PowerShell CRYPTOSTEALER through DNS

Рет қаралды 54,488

Жыл бұрын

j-h.io/snyk || Try Snyk to find vulnerabilities in your own code and applications FOR FREE ➡ j-h.io/snyk
🔥 KZfaq ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

Пікірлер: 74

@Aurem_YT Жыл бұрын

Powershell is so cool, you never have to worry about installation. Makes it easier

@rodricbr Жыл бұрын

yeah, I've never had much disposal to deep learn ps but it's really cool

@manisharrora9525 Жыл бұрын

Already stopped the same attack thanks for this. Also did the malware analysis of the .ps1 file.

@DS6Prophet Жыл бұрын

John, you are an amazing Fella who always makes AAA+ quality videos! Huge props to you!! 😊 I really have obtained lots of knowledge from your videos!

@justinpinson8575 Жыл бұрын

Love this content! Thank you for the analysis as always ❤️

@Lampe2020 Жыл бұрын

18:35 That looks like someone actually modified the malicious DNS record instead of just removing it XD

@autohmae 10 ай бұрын

yes, exactly

@bhagyalakshmi1053 Жыл бұрын

Sho talented person. translation master and brother.

@stopper0203 Жыл бұрын

Love these videos 😎!!

@DarkFaken Жыл бұрын

Thanks man!!

@allurbase 11 ай бұрын

That UUID at the top of the script in the registry is probably to change the signature of the script.

@hyklmcjger9232 Жыл бұрын

Great video! Almost went into the rabbit hole together with you :D

@averagejoe404 Жыл бұрын

yeah right

@muhammadtaha2578 Жыл бұрын

love your videos sir

@pdkama Жыл бұрын

thanks

@theblankuser Жыл бұрын

Powershell stuff is interesting af

@NederlandsPersoon Жыл бұрын

uuh, wtf. I found this on a pc two weeks ago, 3 PowerShell files with a name of 4 random characters with the exact same contents. I correctly identified it as a virus and did some research, after deleting it there still remained some other parts which I could not find (I am a noob on this), so wiped everything. Amazing to see a video on it

@NederlandsPersoon Жыл бұрын

I did think of sending it to you, just to see. But did not do it in the end, idk why

@luketurner314 Жыл бұрын

13:01 and I'm here for it

@raiddesu9687 Жыл бұрын

coolbase64 package for sublime would be useful for this kind of stuff since you do a lot of decoding ,you can just select and decode in sublime directly

@TechSY730 Жыл бұрын

For a moment there I thought scambot (EDIT: now banned and deleted) was doing a ^this style comment to reaffirm your suggestion. Which very well may be the first and only actually useful thing it did.

@bhagyalakshmi1053 Жыл бұрын

Great master

@khush1980 Жыл бұрын

Good stuff here.. thanks What editor is that please

@smtp4626 Жыл бұрын

sublime text bro

@Sestain Жыл бұрын

I had this too and not sure where I had gotten it.

@demotedc0der Жыл бұрын

aaawesome !!!

@muhammadtaha2578 Жыл бұрын

great

@mynamesaretakenwtf Жыл бұрын

How are they injecting and running the PowerShell? It feels like we’re missing the initial attack.

@Dakktyrel Жыл бұрын

Phishing or adware would be my initial thoughts.

@UnfiItered Жыл бұрын

Temp files/adware/malware. Unprotect your computer and visit as many fishy websites as you can. Then turn on your protection and watch it pick up a bunch of stuff in your temp folder.

@asbestinuS Жыл бұрын

How did you get to stage 2? Did I miss something? These ps1 scripts are just reading from registry and getting values. What values are they getting?

@UnfiItered Жыл бұрын

So after the first stage ran, it output a base64 code. He decode it and it shows a block of code. That code is the second stage.

@3WL2 Жыл бұрын

Stop fast forwarding through the video and you won't have to come to the comments to ask dumb questions.

@BryanLu0 Жыл бұрын

Obviously, this malware sample comes from a Windows system. He just pulled the registry values off the system

@asbestinuS Жыл бұрын

@@BryanLu0 I see, thank you kind sir.

@muhammadtaha2578 Жыл бұрын

nice

@mattchub9887 11 ай бұрын

Do you ever go live??

@bhagyalakshmi1053 Жыл бұрын

More videos also following master

@htconex19062012 Жыл бұрын

This is so crazy 😂

@jpsl5281 Жыл бұрын

Why they store payloads as byte arrays?

@Sestain Жыл бұрын

Most likely harder to detect since it needs to be put back together

@VulcanOnWheels Жыл бұрын

3:23 Shouldn't that have been, "to be able to be *run*?"

@bhagyalakshmi1053 Жыл бұрын

One 🕐 login all

@Meletion1 Жыл бұрын

Second view including him!!!

@imyoubutbetter9951 Жыл бұрын

bro i m overwhelmed what programming languages do i need for cybersecurity?

@taureon_ Жыл бұрын

what are you attacking?

@imyoubutbetter9951 Жыл бұрын

@djr thanks man appreciate it also what can i do with java?

@ytsine404 Жыл бұрын

😅

@brylozketrzyn Жыл бұрын

One more reason to analyze DNS traffic

@scrpiona 11 ай бұрын

how to? any software or tips?

@brylozketrzyn 11 ай бұрын

@@scrpiona Suricata + Elastic Security with Machine Learning module. Easiest, but needs ML license. Still few orders of magnitude more accessible, than some popular solutions

@animeworld4775 Жыл бұрын

What is crypto jacker

@blackpinkmedia Жыл бұрын

It's JM

@animeworld4775 Жыл бұрын

@@blackpinkmedia JM ?

@blackpinkmedia Жыл бұрын

@@animeworld4775 Joe Mama

@chicoern Жыл бұрын

Mind-blowing how these files brutally murder PowerShell. Even if you think about creating a file that doesn't make sense, to help disguise the malware, these scripts are terrible.

@DiSiBijo Жыл бұрын

huh?

@keylanoslokj1806 Жыл бұрын

He tripped?

@ancestrall794 11 ай бұрын

I think he meant that the person who wrote the powershell script did a really poor obfuscation job