Snip3 Crypter/RAT Loader - DcRat MALWARE ANALYSIS

  Рет қаралды 492,210

John Hammond

John Hammond

2 жыл бұрын

You can register now for the Snyk "Fetch The Flag" CTF and SnykCon conference at snyk.co/john ! Come solve some great beginner-friendly challenges -- including some of my own!
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)

Пікірлер: 407
@qwqdanchun1049
@qwqdanchun1049 2 жыл бұрын
Well , I have to admit that it once is a class homework , I even make a ppt for it ! LOL
@qwqdanchun1049
@qwqdanchun1049 2 жыл бұрын
Really cool video , i love it
@_JohnHammond
@_JohnHammond 2 жыл бұрын
@qwqdanchun WOW 😆That is incredible. Thanks for checking out the video!!!
@m3mphi5r4r7
@m3mphi5r4r7 2 жыл бұрын
@@_JohnHammond Please do malware analysis on a ransomware. there is not much resources to learn. i hope you can fill the gap :p
@emblemi6345
@emblemi6345 2 жыл бұрын
That completes the cycle. Btw it's a nice uni which gives homework to write a RAT :)
@bryanandhallie
@bryanandhallie 2 жыл бұрын
Haha, this is crazy how things turned out. Great piece of kit qwqdanchun!
@thisconnectd
@thisconnectd 2 жыл бұрын
"he follows me" was the most fun moment by far!
@imtm
@imtm 2 жыл бұрын
time stamp?
@Zyphera
@Zyphera 2 жыл бұрын
@@imtm 1:30:10
@raddoobies
@raddoobies 2 жыл бұрын
I love watching videos like this when I know absolutely nothing about scripting, it's confusing as hell but also entertaining
@XGalaxyPlqyZ
@XGalaxyPlqyZ Жыл бұрын
Same bruh xD
@springchickena1
@springchickena1 Жыл бұрын
@@XGalaxyPlqyZ as we all know it's a requirment to learn R to understand any youtube video about hacking.just throw away python and oracle programming. what you're going to want is to learn assembly and best way to do that is with elon musks lovelace rs fmri net since thinking is power
@faint.2396
@faint.2396 Жыл бұрын
@@springchickena1 Thanks!
@XGalaxyPlqyZ
@XGalaxyPlqyZ Жыл бұрын
@@springchickena1 Thanks
@WagWanTeleban
@WagWanTeleban Жыл бұрын
@@springchickena1 what??
@diszylam1018
@diszylam1018 2 жыл бұрын
I'm just learning how to code and these videos make me super excited. I never thought watching someone analyze some malware would hold my interest this well.
@retroke6560
@retroke6560 2 жыл бұрын
lmao same, this is some new entertainment i'm able to enjoy, and each time is better.
@product_of_august
@product_of_august Жыл бұрын
Same one of his vids appeared in my recommended and I was hooked.
@Tempi_
@Tempi_ Жыл бұрын
What are you learning and how far have you gotten in 8 months? I've just started python for data analysis
@diszylam1018
@diszylam1018 Жыл бұрын
@@Tempi_ I started out with intro to C++ where it was the basics like how to print to screen and the likes. Then C++ 1, where we started to get more in depth and build off the basics like looping a piece of code if an if statement that we created was true and learning about nested loops and other more advanced basic functions like really simple pointers. I just finished my C++ 2 class. We started learning how to really use pointers, and that led into data structures like the use of linked lists and basic binary trees. data structures is where learning this stuff gets pretty damn difficult, please if you do get to that point make sure you're not taking too many classes at once so you can focus on learning it well. I made the mistake of taking too many classes and that made it much more difficult to learn how to code properly.
@arzi2054
@arzi2054 2 жыл бұрын
This guy in one malware program wrote more code then i in my entire life xD And in description he puts "a SIMPLE remote tool"
@stinkytoby
@stinkytoby 2 жыл бұрын
The follow reveal was golden
@trottingfoxinc
@trottingfoxinc 2 жыл бұрын
By youtube logic, nearly 2 hour long videos containing nothing but code shouldn't be interesting. But my god sir, I only started playing with C# in Unity a month ago, and not only am I loving watching all of these, but I feel like I'm learning way more than I did from any of the online courses I've been doing. I've gotten so much exposure to the inner working of computers, and how other languages look both familiar and different, and it's been FUN. There's even starting to be moments where I'll catch onto a pattern or what something's doing at the same time you do, and it's been an amazing brain exercise learning to not only keep up, but also to look for things myself. I'm learning coding both as a hobby and an auxiliary skill to my career (I work in entertainment production), and these videos are both fun and invaluable. Thank you!
@DimkaTsv
@DimkaTsv 2 жыл бұрын
I just watch this like "How it's made" or some detective stuff... Feels good. And i am not even a coder (literally cannot do anything i require sometimes without google).
@TheIronside100
@TheIronside100 2 жыл бұрын
so, i got home at 2 am from a guys night out, bought some food and wanted to watch 10 min meme vid... now i am hooked to this.
@callmemc6
@callmemc6 2 жыл бұрын
Idk how you do it John, but somehow you make entertaining videos while doing one of the most raw forms of data teardown in command shells.
@arif8434
@arif8434 2 жыл бұрын
the talking and he explaning stuff help so much
@dedkeny
@dedkeny 2 жыл бұрын
That twist at the end though... 😳🤣
@ghostofrecon1
@ghostofrecon1 2 жыл бұрын
Unsafe allows it to access memory space that isn’t assigned to it by the JIT (example you can’t use pointers unless you compile as unsafe)
@Stagnating_
@Stagnating_ 2 жыл бұрын
The reason why many scanners tag it as AsyncRAT is because DCRat's code is largely built upon it, most of the core features have been copied directly. I've been following this chinese guys work for a while and came across all kinds of interesting stuff, the language barrier is a bitch though.
@matthewmorton7231
@matthewmorton7231 2 жыл бұрын
This is great! It's so cool to see someone take the time to make content like this; it's super helpful & not a perspective I usually see. Really useful to students of programming/security. Thanks John :)
@-Giuseppe
@-Giuseppe 2 жыл бұрын
AMSI part is amazing, thank you for the quick explanation!
@CielMC
@CielMC 2 жыл бұрын
Hey john, chinese viewer here, according to the author's bio, he is preparing for a postgraduate exam and all of these seem to be just passion projects he is making for fun as his bio would imply. If you have any more questions, feel free to ask, hope that helped.
@h8handles
@h8handles 2 жыл бұрын
So I just started learning some offensive C# and poweshell and am finally able to wrap my head around these videos and it's helping me understand to be better at offense. Love the content John.
@ldSt3345
@ldSt3345 2 жыл бұрын
Hi! Which books/videos/courses do you use?
@richoffremo461
@richoffremo461 Жыл бұрын
@@ldSt3345 Hey Lt, do you still need help getting started?
@ldSt3345
@ldSt3345 Жыл бұрын
@@richoffremo461 not rn. Like, don't have much time, war, that sort of thing
@remyvanderzijden5213
@remyvanderzijden5213 2 жыл бұрын
"Alright so we've done enough cyber-stalking [...] He is on twitter !!!" Made me chuckle. Then "HE FOLLOWS ME !!!" was hilarious xD
@edsongray3356
@edsongray3356 2 жыл бұрын
I saw some similar program of excel that used the VBA macro codes, the program was made in china. What that program basically did was stole your data with some kind of get string and get tables VBA functions. The problem with security in this kind of software like excel is that you install tools from the web with out knowing that these tools contain malware. Funny story is that nobody believed that. I even got screen shots of the malware code being executed in a window macro of an excel VBA code . It's amazing how enterprises can spied whit a single .file with code. Any way awesome video, very pedagogical.
@SomeUniqueHandle
@SomeUniqueHandle Жыл бұрын
I recently found your channel. These deep dives are great for getting better at reading other people's code. A lot of coding channels concentrate on writing fresh, new code, but on the job you often need to read other people's work and add on to it or re-factor it to improve the functionality.
@tomshanahan3346
@tomshanahan3346 2 жыл бұрын
That was insane! What a twist. Brilliant work and entertainment.
@stefsot2
@stefsot2 2 жыл бұрын
"RunPE" refers to code that loads a host process and replaces the PE (hence the name) executable with another one. This is done to execute a windows PE file (.exe commonly) in-memory without writing it to the disc since windows requires a process to be loaded/created from a file on disk. This essentially creates a "zombie" process that points to a specific PE file on disc but inside it executes (hosts) another PE file. You could of course construct a "shellcode" so you dont have to "zombify" another "host" process but this requires delicate knowledge and is more complicated. In your video the "AppLaunch" is used as the zombie file mainly because is included in all windows installations, does nothing when launched (although doesnt really matter since the zombie-host process is spawned in suspended state) and contains imports to required libraries that the "parasite" PE file needs. From what I see this is copy-pasted and not really anything advanced.
@0rez
@0rez 2 жыл бұрын
Hey. U is smert
@brinklaubscher8063
@brinklaubscher8063 2 жыл бұрын
@@0rez u is enterteneng
@drygordspellweaver8761
@drygordspellweaver8761 2 жыл бұрын
Any examples of advanced stuff?
@Lino1259
@Lino1259 Жыл бұрын
Is this whats called process hollowing?
@onmc4754
@onmc4754 2 жыл бұрын
43:05 if applaunch is open it gets the proccess id (type in cmd tasklist its shows the pid). Then it injects itself into it effectively being run in every instance of every executable that uses dot net framework with forums. Kinda clever hard to detect which process is the one doing the malicious stuff meaning this could be hard to remove without the right tools.
@milo_andrs
@milo_andrs Жыл бұрын
I was fascinated, there are a lot of impressive things with this specific analysis and it was very rewarding.
@emmashepard2070
@emmashepard2070 2 жыл бұрын
I'm slowly trying to get better at coding this video was honestly super cool. Amazing what you could end up doing
@mytechnotalent
@mytechnotalent 2 жыл бұрын
Great job as always John! The INSTALL and Decompress were really crazy. Great analysis.
@yannmassard3970
@yannmassard3970 Жыл бұрын
I code games, I wish I could have 2 lives to get enough time to dig into this field. Back top my days, it was only assembly and C++, now the amount of knowledge behind is immense
@MikeySKA
@MikeySKA Жыл бұрын
I'm doing my Sec+ class right now, and this was AWESOME. Will be sharing to my classmates. 👍👍👍👍
@rafaelgontijo5792
@rafaelgontijo5792 2 жыл бұрын
Great video, keep up with the quality content!
@EliteRvZ
@EliteRvZ 2 жыл бұрын
I have NO FUCKING IDEA of how coding works, but i still enjoy the shit out of these videos? how?
@Imwer
@Imwer 2 жыл бұрын
You are "decrypting" malware as I am "decrypting" old, legacy, badly, written source code. Great help and inspiration!
@kryptux2463
@kryptux2463 Жыл бұрын
I could watch these all day.
@Zapperiopa
@Zapperiopa 2 жыл бұрын
Very nicely presented and educational with your own trail and errors. I'm a subscriber now.
@Raser1995
@Raser1995 2 жыл бұрын
Great video. One request: add key presses to video. I love how you navigate in subline, or tinker in terminal with just a keyboard. Will be great to see what hotkeys are you using. Helps learn that kind of stuff. =)
@myndzi
@myndzi 2 жыл бұрын
The urlencoded text was clearly not ascii text, so utf-8 was definitely not the correct encoding to use -- but I was curious what the correct approach in Python is, and there are actually a couple interesting things: - Using urllib.parse.unquote(data) is already irreversibly mangling the data. It performs a conversion step (taking the string to be percent-encoded data as bytes(?), and producing a string with unicode code points based on an encoding), with the encoding defaulting to utf-8. The gzip header includes an invalid sequence, which gets replaced by the unicode replacement character (U+FFFD), so the first four characters in the sequence (%1f%8b%08%00) become \x1f\xff\xfd\x09\x00. This is irreversable, since the data (\x8b) has now been lost. - You tried converting the result of that to bytes with latin1, but you already had the (already-mangled) data, which would have been correct if not for the implicit encoding step by unquote. The unicode replacement character can't be encoded as latin1 data into bytes, so it threw an exception. The correct code appears to be `bytearray(urllib.parse.unquote(urldata_bytes, 'latin-1'), 'latin-1')`, which gives `bytearray(b'\x1f\x8b\x08\x00')` I found it interesting that this is particularly obtuse in Python and that there seems to be no really obvious/clean way to "just do the thing"
@stevebanning902
@stevebanning902 2 жыл бұрын
Damn you are 1337 dude
@Safex
@Safex 2 жыл бұрын
thanks for the explanation. that this has always puzzled me. have a lot less knowledge about what goes on under the hood than you, but parsing things from bytes to strings and between different encodings is pain in the ass.
@myndzi
@myndzi 2 жыл бұрын
​@@Safex I don't really know anything special about what's "under the hood" here or Python, I just saw something I didn't understand and wanted to understand it. I experimented and read docs. That's how I learned everything I know: be curious, explore. Make a habit out of that, and you'll build up a base of knowledge. You accrue all sorts of useful tidbits this way. As an example, I'd like to elaborate on my comment about "clearly not ascii text" -- I phrased that poorly (which is probably what the troll above was reacting to) -- but it derives from just a tiny bit of information about how the ASCII table is organized: Uppercase letters are 010xxxxx, where xxxx=1 is "A" and xxxxx=2 is "B" and so on. Lowercase letters are 011xxxxx. In hex that makes letters fall into the range 0x50-0x8F and space is 0x20. Anything less than space (0x20) is a control character and generally not present in text. That's a pretty restricted set of values, and once you know that "one weird trick", you can make a good guess as to whether you're looking at text or not, even if you don't immediately know what it says. (Unicode encoded as UTF-8 has clear patterns too, in addition to sequences that are invalid) Compressed data (by its nature: read about entropy coding) is pretty similar to random data. If you're looking at a compressed data stream, then aside from any magic/header bytes the values will be all over the place without much of a discernible pattern. An executable or some data file may have some bits of "ascii" text mixed in, but also chunks of null bytes, or small/large bytes that don't look like text. It will look like it has structure, but it won't consist entirely of text-looking content. With all that in mind, even the first four bytes "%1f%8b%00%00" suggests that the data isn't text-based (especially in light of the null bytes -- %00). It also suggests it isn't compressed (there's clear structure). Anyway, I just wanted to mention that there's no magic here, just curiosity at work. Anyone can do it, and I encourage them to :)
@babybirdhome
@babybirdhome 2 жыл бұрын
@@myndzi This is the correct approach, it just requires patience and persistence which is hard if you’re expecting instant results and want to be like John on day two. That said, you’ve gotten a lot further than I ever have with character encoding. I’ve only gotten deep enough to know it’s complicated as heck to step into, and only know enough that two tools are handy when you’re new and still trying to figure things out. CyberChef has two tools - Magic, and one for character encoding brute force that can be very helpful to start you off or sometimes just get you a quick result when you don’t have time to dive deep just to learn.
@XENON2028
@XENON2028 Жыл бұрын
I had a feeling it was the wrong encoding but I never knew unquote would encode into utf-8!
@ancestrall794
@ancestrall794 2 жыл бұрын
35:40 This was badass. I love Sublime Text for this kind of manipulation while writing
@vsevolodmedvedev9002
@vsevolodmedvedev9002 Жыл бұрын
Was really amazed, thank you for the video!
@dillons6721
@dillons6721 2 жыл бұрын
I've never even touched any of this stuff and know nothing about it. Yet I watched the whole video because of your explanations! Great info for anyone looking for it. More please!
@seraphsilent5255
@seraphsilent5255 2 жыл бұрын
and a huge draw for me personally is the voice! the sound and personality just drew me in and he's completely speaking greek
@Spaggelaar
@Spaggelaar 2 жыл бұрын
Thanks for the video, really liked the analysis :)
@PatrickHener
@PatrickHener 2 жыл бұрын
One of the best videos I have ever seen!
@bekkaician
@bekkaician 2 жыл бұрын
Great video, was a really fun ride. Inspiring as well
@Lampe2020
@Lampe2020 Жыл бұрын
This was one of the funniest malware analysis videos I've ever watched XD For example: 1:30:10 "He follows me?!?" It's funny to see you crack up laughing because of that ;)
@devinbrooks136
@devinbrooks136 2 жыл бұрын
Very long video but definitely worth the watch. Crazy buddy actually came and saw the video and commented! AND FOLLOWS YOU! Crazy times.
@p0pck0rn
@p0pck0rn 2 жыл бұрын
Dude, this was so good!
@eamonmulholland3159
@eamonmulholland3159 Жыл бұрын
I love how animated you are doing this 😁
@HackeXPlorer
@HackeXPlorer 2 жыл бұрын
Awesome!!! walkthrough John, it was a wild🎢 ride. ✨✨✨✨✨
@Morimea
@Morimea Жыл бұрын
I rly enjoyed the video, thanks!
@thatETTYT
@thatETTYT Жыл бұрын
Him pops neck The dog: *Windows startup sound*
@SuperChalm
@SuperChalm 2 жыл бұрын
this is cool. seeing you do all this reminds me of first learning CMD stuff and Bash after that lol
@giladT1000
@giladT1000 2 жыл бұрын
Those videos are great! i love to watch them
@mrkhad
@mrkhad 2 жыл бұрын
WOW I truly love what you are doing , respect
@generovinsky
@generovinsky 2 жыл бұрын
Very cool video.. humbled after watching you work. Awesome twist at the end.. ;)
@ChroCast
@ChroCast Жыл бұрын
i took an html class 10 years ago and this is wild to listen too, idk any of your crazy words magic man but they are cool
@mooxart64
@mooxart64 2 жыл бұрын
This was so entertaining to watch, seriously.
@jackfull9972
@jackfull9972 2 жыл бұрын
Had to come check this out after your advent of cyber room!
@asdfasdfasdf383
@asdfasdfasdf383 2 жыл бұрын
Very instructive and very interesting video. I don't know much about windows (I use linux) but I was shocked what a piece of cake it is to bypass amsi!
@stevebanning902
@stevebanning902 2 жыл бұрын
You know someone is amazing with computers when they know and utilize every windows keyboard shortcut imaginable. It's one of the questions I use when interviewing people for IT positions.. lol
@jakezxz1352
@jakezxz1352 2 жыл бұрын
What a waste of time that would be
@nickgawne
@nickgawne 2 жыл бұрын
@@jakezxz1352 wouldnt it be the exact opposite of a waste of time? :)
@snafulegend6689
@snafulegend6689 Жыл бұрын
It creates c++ code, compiles it, sets up 2 ways for the malware to execute automatically incase one fails. It replaces applaunch which start automatically with the framework and on startup. It stores itself (the "exe" is compiled in c++) in memory. Easy. Projectfud = a library stored in your memory doing things. It launches on start up 2 different ways.
@gurucode.studio
@gurucode.studio 16 күн бұрын
Best malware analysis yet you can find on KZfaq, thanks mate)
@Bharath-wb8uy
@Bharath-wb8uy 2 жыл бұрын
Thank you Love your content
@cameronsmith1807
@cameronsmith1807 2 жыл бұрын
Great video John
@kjl3080
@kjl3080 2 жыл бұрын
46:06 that’s some big brain credits
@iliankarasimirov9685
@iliankarasimirov9685 2 жыл бұрын
That was great, I learned a lot
@wayoutstreaming
@wayoutstreaming 2 жыл бұрын
What a nice little surprise when the author was a twitter follower. was not expecting that XD
@powertoystransport
@powertoystransport Жыл бұрын
awesome job
@janekschleicher9661
@janekschleicher9661 Жыл бұрын
I work in software engineering and data science oriented projects, and even tough this is far away of the malware analysis of this video, it highly remembered to significant reverse engineering parts you have to do, too, in legacy code (without documentation and similar), or sometimes even to start a part of the work on semi-protected older projects (where author and everything else left the company some time before). Even web scraping involved a lot of similar techniques (there's a lot of obfuscation parts inside, too, especially if the web sites don't want to be scraped, or more often, when it's using a whole lot of historical technology, like JavaScript Shortifier over some old AJAX over some old SOAP connecting to deprecated MS SQL server technology that might now have a more up to date backend, but still kept the API, etc, with still some survived obfuscation technology that end of 90s were security techniques). I think this also tells why writing anti-malware software is so hard, as even legit code does look very often enough similar odd, including such hardcoded obfuscated byte strings as integers and similar. (Just look to some autogenerated gRPC code as one example).
@omahanprabla3058
@omahanprabla3058 Жыл бұрын
Did your 3yo write this?
@emperorj4783
@emperorj4783 2 жыл бұрын
Keep saucing up these series 😎✌
@nicholasgraff894
@nicholasgraff894 Жыл бұрын
thank you for this
@NickMasseyRideon
@NickMasseyRideon 2 жыл бұрын
I have zero idea how I got here but, dang! this is sssssssssooooooooo cool! subbed!
@0xbyt3z
@0xbyt3z 2 жыл бұрын
really good content. feels more
@concepcionwilson5815
@concepcionwilson5815 2 жыл бұрын
Love your vids John!!! How did you repair your Amsi-Scan?
@homesystem2287
@homesystem2287 2 жыл бұрын
And I was like: “HHm..no obfuscation…” Then I saw the RUNPE variable 🤣
@accountname1047
@accountname1047 2 жыл бұрын
Great content!
@verolyn8459
@verolyn8459 2 жыл бұрын
God i'm loving this Channel.
@CySEC-LB
@CySEC-LB Жыл бұрын
bro I'm learning the analysis more here than my university Dr. I should call you Dr. John 😂 LoL
@tecsmith_info
@tecsmith_info 2 жыл бұрын
Does anyone else shout at their monitor whilst going through these? Great video! Subbed.
@DissyFanart
@DissyFanart 2 жыл бұрын
I've been binge watching these malware analysis videos after a friend of mine tore apart a virus I managed to get. If you want another exe (that at the time wasn't caught by anything on virustotal, could have changed since then) to add to the pile of things I'm sure you have to analyze, let me know :)
@_JohnHammond
@_JohnHammond 2 жыл бұрын
Yes please! Email in the description ;)
@DissyFanart
@DissyFanart 2 жыл бұрын
@@_JohnHammond sent! Forgot to mention in the email but I'm sure you'll get a kick out of some of the variable names/values, no spoilers though :)
@Danjovisagat
@Danjovisagat Жыл бұрын
I'm impressed.
@whetfaartz6685
@whetfaartz6685 Жыл бұрын
1:22:46 LMAO HE SAID WHERE AM I, HE KNOWS DAMN WELL WHAT THOSE CHARACTERS ARE LOOLLLL
@TalsonHacks
@TalsonHacks 2 жыл бұрын
"Or you can use VSCode if you're that kind of human being"
@renchesandsords
@renchesandsords 2 жыл бұрын
idk i kinda like vscode
@TalsonHacks
@TalsonHacks 2 жыл бұрын
@@renchesandsords I like it too ;)
@bonzibuddy4240
@bonzibuddy4240 2 жыл бұрын
1:14:00 and before, it didn't show key because you wrote Console.WriteLine("key=", key), which invokes the overload Console.WriteLine(string format, object value). Since there were no placeholders (like "{0}") it didn't format them.
@3dforming
@3dforming 2 жыл бұрын
1 hour in, the BS-OD is neat. Think about it, it delivers its payload, maintains persistence then BSOD's. Natural response is power cycle PC thereby initialing the start up routine. I'll wait and see how it pans out :)
@x3ICEx
@x3ICEx 2 жыл бұрын
What would be even neater however, is running the malware wihout BSOD.})();
@DimkaTsv
@DimkaTsv 2 жыл бұрын
@@x3ICEx i bet it does that too, bsod is just one of possible stuff it does. Especially as it definitely allows to take commands from remote server... And i 100% bet that BSOD is one of them... Soo mass BSOD is possible
@charlescoult
@charlescoult 2 жыл бұрын
1:30:10 - "He's on Twitter!!" "Should we drop a follow...?" "he follows ME!!!" XD I died.
@M.I.S
@M.I.S 2 жыл бұрын
Merci !
@baremetaltechtv
@baremetaltechtv 11 ай бұрын
That was a crazy rabbit hole...
@genukashamugia5988
@genukashamugia5988 2 жыл бұрын
Just gonna go ahead and like this before seeing the video because I know it's gonna be a banger
@benney25
@benney25 2 жыл бұрын
You can copy paste the URL into google translate to translate the page to english :)
@johnnyhun1
@johnnyhun1 2 жыл бұрын
3:44 "Looks pretty suspicious right away" me who is just seeing a bunch of letters: ?? :0
@Toylmao
@Toylmao 2 жыл бұрын
That plot twist at the end when you saw he follows you LMAO.
@heatherryan9820
@heatherryan9820 Жыл бұрын
So, a lot of time, I'll put on your long videos on my screen next to me while I'm working on my computer, honestly just half-paying attention to it, but I really got into this one. Quick question though, how cool was it to see that he was following you on Twitter? That's got to be an interesting feeling. Anyways, thanks for the great video, and I've learned so much from you. Super appreciate it.
@DWGBlade
@DWGBlade 2 жыл бұрын
OMG You're great, man! Had me dying laughing when you said he follows you on twitter.
@0rez
@0rez 2 жыл бұрын
Instructions unclear. Ran the RAT and now infected
@alandonaly457
@alandonaly457 2 жыл бұрын
Very nice keep it up.
@garethjames8307
@garethjames8307 2 жыл бұрын
This literally blew my mind .... I love how you keep saying "You just do this ... simple!" ....Uhm, yeah OK John ... we believe you. Real simple :D
@ayior
@ayior Жыл бұрын
I came for the code breakdown and stayed for the amazing plot
@sdog300
@sdog300 2 жыл бұрын
do you do code analysis's often? i had a lot of trouble trying to learn during high school. ive got turing complete which has helped me actually understand what is happening & how the variable names used by programing languages are used at the bit/byte level. i got a mental block once i got to the actual coding portion. mainly because the whole system is made from scratch besides the few examples they use to get you started. so its a little dificult to use useful name for the bytes with my limited experience with coding.
@9rye
@9rye Жыл бұрын
Literally a movie!
@jorgemaldonado8515
@jorgemaldonado8515 2 жыл бұрын
I am Mexican and your videos is amazing!
@itaybarok9405
@itaybarok9405 2 жыл бұрын
Thanks for discovering this competition to us!
@katieg2277
@katieg2277 Жыл бұрын
the amsi break is the scariest thing I've ever seen on youtube and it's freely available 10 keystrokes away. thanks i hate it
@pharmokan
@pharmokan 2 жыл бұрын
palms sweaty when trying to reverse trace, the most bravest of brave is you.
TARGETED Phishing - Fake Outlook Password Harvester
47:09
John Hammond
Рет қаралды 256 М.
Unraveling a REMOTE ACCESS TROJAN (VBScript Deobfuscation)
31:20
John Hammond
Рет қаралды 159 М.
Угадайте концовку😂
00:11
Poopigirl
Рет қаралды 3,9 МЛН
Китайка и Хеликоптер😂😆
00:18
KITAYKA
Рет қаралды 1,3 МЛН
FAKE Antivirus? Malware Analysis of Decoy 'kaspersky.exe'
1:28:19
John Hammond
Рет қаралды 271 М.
Finding WEIRD Devices on the Public Internet
27:48
John Hammond
Рет қаралды 112 М.
He tried to hack me...
34:15
John Hammond
Рет қаралды 372 М.
Information Stealer - Malware Analysis (PowerShell to .NET)
47:56
John Hammond
Рет қаралды 51 М.
Hackers Abuse Zero-Day Exploit for CrushFTP
31:49
John Hammond
Рет қаралды 30 М.
Simmerstats: The genius old tech that controls your stovetop
36:31
Technology Connections
Рет қаралды 715 М.
Compiled Python is FAST
12:57
Doug Mercer
Рет қаралды 73 М.
Finding WEIRD Typosquatting Websites
24:26
John Hammond
Рет қаралды 219 М.
Угадайте концовку😂
00:11
Poopigirl
Рет қаралды 3,9 МЛН