Async RAT - Batch Obfuscation
ฝัง
- เผยแพร่เมื่อ 9 ม.ค. 2022
- Check IPinfo online and sign up for free exploring any IP address you would like! ipinfo.io/
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/johnhammond010
E-mail: johnhammond010@gmail.com
Discord: johnhammond.org/discord
Twitter: / _johnhammond
GitHub: github.com/JohnHammond
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/get-kite/?... (disclaimer, affiliate link)
![BOWKYLION - เจ้านายคะ (work-life imbalance) [Official MV]](http://i.ytimg.com/vi/6bFj8G2pOi4/mqdefault.jpg)
The Chinese chars is due to the first two characters in the script, it makes editors think its UTF-16 and thus messes up all the characters. While cmd.exe has no issue processing it.
thats a neat trick
this is exactly what my guess was.
I did not know this. Sounds fun
Wow.
Tu fu fuf fufu CHINA wuhan bat virus NIH ECOHEALTH LAB LEAK
Tbh not boring at all. As an engineer who seems to write more in word, excel and PowerPoint nowadays, I love to have your longer videos playing in the background while working. Much love from Berlin ❤️
One more in Berlin ❤️
2 more*
@@SpaceCatCat still just 2
Wasn't boring at all, watching you do your thing. I did learn a few new tricks today!
Awesome video! Just getting into programming and it's inspiring to see whats possible. I loved being able to see into your investigatory mind and thought processes as you faced problems
Thank you John, we definitely need such so detailed videos about malware! So interesting, so useful!
Excellent John! Not one bit boring man - thanks for all you do!
I absolutely love these! Please don't stop doing them
I've waited for another one of these to come out very patiently. Worth it.
I love the long format vids. Even when they’re old, I feel like I’m talking with you.
You the best, John! It was neither boring nor too quit or anything. Had a blast as always!
Wow this was incredibly entertaining and educational, I can't believe youu were worried that it would be boring! I really hope you make more videos like this, seriously! This is really exciting to watch (as sad as that sounds haha). Would love to make a career out of this sort of analysis.
I had been following many youtubers for years but after finding your channel I don't even need to do it no more. your stuff is just crazy.
Love it! really enjoy watching your malware analysis👍
Hey John, thanks for the video! You probably noticed by now but at 44:48 you missed the function call to KnqbWpjtoveF around the base64 string, which is probably an AES-256 decode on the string and the reason why you were not able to base64 decode them.
Ah, great thing I read your comment. I can alteast now abandon this.
Amazing. Never seen anyone break down malware before. very cool & smart.
unless he's doing a CTF most of his content is a break down of malware.
Thanks for making these videos John.
Great video! I love these deep dives.
amazing video! always loved your work!
I really liked this video, I've been trying to get into stuff like this and you help :D ty and pls keep doing this!
wow...amazing video...Thanks a lot for all this knowledge shared with us.
Thank you! Just following along. Reminded me of some weird things from yrs ago.
John always the best reverse engineer
"That's not bat! That's not BAT!" while you looking a bunch of Chinese characters made my day! nice video 👍
@Not Convinced 🤣🤣 Lol man
As pointed out before, the whole trick relies on setting UTF bits at the start of the file, making the text editor assume it UTF-16 or (8). You can get around this very easily by enforcing a specif encoding (before or after) opening the file. The editor I use (UltraEdit) can do this very easily and I assume most other (advanced) text editors can do the same. So this is not really a very effective obfuscation. The setting of the R variable and then using letters from it in the code is much more effective in my opinion. While easily turned back into valid commands by a PC, a raw text analysis will not find anything there.
This is such a rich content, not boring at all !
Sick video ! More like this please ! :)
ALWAYS great contents!!!
You and Mr. Bombal are my inspiration!
This is it, the wait has finaly come to an end.
it's night time here as well, watching as I sip my coffee ☕
I love that TH-cam bitrate compression when he is looking at the obfuscated Chinese bat file
thnx men, you are great, gave me a bunch of ideas
Thanks a lot John, i learned some new tricks
This was riveting to me. Seeing this process in real-time from A → Z as you yourself figure it out is the most educational way this could’ve possibly been conveyed (to me). Thanks!
Good Stuff John!!
adhd normally does not let me sit through such long videos without getting bored. i was sad when this video ended
Waww , really hilarious , you are on another level . U r the best . Hope i'll reach this level .
I have to wake up in 7 hours. Make that 6 now.
I love this content. I actually want to just jump into doing stuff like this myself
Can't wait for this video
Most underrated yt channel. Love the videos, man! ❤
Dude, how can you talk for pretty much an hour straight and say you were quiet? Amazing, very fun.
I'm starting to learn Linux because of you :) I'm a little bit old (almost 30 now), and idk why but going thru the command line reminds when I was a kid with the new and hot windows 98. The whole experience is new to me.
"I hate this part of the video" 😂 John at his best 😂, nice content 👌🙏
This was intersting, watching whole hour.
You keep saying "Echo" and my Alexa is set to respond to Echo and she's freaking out lmao xD
That's some wicked poor lol great vid thanks man. Audio fine
I like the fact that he is also experimenting in his video, and is not straight up tutorial video.
Nice video Hammond
Very entertaining episode
Sleepytime Malware Analysis is my favorite ASMR channel on TH-cam
You could go to *Preferences* > *Network* > Click the plus icon on the right side of the window. In your virtual machine settings you could set the network interface to "NAT Network". Do this so that you don't have to bridge to your *real* network.
Please Give us more of such unedited videos
Hey John, thanks so much for the content, quality was just fine - also ty for the ipinfo ad! I saw the video yesterday and actually had a great use case for the API just today at work for some attack analysis lol.
Btw just wondering, how would one go about sending you a "juicy file"? Someone sent me a very obvious Node.JS RAT from a compromised discord account pretending to be a game, and thought this could be interesting for you, looks pretty powerful.
You can dm it to him on Discord
Pooth.
Btw %0 is the file being executed in batch and %~F0 will expand to the full path of the file
As I have taught myself many things in life I hope to some day be able to write software and disassemble software.. I remeber buying c++ books when I was a kid but It never got my attention.. Hopefully soon I will possess this knowledge I just don't know where to start.. It so cool how all that code was hidden in a little batch file...
50 minutes:
This is the same code pattern as seen in your snip3 crypter/Rat video. (about an hour in).
Essentially it first decodes the base64 string. Then uses the WF function to decrypt the decoded strings.
it's amazing videos. thx for it
I came across a batch file with Chinese in it once, all i had to do was change the character encoding in sublime text and it fixed it
Not boring at all. Finished the video without skipping.
Fascinating bat file.
Find someone who loves you as much as John loves his malware
very interesting video ! learnt a lot as I'm not used to Windows stuff. anyway do you plan making videos about SANS hhc 2021 ? Would be interesting by comparing our different approaches
whhhaaaattt batch obfuscationnnn !
youuu shinanigenssss
Crazy crazy stuff here :)
Note that K. only detects the origina because it is obsfucated batch, not anything more specific.
the variable names at 16:25 made me laugh because they are what i use when im testing something and need a quick variable name
poggers
John: oo, I've found a python bat deobfuscator in the obfuscated code, neat!
Also John: _proceeds to manually deobfuscate the code anyway_
there was only an obfuscator and no deobfuscator...
the base64 strings are probably aes encrypted then base64 encoded so it's printable, and the random next network stuff got me thinking of fast flux dns resolution to connect to a C2C server that keeps changing it's dns. maybe, maybe not i just though id share my thoughts, nice video as usual :) quite interesting piece of malware
Very interesting stuff mah gai
Love the video as i am a recovering addict and looking in to going in to it not sure which part yet looking at a little of everything any advice on where to start as a novist/ beginner thanks for the video
" i didn’t write it down " john forgets he’s recording 🤣
i know nothing about what he does but very interesting to watch for sure. i try to put things in order in my mind but still don't understand anything. what does that thing do, how can he know all this thing and etc.
hey john i wonder where do you think i should start as complete beginner? i have some free time and would love to spend on what you do.
That is pretty cool
babe wake up, new malware analysis video
I can't remember, are these samples available for us to practice along with the video?
@John Hammond
Which RAT do you recommend? I am using NJRat at the moment.
Also which open source Crypter do you recommend and where can I get it from? Need to undetected on Windows 10/WinDefender/AV
unironically says updog
HOHN JAMMOND - see I obsfucated his name ;) Classis substitution cipher technique that even the most recent malwares deploy.
Hi Chris 👋 I hope my comment didn't sound as a form of privacy invasion your comment tells of a wonderful woman with a beautiful heart which led me to comment I don't normally write in the comment section but I think you deserve this complement. If you don’t mind can we be friends? Thanks God bless you….
39:43 malware analyst moment
nah, "did i just dox my[self/company]?" moment
What's updog?
Also, why do you use separate 'cd' commands in cmd?
'cd Desktop/batch' works fine too, cd takes a relative path.
"That did not like ... whatever was happening." 😂
Port 9001 is commonly used on TOR. Perhaps that's why you did not find clear host destination.
At 44:40, when you looking at the base64 stuff.. They call an other method with the result of base64, and after changing the Encoding. Thats prolly why only getting the base64 from the string didnt do a lots for you. I guess...
you should run part of code to get the output encoded strings
Would be good to investigate which protocol connects to the IP address. Obviously that address is stored somewhere in the encrypted data, including the port. Reverse shell lets the computer at the other side control your computer. What if the process could be reversed? Now you have the IP address, their reverse shell server has to be exposed to the public somehow. Anyway, it would be good to report for authorities.
dear john hammond are you using ubuntu or linux in general as full time like a daily driver ?
I dont know if im going crazy but I can't find your resume video anymore haha
Would you be willing to share the decoded sample? I know it's been a while since you made this video. I used to RE malware at my previous position and was curious if I might be able to.
Could that be just the .length method to define the C2 IP by octets?
Please do videos on PE malware analysis.
how can I start doing stuff like this? IS there a site that has a path for reverse engineering like this?
How that thing is supposed to work? Do people generally use an administrator account with UAC turned off?
13:54 THE CLS IS THERE BECAUSE ITS ECHO OFF NOT @ECHO OFF
39:43 I was like... is he ok?
Hey John I wanted to ask this which course are you studying from for your malware analysis?
sick
I'm curious, this obviously takes a lot of time to write, and to implement, with a lot of skill,
what do they get out of it?
where is the profit?
Is it just to take over someone's computer? Or are they after doing more once they have control?
One thing you could have done is write a script to parse the file for %r:N,n (case insensitive) and replace the matches with the correct value in the seed value
HE IS BACK IN BLACK
I’m confused of those %%r:~-15
So can someone explain, wth are those
👍!
Defender still doesn't have self defense in 2022?
Subbed btw