good programming languages promotes job security over code legibility, because as soon as someone else understands your code, you can be easily replaced. That's why Perl should be used instead - not only it is way faster than Python will ever be, but it also provides a natural facilities to ensure that the company you work for cannot fire you or their software will not be able to be maintained anymore and would need to be rewritten from scratch (a huge cost compared to keeping you employed).
@MrMeow-dk2tx
@MrMeow-dk2tx Ай бұрын
I read your latest reply. Uhhh, sir: what if I'm sending my goddamn code to be open source??? Like, is not just bean counters that need it to be legible!!! What if you're part of a team, or, again, want your code to be open source? You are making a bad argument for your perfferd language, you are pretty much admitting that, because you don't want to be fired, you'd kill other developers time.. . Just to try and screw over big guys? Seriously, dude.... If you wanna really fight the big folks, don't make your code unreadable just to work for big tech, make good, open source alternatives that are BETTER than what they have (don't forget to use the GPL, so incase they wanna use your code they need to open source their project.) In short: don't mess with other folks in your position, just to mess with the big guys. Do something that allows you to work with them so you can do a more direct attack
@UltimatePerfection
@UltimatePerfection Ай бұрын
@@MrMeow-dk2tx Then you can make it legible yourself by following good practices. But under no circumstances you should be FORCED to do it.
@nickadams2361
@nickadams2361 Ай бұрын
You would get more views if you include more viewership, this channel is basically a honey pot for idiots to commit crimes and get caught. You'd get more views if you included how to not get scammed
@marysbigpimp
@marysbigpimp Ай бұрын
Its called ms code right?
@MadManMarkAu
@MadManMarkAu Ай бұрын
You stopped going through the DLLs right before the last one in the list, the c2hash_00061952.dll.cs. That file is not a DLL, but is actually a .exe that was renamed to a .dll. That was probably the "main" application that gets run here.
@realdestr0yer
@realdestr0yer Ай бұрын
Next time, keep going. 6 hours straight or bust. We all watch Joe Rogan and Dr. Jordan Peterson because they do 3+ hr videos. Step it up!
FAKE Antivirus? Malware Analysis of Decoy 'kaspersky.exe'
1:28:19
John Hammond
Рет қаралды 271 М.
Tracking Cybercriminals on Telegram
23:26
John Hammond
Рет қаралды 205 М.
[실시간] 전철에서 찍힌 기생생물 감염 장면 | 기생수: 더 그레이
00:15
Netflix Korea 넷플릭스 코리아
Рет қаралды 38 МЛН
Do you like a chocolate surprise egg?🥚🍫🥰 #demariki
00:32
Demariki
Рет қаралды 3,6 МЛН
ФОКУС С ЧИПСАМИ (секрет)
00:44
Masomka
Рет қаралды 3,7 МЛН
Notepad.exe Will Snitch On You (full coding project)
53:30
John Hammond
Рет қаралды 180 М.
The Apex Legends Hacker: Destroyer2009
21:47
John Hammond
Рет қаралды 111 М.
Python The Hacker's Secret Weapon | Importance Of Python in Hacking
11:06
Finding WEIRD Typosquatting Websites
24:26
John Hammond
Рет қаралды 227 М.
Вселенная и Специальная теория относительности.
3:51:36
ЗЛОЙ АНАЛИТИК ВСЕЛЕННОЙ.
Рет қаралды 6 МЛН
Password Hacking in Kali Linux
24:22
John Hammond
Рет қаралды 726 М.
Is Strictly Apple a SCAM?
27:22
Austin Evans
Рет қаралды 367 М.
Finding WEIRD Devices on the Public Internet
27:48
John Hammond
Рет қаралды 131 М.
Can a PDF File be Malware?
22:26
John Hammond
Рет қаралды 77 М.
I Built a PC that Makes Coffee
23:16
Nerdforge
Рет қаралды 874 М.
[실시간] 전철에서 찍힌 기생생물 감염 장면 | 기생수: 더 그레이
00:15
Netflix Korea 넷플릭스 코리아
Рет қаралды 38 МЛН