Async RAT - Batch Obfuscation
HTML-код
- Опубликовано: 30 июл 2024
- Check IPinfo online and sign up for free exploring any IP address you would like! ipinfo.io/
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)
The Chinese chars is due to the first two characters in the script, it makes editors think its UTF-16 and thus messes up all the characters. While cmd.exe has no issue processing it.
thats a neat trick
this is exactly what my guess was.
I did not know this. Sounds fun
Wow.
Tu fu fuf fufu CHINA wuhan bat virus NIH ECOHEALTH LAB LEAK
Tbh not boring at all. As an engineer who seems to write more in word, excel and PowerPoint nowadays, I love to have your longer videos playing in the background while working. Much love from Berlin ❤️
One more in Berlin ❤️
2 more*
@@SpaceCatCat still just 2
Wasn't boring at all, watching you do your thing. I did learn a few new tricks today!
Awesome video! Just getting into programming and it's inspiring to see whats possible. I loved being able to see into your investigatory mind and thought processes as you faced problems
Thank you John, we definitely need such so detailed videos about malware! So interesting, so useful!
Wow this was incredibly entertaining and educational, I can't believe youu were worried that it would be boring! I really hope you make more videos like this, seriously! This is really exciting to watch (as sad as that sounds haha). Would love to make a career out of this sort of analysis.
I love the long format vids. Even when they’re old, I feel like I’m talking with you.
Excellent John! Not one bit boring man - thanks for all you do!
You the best, John! It was neither boring nor too quit or anything. Had a blast as always!
I absolutely love these! Please don't stop doing them
I've waited for another one of these to come out very patiently. Worth it.
I had been following many youtubers for years but after finding your channel I don't even need to do it no more. your stuff is just crazy.
Love it! really enjoy watching your malware analysis👍
Hey John, thanks for the video! You probably noticed by now but at 44:48 you missed the function call to KnqbWpjtoveF around the base64 string, which is probably an AES-256 decode on the string and the reason why you were not able to base64 decode them.
Ah, great thing I read your comment. I can alteast now abandon this.
"That's not bat! That's not BAT!" while you looking a bunch of Chinese characters made my day! nice video 👍
@Not Convinced 🤣🤣 Lol man
As pointed out before, the whole trick relies on setting UTF bits at the start of the file, making the text editor assume it UTF-16 or (8). You can get around this very easily by enforcing a specif encoding (before or after) opening the file. The editor I use (UltraEdit) can do this very easily and I assume most other (advanced) text editors can do the same. So this is not really a very effective obfuscation. The setting of the R variable and then using letters from it in the code is much more effective in my opinion. While easily turned back into valid commands by a PC, a raw text analysis will not find anything there.
amazing video! always loved your work!
Great video! I love these deep dives.
I really liked this video, I've been trying to get into stuff like this and you help :D ty and pls keep doing this!
Thanks for making these videos John.
Amazing. Never seen anyone break down malware before. very cool & smart.
unless he's doing a CTF most of his content is a break down of malware.
wow...amazing video...Thanks a lot for all this knowledge shared with us.
Thank you! Just following along. Reminded me of some weird things from yrs ago.
John always the best reverse engineer
This is such a rich content, not boring at all !
Sick video ! More like this please ! :)
thnx men, you are great, gave me a bunch of ideas
Dude, how can you talk for pretty much an hour straight and say you were quiet? Amazing, very fun.
I'm starting to learn Linux because of you :) I'm a little bit old (almost 30 now), and idk why but going thru the command line reminds when I was a kid with the new and hot windows 98. The whole experience is new to me.
You and Mr. Bombal are my inspiration!
This is it, the wait has finaly come to an end.
Thanks a lot John, i learned some new tricks
it's night time here as well, watching as I sip my coffee ☕
ALWAYS great contents!!!
You could go to *Preferences* > *Network* > Click the plus icon on the right side of the window. In your virtual machine settings you could set the network interface to "NAT Network". Do this so that you don't have to bridge to your *real* network.
You keep saying "Echo" and my Alexa is set to respond to Echo and she's freaking out lmao xD
I love that RUclips bitrate compression when he is looking at the obfuscated Chinese bat file
This was riveting to me. Seeing this process in real-time from A → Z as you yourself figure it out is the most educational way this could’ve possibly been conveyed (to me). Thanks!
I have to wake up in 7 hours. Make that 6 now.
I love this content. I actually want to just jump into doing stuff like this myself
Waww , really hilarious , you are on another level . U r the best . Hope i'll reach this level .
Most underrated yt channel. Love the videos, man! ❤
This was intersting, watching whole hour.
"I hate this part of the video" 😂 John at his best 😂, nice content 👌🙏
Can't wait for this video
That's some wicked poor lol great vid thanks man. Audio fine
Good Stuff John!!
As I have taught myself many things in life I hope to some day be able to write software and disassemble software.. I remeber buying c++ books when I was a kid but It never got my attention.. Hopefully soon I will possess this knowledge I just don't know where to start.. It so cool how all that code was hidden in a little batch file...
I like the fact that he is also experimenting in his video, and is not straight up tutorial video.
very interesting video ! learnt a lot as I'm not used to Windows stuff. anyway do you plan making videos about SANS hhc 2021 ? Would be interesting by comparing our different approaches
Hey John, thanks so much for the content, quality was just fine - also ty for the ipinfo ad! I saw the video yesterday and actually had a great use case for the API just today at work for some attack analysis lol.
Btw just wondering, how would one go about sending you a "juicy file"? Someone sent me a very obvious Node.JS RAT from a compromised discord account pretending to be a game, and thought this could be interesting for you, looks pretty powerful.
You can dm it to him on Discord
50 minutes:
This is the same code pattern as seen in your snip3 crypter/Rat video. (about an hour in).
Essentially it first decodes the base64 string. Then uses the WF function to decrypt the decoded strings.
Very entertaining episode
it's amazing videos. thx for it
adhd normally does not let me sit through such long videos without getting bored. i was sad when this video ended
Sleepytime Malware Analysis is my favorite ASMR channel on RUclips
Nice video Hammond
Pooth.
Btw %0 is the file being executed in batch and %~F0 will expand to the full path of the file
Love the video as i am a recovering addict and looking in to going in to it not sure which part yet looking at a little of everything any advice on where to start as a novist/ beginner thanks for the video
i know nothing about what he does but very interesting to watch for sure. i try to put things in order in my mind but still don't understand anything. what does that thing do, how can he know all this thing and etc.
hey john i wonder where do you think i should start as complete beginner? i have some free time and would love to spend on what you do.
Note that K. only detects the origina because it is obsfucated batch, not anything more specific.
Please Give us more of such unedited videos
John: oo, I've found a python bat deobfuscator in the obfuscated code, neat!
Also John: _proceeds to manually deobfuscate the code anyway_
there was only an obfuscator and no deobfuscator...
Find someone who loves you as much as John loves his malware
I came across a batch file with Chinese in it once, all i had to do was change the character encoding in sublime text and it fixed it
Fascinating bat file.
the variable names at 16:25 made me laugh because they are what i use when im testing something and need a quick variable name
poggers
the base64 strings are probably aes encrypted then base64 encoded so it's printable, and the random next network stuff got me thinking of fast flux dns resolution to connect to a C2C server that keeps changing it's dns. maybe, maybe not i just though id share my thoughts, nice video as usual :) quite interesting piece of malware
Port 9001 is commonly used on TOR. Perhaps that's why you did not find clear host destination.
Not boring at all. Finished the video without skipping.
Crazy crazy stuff here :)
" i didn’t write it down " john forgets he’s recording 🤣
I can't remember, are these samples available for us to practice along with the video?
whhhaaaattt batch obfuscationnnn !
youuu shinanigenssss
dear john hammond are you using ubuntu or linux in general as full time like a daily driver ?
Very interesting stuff mah gai
HOHN JAMMOND - see I obsfucated his name ;) Classis substitution cipher technique that even the most recent malwares deploy.
Hi Chris 👋 I hope my comment didn't sound as a form of privacy invasion your comment tells of a wonderful woman with a beautiful heart which led me to comment I don't normally write in the comment section but I think you deserve this complement. If you don’t mind can we be friends? Thanks God bless you….
At 44:40, when you looking at the base64 stuff.. They call an other method with the result of base64, and after changing the Encoding. Thats prolly why only getting the base64 from the string didnt do a lots for you. I guess...
you should run part of code to get the output encoded strings
@John Hammond
Which RAT do you recommend? I am using NJRat at the moment.
Also which open source Crypter do you recommend and where can I get it from? Need to undetected on Windows 10/WinDefender/AV
babe wake up, new malware analysis video
unironically says updog
Would be good to investigate which protocol connects to the IP address. Obviously that address is stored somewhere in the encrypted data, including the port. Reverse shell lets the computer at the other side control your computer. What if the process could be reversed? Now you have the IP address, their reverse shell server has to be exposed to the public somehow. Anyway, it would be good to report for authorities.
Would you be willing to share the decoded sample? I know it's been a while since you made this video. I used to RE malware at my previous position and was curious if I might be able to.
That is pretty cool
"That did not like ... whatever was happening." 😂
39:43 malware analyst moment
nah, "did i just dox my[self/company]?" moment
How that thing is supposed to work? Do people generally use an administrator account with UAC turned off?
Hey John I wanted to ask this which course are you studying from for your malware analysis?
how can I start doing stuff like this? IS there a site that has a path for reverse engineering like this?
Could that be just the .length method to define the C2 IP by octets?
What's updog?
Also, why do you use separate 'cd' commands in cmd?
'cd Desktop/batch' works fine too, cd takes a relative path.
I dont know if im going crazy but I can't find your resume video anymore haha
Did YOU figure it out as ASYNCRAT or was it windows defender that did the heavy lifting here?
I'm curious, this obviously takes a lot of time to write, and to implement, with a lot of skill,
what do they get out of it?
where is the profit?
Is it just to take over someone's computer? Or are they after doing more once they have control?
How do you know all these things? What course do you learn ?
I'd love to see the batchfile, can you share it?
I don't understand anything he does but that was still fun to watch. Did he "run" parts of the malware in his command promt tab to see what they do? If so, why do people obfuscate their code anyway?
Main purpose of obfuscation is usually to evade anti-virus detection
Obfuscation is always possible to get around, but it does slow things down.
One thing you could have done is write a script to parse the file for %r:N,n (case insensitive) and replace the matches with the correct value in the seed value
Please do videos on PE malware analysis.
at 49:02 it get the lenth of one and it it deosent have .length its 0 (.len = 1, no .len = 0)
I’m confused of those %%r:~-15
So can someone explain, wth are those
sick