They Say This Malware is INSANE

WATCH MORE:

🔥YOUTUBE ALGORITHM ➡ Like, Comment, & Subscribe!

[GodDamnitTwitch]

the word "kindly" is like a dog whistle to me lol

[likebot.]

the clue is in the wording "... we _kindly_ request..."

[godliestous]

It's sooo interesting to watch these kind of videos where you reviewing the source code and see how malwares behave on infected hosts

[technikschaf]

"loosing a little bit of street cred" ? With a lot of luck there is a little bit left thanks to you at least recognising it as lotr.
Thanks for taking us with you at this journey there and back again.

[edwardfildes]

You'd think anyone with the technical know-how to run JS files would also find the request to run one from IT highly suspicious.

[ChemicalShots]

All of this malware would be stopped easily with true zero trust.

[ftjemc]

Neat video. Yes. Yes you loose nerd cred for not knowing LoTR.

[MultiDark]

Even though I could see the info on screen, I was still w8ing for John to say LTT. 😂😝

[draconic]

Seems someone is a Lord of the Rings fan lol. Finding Middle-Earth, bringing the god of everything Eru and then using the Palantir to get into Gondor haha!

[fdert]

Great education here digging into IDA. I'm just getting into this field and this is very helpful to see your process, thank you!

[ismayonnaiseaninstrument]

This is probably the first in-depth digital forensics video I've sat around and watched, and honestly...thanks! I learned a helluva lot, and I'll be experimenting with those debug tools myself... (once I have a stronger foundation in assembly, mind you.)

[shodannonymous]

I'm probably gonna try this box with your guide, thanks as always John

[Rostol]

windows pro includes a secure isolated ephemeral VM, it's called Sandbox. it's awesome for testing things. Also a good tip if using VMs is to take snapshots between steps, just in case ... lol.
35:46 it's reading the resource table on the .dll, not the .exe that's probably why the entropy was meh in the .exe resourrces

[threeMetreJim]

Not too bad at all. The insane rating was about right if you've never done this before. Be prepared for layers of obfuscation (in the scripting parts) in real malware, just to frustrate even more. Nice to see this test also having an encrypted part to extract.

[logiciananimal]

Nicely done - I didn't know IDA Free had a debugger. I don't do much RE, I guess.

[hckhlp]

If we weren't already aware, the "WinHTTP" autofill in IDA shows you've prepared this walkthrough which is fine, but I for one would find exponentially more value in the footage of you when you're first running through it. Because to see how you go about figuring shit out when things don't work as you would expect them to would be a lot more informative imo.

[noamrozen]

Amazing video!! Keep up with the hard work

[jesperwall]

Is this a 57 minute commercial? Been to many of those lately, and I don’t want to waste my time.

[mitospha]

Pretty cool demo, thank you. That was rated insane? Some sites I think would honestly rate that as Medium out of easy, medium, hard. Not all CTF sites are the same I guess.

[AUBCodeII]

Hey John, let's get OSEE+ right the flipp now