Async RAT - Batch Obfuscation
Вставка
- Опубліковано 9 січ 2022
- Check IPinfo online and sign up for free exploring any IP address you would like! ipinfo.io/
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)
The Chinese chars is due to the first two characters in the script, it makes editors think its UTF-16 and thus messes up all the characters. While cmd.exe has no issue processing it.
thats a neat trick
this is exactly what my guess was.
I did not know this. Sounds fun
Wow.
Tu fu fuf fufu CHINA wuhan bat virus NIH ECOHEALTH LAB LEAK
Tbh not boring at all. As an engineer who seems to write more in word, excel and PowerPoint nowadays, I love to have your longer videos playing in the background while working. Much love from Berlin ❤️
One more in Berlin ❤️
2 more*
grüße aus dem westen
@@SpaceCatCat still just 2
Wasn't boring at all, watching you do your thing. I did learn a few new tricks today!
Awesome video! Just getting into programming and it's inspiring to see whats possible. I loved being able to see into your investigatory mind and thought processes as you faced problems
Thank you John, we definitely need such so detailed videos about malware! So interesting, so useful!
I love the long format vids. Even when they’re old, I feel like I’m talking with you.
Excellent John! Not one bit boring man - thanks for all you do!
I absolutely love these! Please don't stop doing them
I've waited for another one of these to come out very patiently. Worth it.
Wow this was incredibly entertaining and educational, I can't believe youu were worried that it would be boring! I really hope you make more videos like this, seriously! This is really exciting to watch (as sad as that sounds haha). Would love to make a career out of this sort of analysis.
You the best, John! It was neither boring nor too quit or anything. Had a blast as always!
I had been following many youtubers for years but after finding your channel I don't even need to do it no more. your stuff is just crazy.
Love it! really enjoy watching your malware analysis👍
Amazing. Never seen anyone break down malware before. very cool & smart.
unless he's doing a CTF most of his content is a break down of malware.
Hey John, thanks for the video! You probably noticed by now but at 44:48 you missed the function call to KnqbWpjtoveF around the base64 string, which is probably an AES-256 decode on the string and the reason why you were not able to base64 decode them.
Ah, great thing I read your comment. I can alteast now abandon this.
amazing video! always loved your work!
Thanks for making these videos John.
Great video! I love these deep dives.
I really liked this video, I've been trying to get into stuff like this and you help :D ty and pls keep doing this!
"That's not bat! That's not BAT!" while you looking a bunch of Chinese characters made my day! nice video 👍
@Not Convinced 🤣🤣 Lol man
As pointed out before, the whole trick relies on setting UTF bits at the start of the file, making the text editor assume it UTF-16 or (8). You can get around this very easily by enforcing a specif encoding (before or after) opening the file. The editor I use (UltraEdit) can do this very easily and I assume most other (advanced) text editors can do the same. So this is not really a very effective obfuscation. The setting of the R variable and then using letters from it in the code is much more effective in my opinion. While easily turned back into valid commands by a PC, a raw text analysis will not find anything there.
Thank you! Just following along. Reminded me of some weird things from yrs ago.
wow...amazing video...Thanks a lot for all this knowledge shared with us.
This is it, the wait has finaly come to an end.
John always the best reverse engineer
I love that UA-cam bitrate compression when he is looking at the obfuscated Chinese bat file
thnx men, you are great, gave me a bunch of ideas
Thanks a lot John, i learned some new tricks
This is such a rich content, not boring at all !
adhd normally does not let me sit through such long videos without getting bored. i was sad when this video ended
it's night time here as well, watching as I sip my coffee ☕
You and Mr. Bombal are my inspiration!
Sick video ! More like this please ! :)
ALWAYS great contents!!!
Hey John, thanks so much for the content, quality was just fine - also ty for the ipinfo ad! I saw the video yesterday and actually had a great use case for the API just today at work for some attack analysis lol.
Btw just wondering, how would one go about sending you a "juicy file"? Someone sent me a very obvious Node.JS RAT from a compromised discord account pretending to be a game, and thought this could be interesting for you, looks pretty powerful.
You can dm it to him on Discord
I like the fact that he is also experimenting in his video, and is not straight up tutorial video.
Good Stuff John!!
You could go to *Preferences* > *Network* > Click the plus icon on the right side of the window. In your virtual machine settings you could set the network interface to "NAT Network". Do this so that you don't have to bridge to your *real* network.
This was intersting, watching whole hour.
I have to wake up in 7 hours. Make that 6 now.
I love this content. I actually want to just jump into doing stuff like this myself
Please Give us more of such unedited videos
Can't wait for this video
That's some wicked poor lol great vid thanks man. Audio fine
Find someone who loves you as much as John loves his malware
Waww , really hilarious , you are on another level . U r the best . Hope i'll reach this level .
This was riveting to me. Seeing this process in real-time from A → Z as you yourself figure it out is the most educational way this could’ve possibly been conveyed (to me). Thanks!
Most underrated yt channel. Love the videos, man! ❤
Sleepytime Malware Analysis is my favorite ASMR channel on UA-cam
it's amazing videos. thx for it
You keep saying "Echo" and my Alexa is set to respond to Echo and she's freaking out lmao xD
As I have taught myself many things in life I hope to some day be able to write software and disassemble software.. I remeber buying c++ books when I was a kid but It never got my attention.. Hopefully soon I will possess this knowledge I just don't know where to start.. It so cool how all that code was hidden in a little batch file...
Dude, how can you talk for pretty much an hour straight and say you were quiet? Amazing, very fun.
I'm starting to learn Linux because of you :) I'm a little bit old (almost 30 now), and idk why but going thru the command line reminds when I was a kid with the new and hot windows 98. The whole experience is new to me.
Note that K. only detects the origina because it is obsfucated batch, not anything more specific.
Fascinating bat file.
50 minutes:
This is the same code pattern as seen in your snip3 crypter/Rat video. (about an hour in).
Essentially it first decodes the base64 string. Then uses the WF function to decrypt the decoded strings.
Very entertaining episode
I came across a batch file with Chinese in it once, all i had to do was change the character encoding in sublime text and it fixed it
very interesting video ! learnt a lot as I'm not used to Windows stuff. anyway do you plan making videos about SANS hhc 2021 ? Would be interesting by comparing our different approaches
"I hate this part of the video" 😂 John at his best 😂, nice content 👌🙏
Pooth.
Btw %0 is the file being executed in batch and %~F0 will expand to the full path of the file
Not boring at all. Finished the video without skipping.
Nice video Hammond
Love the video as i am a recovering addict and looking in to going in to it not sure which part yet looking at a little of everything any advice on where to start as a novist/ beginner thanks for the video
i know nothing about what he does but very interesting to watch for sure. i try to put things in order in my mind but still don't understand anything. what does that thing do, how can he know all this thing and etc.
hey john i wonder where do you think i should start as complete beginner? i have some free time and would love to spend on what you do.
@John Hammond
Which RAT do you recommend? I am using NJRat at the moment.
Also which open source Crypter do you recommend and where can I get it from? Need to undetected on Windows 10/WinDefender/AV
unironically says updog
John: oo, I've found a python bat deobfuscator in the obfuscated code, neat!
Also John: _proceeds to manually deobfuscate the code anyway_
there was only an obfuscator and no deobfuscator...
the variable names at 16:25 made me laugh because they are what i use when im testing something and need a quick variable name
poggers
What's updog?
Also, why do you use separate 'cd' commands in cmd?
'cd Desktop/batch' works fine too, cd takes a relative path.
39:43 malware analyst moment
nah, "did i just dox my[self/company]?" moment
Very interesting stuff mah gai
Crazy crazy stuff here :)
Port 9001 is commonly used on TOR. Perhaps that's why you did not find clear host destination.
the base64 strings are probably aes encrypted then base64 encoded so it's printable, and the random next network stuff got me thinking of fast flux dns resolution to connect to a C2C server that keeps changing it's dns. maybe, maybe not i just though id share my thoughts, nice video as usual :) quite interesting piece of malware
I can't remember, are these samples available for us to practice along with the video?
HOHN JAMMOND - see I obsfucated his name ;) Classis substitution cipher technique that even the most recent malwares deploy.
Hi Chris 👋 I hope my comment didn't sound as a form of privacy invasion your comment tells of a wonderful woman with a beautiful heart which led me to comment I don't normally write in the comment section but I think you deserve this complement. If you don’t mind can we be friends? Thanks God bless you….
whhhaaaattt batch obfuscationnnn !
youuu shinanigenssss
Hey John I wanted to ask this which course are you studying from for your malware analysis?
you should run part of code to get the output encoded strings
dear john hammond are you using ubuntu or linux in general as full time like a daily driver ?
babe wake up, new malware analysis video
" i didn’t write it down " john forgets he’s recording 🤣
That is pretty cool
"That did not like ... whatever was happening." 😂
At 44:40, when you looking at the base64 stuff.. They call an other method with the result of base64, and after changing the Encoding. Thats prolly why only getting the base64 from the string didnt do a lots for you. I guess...
13:54 THE CLS IS THERE BECAUSE ITS ECHO OFF NOT @ECHO OFF
how can I start doing stuff like this? IS there a site that has a path for reverse engineering like this?
Would you be willing to share the decoded sample? I know it's been a while since you made this video. I used to RE malware at my previous position and was curious if I might be able to.
Would be good to investigate which protocol connects to the IP address. Obviously that address is stored somewhere in the encrypted data, including the port. Reverse shell lets the computer at the other side control your computer. What if the process could be reversed? Now you have the IP address, their reverse shell server has to be exposed to the public somehow. Anyway, it would be good to report for authorities.
I'm curious, this obviously takes a lot of time to write, and to implement, with a lot of skill,
what do they get out of it?
where is the profit?
Is it just to take over someone's computer? Or are they after doing more once they have control?
Could that be just the .length method to define the C2 IP by octets?
I dont know if im going crazy but I can't find your resume video anymore haha
How that thing is supposed to work? Do people generally use an administrator account with UAC turned off?
39:43 I was like... is he ok?
Did YOU figure it out as ASYNCRAT or was it windows defender that did the heavy lifting here?
How do you know all these things? What course do you learn ?
54:41
" ॐ ख "
🤣🤣🤣
Please do videos on PE malware analysis.
HE IS BACK IN BLACK
Damn!!
15:13 yes it does
set name = whatever 123 variable
echo %name %