Hacker's Gave me a Game and I Found a Virus

A hacker put malware on a Discord server that I hang out on, so naturally I downloaded it to see what it did. Instead of just running the software, I tried to reverse engineer it to get a peek underneath the hood at the assembly and see what was going on. I quickly found out there was MUCH more than what meets the eye with this malware.

🛒 GREAT BOOKS FOR THE LOWEST LEVEL🛒

🏫 COURSES 🏫

🔥🔥🔥 SOCIALS 🔥🔥🔥

[acuifex]

Now imagine what's it like for malware researchers. You go trough all of those hoops every day, just to find out that it's an xmr miner

[SpeckyYT]

The creativity of the hacker to just name the game as an already existing one

[billigerfusel]

I could enjoy a 30 minute video on this topic.

[bitfun]

Might not have been the hack of the century, but still interesting to learn what they were attempting to do. Could maybe do a video in the future trying to dig into it a bit more? Maybe even an overview on how to write a deobfuscator? Would be neat

[KunningFox]

1:26 Looks like the malware maker uses Sprinthost's technical domain to host the virus. The subdomain is the username of the client. It might be a good idea to inform the hosting provider that one of their clients uses their servers for malicious purposes. The clients must provide the scan of their passport (or other documents if it's a legal entity) in order to use their services.

[shimadabr]

A longer video explaining the intricacies of your discovery process would be awesome.

[ZarkWiffle]

A friend of mine got hit with a similar scheme but this one stole passwords and other data from chromnium browsers. Once I found the malwares put requests I may or may not have uploaded a few hundred fields of fake generated data into their server.

[fwilhe]

Nice. Tell us more about the sandbox tool at 1:45. Is that something I should know about? I was expecting a VM, is this some wrapper for a (cloud?) VM? What considerations do you make before running sketchy binaries to avoid them breaking out of the sandbox and affecting the host system?

[heroclixrz]

Would be good to explain in as much detail as possible what steps you take to ensure a virus will not be run on your main machine and will definitely be isolated to the sandbox of your choice. Don't want a random 14 year old feeling invincible, only to get their mom's laptop pwned because they don't know how to put a VM in the DMZ.

[TowelPanel]

FYI, the first stage is called a dropper because it downloads/drops malware from another computer onto yours

[CallousCoder]

“I just ran it” and that actually is often the easier thing to do. Because some code can indeed be hellishly obfuscated or even compressed and/or encrypted and to reverse engineer that can take ages. Just running it, whilst having wireshark logging and memory dumping the data segments and on Linux I live to run strace or Solaris truss as well. And see what kernel calls with what data are done.
Now I never reversed engineered malware but mainly copy protection and old unsupported software (statue of limitations has passed 😂), or create cheats in games (a lot of that on this channel too) and debug unsupported code that still ran (and probably still is).

[Rottenham]

It would be great to see a detailed video on how you reverse engineered this. You speak through your process so casually when it’s actually super impressive stuff you’re doing that I’m sure a lot of us would like to better understand

[khalilovitch_]

Great video, I would enjoy a detailed explanation of your approach to reverse engineer the binary

[jumanji]

This is really interesting, the entire idea of reverse engineering and looking for those hard coded urls and files is really smart.

I’d love to see a course on decompiling executables and understanding their purpose.

Happy new year!

[vyldim]

0:33 Folders named \Cryptor\Loader runpe huh? Really subtle hacker, reaaaaly subtle

[NutflX]

i almost fell for this a few months ago

but the part that made it believeable was it from one of my friends hacked accounts. and he was developing a basic platformer so i didnt think twice about it.

i only realised once a cmd opened and discord restarted to the login page.

[superswords]

There are a lot of good malware reversing researchers here on youtube. Many don't like to/are not capable of jumping into IDA. This is great!

[chadengineer]

Nice video, you should do more videos about this IDA tool, it's really interesting

[billyjoejimbob]

That's funny. Always wondered why nobody ever took my old DOS screensavers back in the 90s. Then I realized they thought everyone on the internet was out to get them.

[Littlefighter]

I've received a very interesting malware once, that was a Java file, but all classes and functions were renamed to sound like they were part of a game.
(Like "Map", "House", "Inventory", etc.)
But if you looked into the classes you could see by the behavior that this wasn't a game at all.

So be careful when trying to assume things from using string.
Some madman might have been smart enough to just rename everything.