Async RAT - Batch Obfuscation

Check IPinfo online and sign up for free exploring any IP address you would like! ipinfo.io/
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/john...
E-mail: [e-mail]
Discord: johnhammond.or...
Twitter: / _johnhammond
GitHub: github.com/Joh...
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/g... (disclaimer, affiliate link)

[@liminal548]

The Chinese chars is due to the first two characters in the script, it makes editors think its UTF-16 and thus messes up all the characters. While cmd.exe has no issue processing it.

[@theimperious1]

thats a neat trick

[@sangamo38]

this is exactly what my guess was.

[@SadKris]

I did not know this. Sounds fun

[@rdil]

Wow.

[@andrewjehen5910]

Tu fu fuf fufu CHINA wuhan bat virus NIH ECOHEALTH LAB LEAK

[@dinoscheidt]

Tbh not boring at all. As an engineer who seems to write more in word, excel and PowerPoint nowadays, I love to have your longer videos playing in the background while working. Much love from Berlin ❤️

[@alexvidal821]

One more in Berlin ❤️

[@SpaceCatCat]

2 more*

[@paydayvideos4924]

@@SpaceCatCat still just 2

[@Bobtb]

Wasn't boring at all, watching you do your thing. I did learn a few new tricks today!

[@mytube7473]

Amazing. Never seen anyone break down malware before. very cool & smart.

[@davidmiller9485]

unless he's doing a CTF most of his content is a break down of malware.

[@ivanboiko8975]

Thank you John, we definitely need such so detailed videos about malware! So interesting, so useful!

[@trapOrdoom]

I love the long format vids. Even when they’re old, I feel like I’m talking with you.

[@andydataguy]

Awesome video! Just getting into programming and it's inspiring to see whats possible. I loved being able to see into your investigatory mind and thought processes as you faced problems

[@NotFab]

Hey John, thanks for the video! You probably noticed by now but at 44:48 you missed the function call to KnqbWpjtoveF around the base64 string, which is probably an AES-256 decode on the string and the reason why you were not able to base64 decode them.

[@TagnumElite]

Ah, great thing I read your comment. I can alteast now abandon this.

[@MygenteTV]

I had been following many youtubers for years but after finding your channel I don't even need to do it no more. your stuff is just crazy.

[@BIGAPEGANGLEADER]

Wow this was incredibly entertaining and educational, I can't believe youu were worried that it would be boring! I really hope you make more videos like this, seriously! This is really exciting to watch (as sad as that sounds haha). Would love to make a career out of this sort of analysis.

[@applePrincess]

"That's not bat! That's not BAT!" while you looking a bunch of Chinese characters made my day! nice video 👍

[@bobmars8771]

@Not Convinced 🤣🤣 Lol man

[@LordRaven256]

As pointed out before, the whole trick relies on setting UTF bits at the start of the file, making the text editor assume it UTF-16 or (8). You can get around this very easily by enforcing a specif encoding (before or after) opening the file. The editor I use (UltraEdit) can do this very easily and I assume most other (advanced) text editors can do the same. So this is not really a very effective obfuscation. The setting of the R variable and then using letters from it in the code is much more effective in my opinion. While easily turned back into valid commands by a PC, a raw text analysis will not find anything there.

[@chrisclark5135]

Excellent John! Not one bit boring man - thanks for all you do!

[@Endzeitpanda]

You the best, John! It was neither boring nor too quit or anything. Had a blast as always!

[@readypubggo5650]

This is it, the wait has finaly come to an end.

[@Kurowe.]

You keep saying "Echo" and my Alexa is set to respond to Echo and she's freaking out lmao xD

[@Harrowthe12]

I've waited for another one of these to come out very patiently. Worth it.

[@debarghyamaitra]

John always the best reverse engineer

[@kajoma1782]

You could go to *Preferences* > *Network* > Click the plus icon on the right side of the window. In your virtual machine settings you could set the network interface to "NAT Network". Do this so that you don't have to bridge to your *real* network.

[@wnathanielw]

I absolutely love these! Please don't stop doing them

[@ambrosiahasnevertastedthis3673]

adhd normally does not let me sit through such long videos without getting bored. i was sad when this video ended

[@victorcascallar6745]

Dude, how can you talk for pretty much an hour straight and say you were quiet? Amazing, very fun. I'm starting to learn Linux because of you :) I'm a little bit old (almost 30 now), and idk why but going thru the command line reminds when I was a kid with the new and hot windows 98. The whole experience is new to me.

[@Ged325]

50 minutes: This is the same code pattern as seen in your snip3 crypter/Rat video. (about an hour in). Essentially it first decodes the base64 string. Then uses the WF function to decrypt the decoded strings.

[@jackchan5635]

Love it! really enjoy watching your malware analysis👍

[@albertsaeznunez8875]

I love that KZbin bitrate compression when he is looking at the obfuscated Chinese bat file

[@ByteBurstShorts]

I like the fact that he is also experimenting in his video, and is not straight up tutorial video.

[@jacklee1612]

This is such a rich content, not boring at all !

[@csongorszecska]

Pooth. Btw %0 is the file being executed in batch and %~F0 will expand to the full path of the file

[@jimvincentmartinez7485]

Not boring at all. Finished the video without skipping.

[@MisterK-YT]

This was riveting to me. Seeing this process in real-time from A → Z as you yourself figure it out is the most educational way this could’ve possibly been conveyed (to me). Thanks!

[@JustSomeAussie1]

I came across a batch file with Chinese in it once, all i had to do was change the character encoding in sublime text and it fixed it

[@tecra3toshiba149]

Thank you! Just following along. Reminded me of some weird things from yrs ago.

[@Autokey_Security_Services]

As I have taught myself many things in life I hope to some day be able to write software and disassemble software.. I remeber buying c++ books when I was a kid but It never got my attention.. Hopefully soon I will possess this knowledge I just don't know where to start.. It so cool how all that code was hidden in a little batch file...

[@CJMAXiK]

John: oo, I've found a python bat deobfuscator in the obfuscated code, neat! Also John: _proceeds to manually deobfuscate the code anyway_

[@user-zt5bq9tf2z]

there was only an obfuscator and no deobfuscator...

[@daleryanaldover6545]

it's night time here as well, watching as I sip my coffee ☕

[@Intuitronix]

Great video! I love these deep dives.

[@qqb0t]

Sick video ! More like this please ! :)

[@yassinebellal1671]

Thanks a lot John, i learned some new tricks

[@b.tulsirao7724]

wow...amazing video...Thanks a lot for all this knowledge shared with us.

[@laurenlewis4189]

Sleepytime Malware Analysis is my favorite ASMR channel on KZbin

[@CrowTheArchfiend]

I have to wake up in 7 hours. Make that 6 now. I love this content. I actually want to just jump into doing stuff like this myself

[@sordavie]

Thanks for making these videos John.

[@moom8254]

amazing video! always loved your work!

[@logiciananimal]

Note that K. only detects the origina because it is obsfucated batch, not anything more specific.

[@Yuki-bk2my]

the variable names at 16:25 made me laugh because they are what i use when im testing something and need a quick variable name

[@joefawcett2191]

poggers

[@alnoiseplaysmc]

Find someone who loves you as much as John loves his malware

[@Deathyss]

At 44:40, when you looking at the base64 stuff.. They call an other method with the result of base64, and after changing the Encoding. Thats prolly why only getting the base64 from the string didnt do a lots for you. I guess...

[@Alex-nq5nz]

You and Mr. Bombal are my inspiration!

[@notafurrysogoaway]

What's updog? Also, why do you use separate 'cd' commands in cmd? 'cd Desktop/batch' works fine too, cd takes a relative path.

[@brock_-1542]

39:43 malware analyst moment

[@johnpathe]

nah, "did i just dox my[self/company]?" moment

[@user-ll8hy1lv5l]

thnx men, you are great, gave me a bunch of ideas

[@froststorm77]

This was intersting, watching whole hour.

[@gnastyg7798]

Good Stuff John!!

[@lucien5112]

unironically says updog

[@chrisbitus1328]

HOHN JAMMOND - see I obsfucated his name ;) Classis substitution cipher technique that even the most recent malwares deploy.

[@maryalison1321]

Hi Chris 👋 I hope my comment didn't sound as a form of privacy invasion your comment tells of a wonderful woman with a beautiful heart which led me to comment I don't normally write in the comment section but I think you deserve this complement. If you don’t mind can we be friends? Thanks God bless you….

[@TealTunic]

Most underrated yt channel. Love the videos, man! ❤

[@trunovmichael]

Port 9001 is commonly used on TOR. Perhaps that's why you did not find clear host destination.

[@Trezc0]

Hey John, thanks so much for the content, quality was just fine - also ty for the ipinfo ad! I saw the video yesterday and actually had a great use case for the API just today at work for some attack analysis lol. Btw just wondering, how would one go about sending you a "juicy file"? Someone sent me a very obvious Node.JS RAT from a compromised discord account pretending to be a game, and thought this could be interesting for you, looks pretty powerful.

[@lightningdev1]

You can dm it to him on Discord

[@viat8711]

it's amazing videos. thx for it

[@gigabitestudios]

at 49:02 it get the lenth of one and it it deosent have .length its 0 (.len = 1, no .len = 0)

[@amirmohamed8748]

Waww , really hilarious , you are on another level . U r the best . Hope i'll reach this level .

[@paxdriver]

That's some wicked poor lol great vid thanks man. Audio fine

[@viv_2489]

"I hate this part of the video" 😂 John at his best 😂, nice content 👌🙏

[@sylvainrocca-serra3402]

the base64 strings are probably aes encrypted then base64 encoded so it's printable, and the random next network stuff got me thinking of fast flux dns resolution to connect to a C2C server that keeps changing it's dns. maybe, maybe not i just though id share my thoughts, nice video as usual :) quite interesting piece of malware

[@LinuxJedi]

" i didn’t write it down " john forgets he’s recording 🤣

[@MrRobertX70]

Fascinating bat file.

[@krokodaun]

15:13 yes it does set name = whatever 123 variable echo %name %

[@sendlocation8476]

@John Hammond Which RAT do you recommend? I am using NJRat at the moment. Also which open source Crypter do you recommend and where can I get it from? Need to undetected on Windows 10/WinDefender/AV

[@albaniaiptv8335]

you should run part of code to get the output encoded strings

[@TheJustinist]

One thing you could have done is write a script to parse the file for %r:N,n (case insensitive) and replace the matches with the correct value in the seed value

[@RandomytchannelGD]

13:54 THE CLS IS THERE BECAUSE ITS ECHO OFF NOT @ECHO OFF

[@ishaankapoor933]

Please Give us more of such unedited videos

[@bobbychingchang8811]

Can't wait for this video

[@Alex-nq5nz]

ALWAYS great contents!!!

[@googleuser298]

how can I start doing stuff like this? IS there a site that has a path for reverse engineering like this?

[@gregoryjones4539]

Love the video as i am a recovering addict and looking in to going in to it not sure which part yet looking at a little of everything any advice on where to start as a novist/ beginner thanks for the video

[@sioonhho]

babe wake up, new malware analysis video

[@willk7184]

"That did not like ... whatever was happening." 😂

[@lfcbpro]

I'm curious, this obviously takes a lot of time to write, and to implement, with a lot of skill, what do they get out of it? where is the profit? Is it just to take over someone's computer? Or are they after doing more once they have control?

[@kQle]

Very interesting stuff mah gai

[@hoodmanager]

Try using dnSpy instead of IlSpy, it's way better!

[@Lei_Wong]

Very entertaining episode

[@iddqds]

i know nothing about what he does but very interesting to watch for sure. i try to put things in order in my mind but still don't understand anything. what does that thing do, how can he know all this thing and etc. hey john i wonder where do you think i should start as complete beginner? i have some free time and would love to spend on what you do.

[@CZghost]

Would be good to investigate which protocol connects to the IP address. Obviously that address is stored somewhere in the encrypted data, including the port. Reverse shell lets the computer at the other side control your computer. What if the process could be reversed? Now you have the IP address, their reverse shell server has to be exposed to the public somehow. Anyway, it would be good to report for authorities.

[@Jm7wtf]

I’m confused of those %%r:~-15 So can someone explain, wth are those

[@aksvan]

Please do videos on PE malware analysis.

[@_hackwell]

very interesting video ! learnt a lot as I'm not used to Windows stuff. anyway do you plan making videos about SANS hhc 2021 ? Would be interesting by comparing our different approaches

[@Vaampz]

You do not need to make such faces to get views. you are better than that.

[@aksvan]

lmao

[@owenswabi]

Soyface need not be applied

[@ytg6663]

@@AG-ur1lj where is it wtitten ?? how ca you say that ??

[@astralgames5535]

He does what he wants

[@greyburns6170]

I only watched this video because of the face he made

[@user-em2kf6ff4v]

?Need a Tutor in this field so that I can get a walk through. I just enrolled in Salem University???

[@azizutkuozdemir]

whhhaaaattt batch obfuscationnnn ! youuu shinanigenssss

[@torf1746]

why do they keep writing malware in C#? wouldn't it be way harder to detect and reverse-engineer in C++?

[@stefanscicluna2799]

Defender still doesn't have self defense in 2022? Subbed btw

[@shepardcd]

Hey its the silentclean UAC bypass at 25min

[@bobnoob1467]

I dont know if im going crazy but I can't find your resume video anymore haha

[@Jonas-qr8mn]

What I think would be cool is looking up a obviously fake hack and tearing it apart to see how its made

[@MrPing-jh4tl]

Nice video Hammond

[@IkarusKommt]

How that thing is supposed to work? Do people generally use an administrator account with UAC turned off?

[@eanglyroeurn8255]

Passed any cert from him such ejpt ecppt and oscp 😍😍

[@TalkL3ss]

Y don't you pip the output of the echo to clip, it will be much faster

[@constroyanonymous7830]

Hey John I wanted to ask this which course are you studying from for your malware analysis?

[@sorry7704]

Hey mr Hammond, have you ever omg mr Hammond you have to meet my friend skittles at apple, He’s amazing he use to be a hacker for the navy he taught all over the place

[@sorry7704]

You two would love each other. Your 2 brains would launch cyber security into the next dimension. Also bionic chips.. rofl poor Siri is hackable just by teaching the bionic chil dyslexia and I changed Siri name to Alexa it’s hilarious