JScript Deobfuscation - More WSHRAT (Malware Analysis)
Рет қаралды 56,401
2 жыл бұрынIf you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond
@amstevenson 2 жыл бұрын
Hacker: Turns code into obfuscated alphabet soup 42:40 Also hacker: Adds helpful code comment to let you know this line is for Firefox
@awli8861 2 жыл бұрын
hecker XD
@mycotina6438 2 жыл бұрын
I love it so much how you speak out loud what you're thinking as you work through the code. I think this kind of video is a lot more useful than tutorials, because we get to see the thought process and from where the ideas come from trough the trials and error.
@Irisilol 2 жыл бұрын
When John goes "OH NOOOOOOO" you know the code is evil.
@jesseramsell1895 2 жыл бұрын
"What is that, Jurassic Park? I should know, I'm John Hammond." i died 😂
@rrittenhouse 2 жыл бұрын
I never even realized the similarity on the name LOL. I've even made replica John Hammond Cane's for people... I should have caught that 🤣
@litmussales9750 Жыл бұрын
I'm happy seeing you having fun with my codes. I love that part where you said OMG!!!
@ChymekJR 2 жыл бұрын
Your work inspires me! This is so cool
@KeithGriffiths 2 жыл бұрын
Great video John. Good walk through.
@slybandit8117 2 ай бұрын
That was some slick coding to get those vars into the correct places! Well done sir, stuff like that is why I love this channel!
@BlackDragonCZ_alt 2 жыл бұрын
23:52 john think: "John stop using python" Me: "John keep using python, thanks" :D
@hunterbodell1129 2 жыл бұрын
I hate that these are so good that I wake up at 6 for them
@murkdurk8961 2 жыл бұрын
You might need to rethink your priorities🤭
@alexlefevre8226 2 жыл бұрын
I don't wake up early to watch, but I do wake up to schedule the download, automagically chop the resolution down a bit, and finally upload to a part of my cloud storage where I store every one of these for the future. Kinda silly... But I am using these videos as a set of walkthroughs and have learned an "asston" so far. John does such a good job with these! His ah-ha moments have become the center of mass of which I orbit around. Keep it up John... Please!!! Although I know you were busy with the huge ransomware attack recently. Your name was in probably a dozen of the 15 I read. As if I didn't already respect the crap out of you
@Cavemannnnnn 2 жыл бұрын
@@murkdurk8961 Nah, completely agree with him
@murkdurk8961 2 жыл бұрын
@@Cavemannnnnn not saying this isn't important, but if you set your alarm to wake up for this in the morning, you might need to get a job
@Cavemannnnnn 2 жыл бұрын
@@murkdurk8961 I wake up before 6:00 most days regardless of a video or not, and what does having a job got to do with watching anything xD
@benjaminthelen1413 2 жыл бұрын
Does anyone besides me else just watch him even though you have no idea what hes doing?
@1FelixxileF1 2 жыл бұрын
Same
@justinboss4131 2 жыл бұрын
@@1FelixxileF1 same here buddy
@joancasals4365 2 жыл бұрын
same here
@StreuB1 2 жыл бұрын
Yep, absolutely no idea what he's doing but its awesome to watch brilliant people work their jam.
@codydietrich4246 2 ай бұрын
Same here, but he makes me wanna learn!
@DahlFreeman 2 жыл бұрын
Great video!!! So much fun to watch
@sebastianinnez3395 2 жыл бұрын
surely John teaches us HOW to obfuscate, looks awesome!
@samuelmiller1691 2 жыл бұрын
God I love this. I started watching your videos thanks to the KZfaq Algorithm and had no idea what you are doing. Now I am starting to pick up on things here and there. More more more!
@bendavis8461 2 жыл бұрын
Oooo woow Malware Analysis, great stuff.
@erin1569 2 жыл бұрын
Are people really complaining about python? It's incredibly comfy. It's often as simple as saying: "Jarvis, convert this code into recognizable commands", but with a few extra words.
@vexraill 2 жыл бұрын
These are always so fun to watch, thanks for sharing your research with us!
@pbezunartea 2 жыл бұрын
Great video! Amazing job!
@jannikmeissner 2 жыл бұрын
At 39:38 I was like "yeees I did suspect 2031 would be the port the C2 server is running on" and it felt sooo good when this suspicion was met.
@rungoranga6341 2 жыл бұрын
Malware Analysis -videos are the best. 👍
@sjslife 2 жыл бұрын
I fookin love u J, loads of love from UK
@dustyboyle 2 жыл бұрын
Thanks for the video. Very cool
@happyked 2 жыл бұрын
Great content as always. Are you planning to make a video about Kaseya and REvil?
@fordorth 2 жыл бұрын
This was a great video... very fast!
@johtodev 2 жыл бұрын
love these videos
@LouisSerieusement 2 жыл бұрын
I think you were slightly peaking your audio interface sometimes But thank you so much, your videos are very informative !
@Roxas99Yami Күн бұрын
great video 10/10 this helped me a lot deobfuscate a .js script i ripped from a site
@snake1980eyes 2 жыл бұрын
that filename actualy is from romanian language and it translates to INVOICE in english
@phyotyla 2 жыл бұрын
Apparently the same in Swedish and Spanish among others
@cheshirecat6519 2 жыл бұрын
I don’t know **** about programming language and malware decoding and reverse engineering and stuff but It’s the 5th video I watch this week on your channel. Just saying.
@jkobain 2 жыл бұрын
No, the syntax highlight in Sublime Text was working fine, the problem was in escaping borderline quote symbols, for instance.
@kaihuang5420 2 жыл бұрын
no way. I am literally learning OSEP materials chapter where they go over Jscript and C#.. The big data has gotten me
@larziel7107 2 жыл бұрын
Thanks to you I'm trying to learn Python myself! :)
@nordgaren2358 2 жыл бұрын
Great reference to Jurassic Park!
@drasticwarrior5357 Жыл бұрын
@John Hammond, Do you ever go live?? and if so may i please ask what your preferred platform is
@BloodBornKnight Жыл бұрын
The king in cyber security huge fan.
@gdk111 2 жыл бұрын
Thank you John, really interesting 😊
@ibrahemtaha8177 2 жыл бұрын
Many thanks for sharing with us all your amazing videos, John!! Could you please share with us Roadmap videos in which you tell us how to become Expert in Malware analysis \ Exploit engineers, from zero to hero, from beginner to Super advance! BTW, are the roadmaps for Malware analysis VS Exploit engineers different!? maybe a video for that? :)
@mustafaismail5773 2 жыл бұрын
too inspiring, despite I'm in totally other field of work actually now I'm involved in my free time in coding with python & analysis of C applications since I started watching you almost one year ago. High respect brother keep it up always !!
@eklypzn 2 жыл бұрын
Hilarious. I'm wearing that shirt right now.
@_JohnHammond 2 жыл бұрын
IT'S SUCH A GOOD SHIRT
@zimboiii9025 2 жыл бұрын
@@_JohnHammond WHAT SHIRT IS IT
@Colaholiker 2 жыл бұрын
Seeing this, I am so glad that my computer would not be vulnerable to this. I doubt, I can apt install WSH. And even if I could, I would not. :-)
@AnthonyBlakley 2 жыл бұрын
This was quite the episode..
@TobiasTimpe 2 жыл бұрын
JScript is one of my favorite languages.
@guky667 2 жыл бұрын
THIS IS SO FRICKIN COOL, WTF!!!
@crystal_royal3405 2 жыл бұрын
Epic
@ikhmalfahmi9308 2 жыл бұрын
Reallyy missing your ctf videos :,((((((((
@logiciananimal 2 жыл бұрын
"Please commit Sudoku"? Not while I'm supposedly at work! This video is at least job related sort of otherwise.
@bosch5303 2 жыл бұрын
Fun fact. Factura in romanian means invoice
@userou-ig1ze 2 жыл бұрын
didn't catch how it deploys, do you have to run the file?
@SuiGio 2 жыл бұрын
Hey man, I have a obfuscated js code which creates a chrome extension for a game. I was wondering if you would like to share that with you, see if there's a malware in it? Would really like to see whats beneath it, since I've been using it many years now. Let me know how to reach out to you. Cheers, great content!
@_JohnHammond 2 жыл бұрын
Yes please, always happy to take a look through some weird code -- you can email me with the address in the description :)
@marlonius05 Жыл бұрын
interesting.. still learning... h1senzz3... Hisense? So Huawei/Honor???
@huongkieu8335 2 жыл бұрын
John can you give me the link of first file in this video?
@Dooglet Жыл бұрын
maybe I missed it but how does this usually detonate?
@thewhat4228 2 жыл бұрын
Please where can I get the code or download link to this
@theragequitgamer246 2 жыл бұрын
I'm afraid to scan the qr code on that shirt lol
@viv_2489 2 жыл бұрын
😂
@dddddddddavis 2 жыл бұрын
I always watch your reviews and always wonder: what is usually your next step after the analysis? do you follow up reporting the c2 server? if you eventually find out an unreported malware will you follow up with a report? just wondering because these actions can help users in the end of the day. - also, thanks for putting out always some good content
@stefank2387 2 жыл бұрын
Finally, great content
@jimo8486 2 жыл бұрын
What I use to look up an IP I use check-host and it will tell u all about the hosting
@camerontgore 2 жыл бұрын
I get a good chuckle everytime you say Show-toast 😂
@DD-hn2jr 2 жыл бұрын
First I saw somebody using pkill in real life
@gustinstamatinos9910 2 жыл бұрын
I could sit back with a beer and watch these all month. ...okay, a few beers.
@jkobain 2 жыл бұрын
I've never used NodeJS to casually run JS manually, rhino is a thing, IMO.
@whatthefunction9140 2 жыл бұрын
How would the js ever reach out of the browser?
@carterplasek498 2 жыл бұрын
He references this in a few other videos, this isn't Javascript, it is JScript, which is a confusing way of saying it is Microsoft's Javascript, a scripting language using the same (or very similar) syntax to javascript, but does windows stuff and can run on windows.
@thowbikdustan6515 2 жыл бұрын
Hey john, can you just upload the malware file anywhere and provide link. AHH maybe your github is fine !!
@cyrussecurity 2 жыл бұрын
Toast to "show-toast" :D
@PreetisKitchenltr 2 жыл бұрын
Yay!!! I am first like as well as comment! Great Content Sir!
@andrewloucks6568 2 жыл бұрын
Anyone ever wonder why the bears need so much toilet paper in the charmin advertisements that keep playing ??
@dowLoveTap 2 жыл бұрын
just found this channel, i'm sevral hours in.. oof
@0xhex 2 жыл бұрын
Could you please share code source ?
@nextlevelbruh827 2 жыл бұрын
though, vim is incredible 😉
@claudiafischering901 2 жыл бұрын
I found a wired server with a bunch of applications from a doc vba file. But I think this server should be offline now. I think I delete the file because the file which has been downloaded was not on the server. All I know is that target was windows - but it was sended up to a MAC User - that is a little bit stupid I guess. Thanks for video - I have a lot of fun.
@razaullahkhan8099 Жыл бұрын
NICE ANDROID RUNNING NOW THANKS
@crazylegs85 2 жыл бұрын
vim...vim...vim! VIM!!!
@magicball60 2 жыл бұрын
Share code :) hehe would love to take a look at the rdp module
@btno222 2 жыл бұрын
Is it good nsa
@jkobain 2 жыл бұрын
«Lua» stands for «moon», while the UAC actually mined Mars…
@corbezzz 2 жыл бұрын
KZfaq algorithm things
@MartinHaunschmid 2 жыл бұрын
Now I REALLY want to know what 'show-toast' is. EDIT: Now I do. Don't know what I expected.
@awndolznmowdlzkwndznwua 2 жыл бұрын
What was it, Martin?
@balazsolah1976 2 жыл бұрын
What was it, MARTIN?
@MartinHaunschmid 2 жыл бұрын
@@awndolznmowdlzkwndznwua I guess an endpoint for returning Messages to the C2
@fra1897 2 жыл бұрын
love the bash at vim fanboys
@cat-boy1357 2 жыл бұрын
38:08 - "OwO what is this?"
@real1cytv 2 жыл бұрын
Well, I'm not shouting at my monitor, but with the stuff you do, I think VScode(/VSCodium) would be the better fit...
@tsustyle6263 2 жыл бұрын
SHOW TOAST!
@grandmakisses9973 2 жыл бұрын
“Please send me malware” lol should been my graduation quote
@realMattGavin 2 жыл бұрын
I think John was the one who stole the $600mil of ETH and was trying to bring us valuable ententertaining content. Also the way that John acts reminds me of the somewhat "innocence" of the ETH hacker... like "uh, oh, what did I do?" Then returns it all back.
@CarRamrod-uf2ub 2 жыл бұрын
That 1 dislike must have been a mistake.
@baxsm 2 жыл бұрын
that was from the hacker :/
@bellshoe2894 2 жыл бұрын
I love watching Justin Roiland hack the NSA
@isosthenie8271 2 жыл бұрын
Python is a good language. Bite me. :D
@magnum_dingus 2 жыл бұрын
John, keep using python.
@Vlad.1610 2 жыл бұрын
What about the Dark Web videos?
@daryll4645 2 жыл бұрын
lol Commit Sudoku
@hackingismylife2167 2 жыл бұрын
Please I need your help
@LycanEnforcer 2 жыл бұрын
Yeah, regex with that many characters is fun isn't it? Usually better to just open up python and write a script to replace characters in a document.
@gorway6807 2 жыл бұрын
Why is he so scared to say “slaves” when it’s a pretty common computer term with a specific meaning? Cool content tho
@heraclitus7893 Жыл бұрын
KZfaq algorithm demonetisation I suppose
@techysecurity4107 2 жыл бұрын
Javascript = 😌😌
@pinkeye00 2 жыл бұрын
cntrl+z
@RyzekZ0008 2 жыл бұрын
1:02:10
@MarcinGrobelkiewicz 2 жыл бұрын
Can u help to how to do referendum ?how to do real voting ? How to stop fake plandemy
@Lemon_Inspector 2 жыл бұрын
How demoncracy is formed?
@JNET_Reloaded 2 жыл бұрын
mics way too close sounds like your shouting!
@Tedd755 2 жыл бұрын
More analysis/reverse engineering, less googling please. Do it off-camera, and if there's any insights, give a summary. I don't like watching someone else browse. I can do that myself.
@viv_2489 2 жыл бұрын
@@miyu1424 yeah agree, he is working through and displaying it to us at the same time... I think his concern is that more deep code analysis should be done for C# exe's or binaries in video but that would take immense lot of time...
@issecret1 2 жыл бұрын
No, thanks. Then if I don't know something he uses I get intimidated and have no idea how he found it
Осторожно: Собчак
Рет қаралды 10 МЛН
Low Level Learning
Рет қаралды 1,2 МЛН