Somebody emailed me a trojan virus

[@bogxd]

Also, I just realised that you can reduce email spam by around 70-80% by scrolling back up to SMASH the like button

[@ChumBucketlNC]

Hello. I eat rats. Are you a rat?

[@TheDragoPenguin]

bet

[@mand4lex]

💯

[@soggybicycle]

real!!

[@llliiimmmeee]

It worked

[@M249-z2s]

This turned from a video about viruses to an virtual box ad.

[@vaakdemandante8772]

more like a Windows installation tutorial, which is crazy because the OS installer should not require one

[@sspnlgaming7844]

thats the point

[@JmKrokY]

🗿

[@Manny73211]

they deserve the promo

[@laupoke]

That's not the type of tool that would make any sense being advertised on youtube

[@billyjhamlin]

Congratulations on getting me to watch a 14 minute long ad for VirtualBox!

[@RishabhBohra13]

I live in india, Zomato is a legit company, and really big like doordash, this person is definitely pretending to be them.

[@HaryanviKashmiri]

same here, zomato doesn’t even work in europe.

[@zerokun2655]

I mean, definitely. He even showed the stock value of the company in the video, so it's real. Just like Sony Vegas is

[@flipflops99]

ya dont say?

[@Rusty01]

@@flipflops99 fr like bro saying it like it wasnt obvious they are prentended

[@asadfarraj]

It is a multinational company if I remember correctly

[@TerraGreen1]

A couple years ago I fell for one of these emails on an old channel from some one pretending to be from a mobile game. After opening it, within a few hours my channel had been converted into some fake scam uploading videos about cracked editing softwares trying to spread the trojan to my audience. It was a pain to get the channel back as pretty much all my emails had been hacked and I had no proof of even owning the channel 😂. I had to completely wipe my computer and go through tons of email recovery steps. It's crazy how they're still around, and it's a good thing you made a video about this as you probably saved at least a couple youtubers from falling for it.

[@pestznyk]

Huge fan of your channel! Hope this never happens again

[@SillyStarCat]

I remember this happened to an artist named sonadrawsstuffyt

[@zallax-07]

Can you gimme a shout-out?

[@twotruckslyrics]

@@SillyStarCatthe elon musk live streams…

[@SillyStarCat]

@@twotruckslyrics oh god

[@falxie_]

Running suspicious software in a VM helps but doesn't completely remove any risk. The virus could steal any credentials present in the VM and potentially probe at your home network if you don't have it isolated.

[@randomgamingin144p]

also often the software can detect a VM so you have to use qemu-kvm and trick it into thinking its not running on a VM, or hyper-v might work

[@phr3ui559]

are there any tutorials on this

[@phr3ui559]

@@randomgamingin144pcan you link a tutorial

[@zakariya2011_]

Uhh if you run VMware the vm's network connection will be isolated

[@redlionstudio2750]

@@randomgamingin144p or sandbox

[@DomenLo]

This part {something|something else} is actually spintax, not personalization. It randomly picks one of the options inside the squiggly brackets (separated by a pipe), making the text unique enough that it doesn't trigger spam filters. Btw - in virtualbox you could also create snapshots and revert back to one pre-test, this way you dont need to delete and re-clone the installation.

[@AmartyaAnand]

Plot twist: this whole video was a virtual box promo 🗿

[@ElishaPervezORG]

bruhhh :-:

[@sauliusvitkauskas8741]

VMware is better

[@ElishaPervezORG]

@@sauliusvitkauskas8741 Both are pretty good but still not 100% safe

[@Russian95_]

@@sauliusvitkauskas8741 true

[@TheosTechTips]

@@sauliusvitkauskas8741 No way lol. Broadcom sucks. Open-source FTW!

[@HarryDoesTech]

Nice folder called "STOP READING MY FOLDER NAMES". Gotta love that!

[@CrimesAnatomy]

Hey Bog, this is hilarious, I got a recent email just like this. You did well turning this into a video to educate people. Because I installed it and now everyone know my true identity and Gotham will never be safe again.

[@kwe_]

😭

[@MrBIizzard]

Pack it up bruce wayne

[@TimeisoutT]

@@MrBIizzard MY NAME IS THE HULK!

[@marekvojta9648]

Well i hoped for some analysis of the virus like what it steal how it works etc.

[@Mr.MessOpixels]

Gotta engage knightfall protocol now Edit: don’t forget about the 243 riddler trophies

[@JohnJacobson555]

I want you to know that this happened to my mother and I had to restart the PC from scratch and look for the programs and office keys to get it working again.

[@MarkUSAfreedom]

where did you get them?

[@JohnJacobson555]

I checked many sites and in the end I leaned towards BNH Software and in the end everything turned out well.

[@MarkUSAfreedom]

I asked you because lately I'm very distrustful of download sites

[@JohnJacobson555]

I think that's normal

[@gFamWeb]

Clarification on virtual machines: some clever viruses can detect and potentially even escape virtual machines (although the latter is rare)

[@siphovundla5057]

That is what wacatac is doing, it first scans to see if its on a VM and if it is then it wont run any further malware

[@woodcrafte_r]

I mean 6 out of 100 malware can do this. Your just better off playing the unlucky jackpot if that happens. But some people use web virtual machines

[@thmUNIX]

QEMU/KVM is rarely detected, because VirtualBox and VMware are the most popular VMs out there. btw, even in VBox & VMware you can via Registry Editor, I believe, edit sys info so that it would look like to malware that it's a real PC

[@ZarakKhan-h3j]

@@siphovundla5057 wacatac isnt even a malware lol. its the ai scanned malware.

[@dvorakgigachad1444]

@@woodcrafte_r VM escapes are very very rare and haven't happened in many years

[@nanomachines2954]

9:04 it's not "HTML". H here stands for 'heuristic' and ML means machine learning. Means this virus was detected not by checking it's signature but by scanning its behavior using machine learning (AI).

[@thelastdirewolf3587]

What it was detected with ml because it said that was the detected file

[@LocksDE]

Hey Bog if you see this, in the future DO NOT connect a ethernet cable or Wi-Fi they can infect your router.

[@norav69]

More than infecting your router they can take the public IP from the internet connection of the pc, taking public informations. Most "routers" that we use in our houses do not have any computation power and decision making capabilities, everything is done by the ISP. In general yes tho, it's better to disconnect the internet connection from a virus testing virtual machine

[@Follina.]

@@norav69 The greatest risk I see is if you have a router with the default password the malware might be able to log into it and turn on port forwarding on your devices, then send your IP to an attacker, so if you then ran a service thinking it'd only be accessible locally, you might end up exposing yourself to the internet

[@fabienso5889]

​@@norav69 Oh no they can take my PUBLIC ip whatever are they gonna do Yeah nothing that's right Network access might start becoming dangerous if you have fully unprotected devices like a camera or a washing machine on your network But let's be honnest most viruses you get are just interested in grabbing your passwords and access token

[@somedude8728]

@@fabienso5889 Can't wait for a virus to overtake random unprotected printeris

[@dvorakgigachad1444]

anyrun is a good way to do that stuff safely

[@jan_harald]

protip: don't keep cloning the machines, use snapshots! you take a base snapshot, then do shady stuff, and revert back to previous snapshot, it's pretty simple

[@biscottimuncher]

Running Procdot to capture all system changes in a network isolated environment, or even better, running it in a cloud SAAS like joesandbox could be a really cool follow up video! Following the exfiltration of whatever the bad actor/hacker wanted in a safe environment is always a blast, plus seeing what happens as a granular level is super cool! Awesome video!

[@Humtog]

Hi, I also got exact same Zomato impersonating email. Same text. And same second reply. At approx same time as you. I also realized something is off, when I saw the email itself. Then after downloading and seeing the exe file, I became sure. I did not even extract it. I think the ploy here is to get the login/password details of youtubers. Maybe possible to copy a Chrome session that has the user already logged in? I had put a hidden mailtracker in my reply to their last email. And they did not even open the mail to check what it is about!

[@Spectrulight]

3:39 my bad for reading your folder names

[@pizzaman1720]

Lol

[@JosGeerink]

I don't get it?

[@pumkin610]

​@@JosGeerink3:41

[@ZRIstruck]

My bad, too.

[@its_air7]

why is the pfp a pic of someone on the moon

[@CLOYO]

6:23 If there's spelling and grammar mistakes then there's definitely something wrong in my opinion.

[@cat_umbrella]

yeah

[@efficiencyvi8369]

As long as it is a cookie cutter trojan and windows defender is on it is no big deal. It gets dangerous when it is tailored for your device and antivirus doesn't detect it.

[@rustlr]

"Now imagine if I opened this on my actual computer, not a virtual machine." Your Windows Defender on your actual computer would have blocked and quarantined it as well.

[@Lucy-bx7si]

but windows defender will not 100% protect you from these viruses.

[@XJ9LoL]

0:29 nope, broken english = its a phish.

[@johnsilvrr]

God I had such a crush on that pfp when I was a kid

[@tylerebowers]

Booting in a VM is sure safer EXCEPT WHEN THAT VM IS CONNECTED TO THE INTERNET!

[@karmapawsnplay9701]

good thing you oppened the trojan in a virtual machine. BUT I don think you have properly isolated virtualbox! You might have to check your main desktop! it might have leaked! Be safe!

[@toreopp]

He didn't run the file. He's fine.

[@redlionstudio2750]

i think it's just some cheap stealer, so nothing to worry about

[@RealMol]

​@toreopp this is true, he ran the file on his vm. But he didn't completely isolate his vm from his host machine by disabling all network connections. Most viruses can escape the vm by hopping to the host machine through the network.

[@pancak3]

@@RealMol this is false.

[@somedude8728]

@@RealMol They aren't able to escape, they can however gain access to unprotected devices on the network.

[@Ryusakiiii]

Just realised Zomato doesn't exist in other countries. Basically it's like doordash

[@zerrrp]

3:40 love the "STOP READING MY FILE NAMES" folder 🤣🤣🤣🤣

[@Abukek133]

"theres a .pl" Ok so its Polish "Its from the netherlands"

[@vGermanK]

i was thinking the same think lol

[@vGermanK]

thing*

[@synvie-x]

as a polish person, i agree 😭

[@uzzybuzzy-t5h]

probably used a vpn

[@agateophobiaaa]

@@uzzybuzzy-t5h Polish domain (.pl) doesn't require you to have a polish citizenship. Also the information provided by WHOIS is supplied by the owner of the domain (it's whatever was used on domain's purchase), VPN has nothing to do with that.

[@smittywerbenjj1]

Windows has a optional feature called "Windows Sandbox". It does exactly what you did with your clone of a clone of a virtual machine, where it gives you a disposable virtual Windows Machine. Its pretty good & safe and doesn't use as much space as VirtualBox.

[@johnandericadventures]

"it's pretty good & safe" someone has never encountered a piece of malware not coded by a 7 year old

[@speedstyle.]

@@johnandericadventures Please do show me this malware that can escape from an airgapped Hyper-V sandbox. Would be handy for taking down Azure

[@rossberget]

5:36 whoo trojan virus ladies and mentelgen got me cracked up 😂

[@Lampe2020]

5:46 You can also create a snapshot of the VM in VirtualBox and restore it after you're done, that way you don't have to have multiple VMs.

[@mokumoki]

Regarding the unattended file, it’s a cool feature for most people as it will setup Windows for you automatically without any user interaction (hence, unattended). The reason you get the license key error is when you are adding new VM you did not add a license key. You can use KMS Generic key which you can get from Microsoft documentation and put it in during VM creation. On the other hand, if you want to set it up manually, just check “Skip unattended installation” when creating VM. *Unattended installation is quite common in most type 2 hypervisors (Virtual Machine software) like VMware Workstation and Parallels, and for most major OS, so it’s quite easy to setup a VM with minimal effort. Another few things I would like to mention is you can learn more about snapshotting in VM, so you can avoid the part where you delete and clone your VM. Also you don’t have to remove floppy to solve the mount error, it is complaining no bootable device found is because you didn’t press any key when booting from the ISO.

[@abhishek_patra_]

Bro I'm from India 🇮🇳 and Zomato is an Indian food company.... It doesn't work outside of India .... Why Zomato would promote anything outside India 😂😂 .....

[@sebastianbauer4768]

So why are they trying to trick people into installing malware on their machines? Even worse why don’t they support Linux? /jk

[@GOLDEN-z7x]

It has many services outside India

[@ashishjadhao115]

They are outside India aswell...atleast in usa and use since like 2016

[@charmingotter976rr]

so its kinda like just eat/grubhub/uber eats but in india

[@vikaspoddar001]

​@@ashishjadhao115 they have stopped operating outside india

[@FanixeyReam]

9:38 this gives "I always come back" vibes

[@JmKrokY]

7:57 Polish domain

[@KRZYSZTOFMANIA]

Chciałem napisać 😅

[@Maciurella]

nie wiem dlaczego, ale byłem przekonany, że oglądam Polski film a nie angielski, więc mnie to nie zdziwiło, czy ja już naprawdę nie odróżniam Polskiego od Angielskiego?! 😂 POLSKA GUROM 🇵🇱

[@svijj_]

POLAND MENTIONED ☝️☝️☝️☝️🦅🦅🦅🦅🇵🇱🇵🇱🇵🇱🇵🇱🇵🇱🇵🇱🇵🇱💪💪💪💪💪💪💪

[@TheRealOderless635gnat]

10:03 Fun fact: if u have windows pro version, u can use windows sandbox too

[@natjoe4763]

this stuff is fascinating, seeing how security is exploited in different ways across different operating systems. particularly in windows and how its able to regen itself. so interesting

[@Doctor_Ks]

4:33 insert vsauce music

[@aniekanabasiumoh170]

Hahaha

[@tineyperson]

DOCTOR WHOOOOOOOOOOOO

[@elbert5208]

Try opening it without windows defender turned on

[@AmartyaAnand]

💀💀

[@zerokun2655]

Virtual machines are for cowards!

[@mayoraeryn]

Could be a cool video idea if he gets some really old laptop for super cheap

[@Milkguy33]

he would get a trojan virus, nothing interesting

[@This77577]

Someone: sending an email to sponsor a company Bog: ends up sponsoring/recommending oracle virtualbox😊

[@27legend31]

Instead of cloning, you can use a snapshot to clone a vm at a point in time, so you can restore it back after running sketchy stuff

[@Volstx]

"Kindly" is scammer's favourite word

[@Trisks]

Bog when he discovers some viruses are capable of escaping Virtual Machines

[@AndRei-yc3ti]

How?

[@pastaya]

@@AndRei-yc3ti exploiting the networking

[@WindowsDestroyer]

Or some one could do just exploits with the hypervisor

[@Follina.]

​@@WindowsDestroyerIf you're thinking of exploits capable of escaping a network isolated VM, yea, no, those exploits go for millions, they ARE NOT going to be used on a YTber

[@polarrbtw]

no one is risking a 0day for a 110k youtuber

[@Riscei]

always hit up the original company and ask about the email address that you had gotten to see if its in the system :)

[@alba4k]

I almost lost my steam account to a similar scam a few days ago. Only realised there was something fishy going on before typing in the sms verification code

[@bindogaming791]

I almost lost my steam account by some person pretending to be a steam admin and that I was about to get banned. I didn’t fall for it I only gave him my email and he wanted verification code, but when I checked email to change password. Which made me suspicious. He has my email though and is that a problem?

[@that_guy1211]

you can also do this with Triage, it's what NTTS uses, and it's a website that gives you a x/10 score on how bad the malware actually is, virustotal is also a pretty good scanner

[@its_air7]

Btw NTTS Means "No Text To Speech"

[@joytech23]

When playing with viruses in a virtual machine, it's better to do it from a machine you don't care about like a home lab. Some viruses can and do escape containers. Please turn off your network adapter on the VM and any sharing features between the VM/Host. Snapshots also work better than cloning and are way faster - just make sure you restore to the snapshot every time you boot the VM. A good test box would be a linux host virtualizing Windows, and if you can nest your machines that'll also work but just remember - work like each layer you try to contain can be breached.

[@Follina.]

@@joytech23 Containers such as docker? Sure, VMs? Unless you're the target of a highly sophisticated government actor, not really.

[@joytech23]

​@@Follina. Escaping a container (VM or otherwise) in an environment that isn't well prepared is actually pretty easy.

[@Follina.]

@@joytech23 Unless it's connected to your home network there is really not much you can do

[@qingxinn_]

I'm curious about this, but I can't find any reputable sources online. Do you mind sharing any sources/how you got this information? ^^

[@genetalavera4256]

Yup I saw this happen once forgot what youtuber it was.

[@KaiCross-l5i]

OH MY GOSH. THE TWO ERRORS HE JUST GOT WHEN HE MADE THE VM WERE THE EXACT 2 THAT I GOT AND SPENT OVER A MONTH TROUBLESHOOTING AND RESEARCHING THINGS. THEN THIS ISN'T EVEN RELATED TO IT AND FIXES BOTH ERRORS IN THE SIMPLEST WAY POSSIBLE!

[@nithinsvarrier670]

From windows 11, You can use Windows Sandbox, which is essentially a VM for these files, It under the hood uses HyperV and is usually more performant than virtualbox

[@machieu]

Yeah it's just a random window that when you close it goes like bye bye

[@leafve]

I would recommend always turning off network connection from the virtual machine. As this way the malicious codes can infect your wifi and other devices connected in real-time.

"woo, trojan virus ladies and mentalgen" 🤣🤣🤣🤣

[@guxalu]

"Que gameplay incrível do novo EA FC 25, mano! 👏🔥 A forma como você controla o time é impressionante, parece até que o jogo fica mais fácil nas suas mãos! Adorei as jogadas e as finalizações, tá jogando como um profissional! Bora ver mais dessas partidas insanas! 🚀⚽

[@barnknee7847]

Man keep doing these,really loving your work so far

[@bogxd]

Cheers!

[@kylek29]

If you create a Linked Clone (this a snapshot that appears like a unique VM referencing the other) or a snapshot fork (checkpoint via the snapshot manager) you can reduce the VM's footprint by a lot. Utilizing checkpoints allows you to roll back the changes you made for the purpose of testing. Alternatively, if you enable the Hyper-V / Windows Sandbox in Windows Features, you gain access to a temporary VM clone built into Windows, it's a tad quicker to spin-up / get into, and can perform better.

[@thmUNIX]

you know what, I was more interested in the Mac version of virus in the last email as it's a bit unusual. I downloaded it, and quick check of strings showed that it's definitely a stealer. Will try to reverse it later

[@_invencible_]

yeah i thought he was going to show that one but he just showed the same windows virus twice 😒

[@thmUNIX]

Ok, I digged a bit deeper, it's something reeeally interesting. Will completely reverse it and I guess upload a video on what it is

[@thmUNIX]

well, just an upload to VT showed it's AMOS stealer (not 100% sure, maybe wrong detection & could be something different). So it seems that it's nothing incredibly new, but still interesting

[@blahblahgdp]

the immediate redflag is the sender not having zomato in the email

[@jobo_o]

W video, really smart to open the file in a virtual box :)

[@solofdragons6446]

I was not expecting the spy jumpscare lmao. Great video!

[@RZ302]

You can also just use Windows Sandbox if you got Windows 11 Pro. Maybe set up a read-only shared folder and disable vgpu and networking before messing with malware.

[@undefinedCat]

it exists on windows 10 too

[@shitpostinggang]

Bro gave us a VM tutorial for a video about addressing a scam, props to you man 🗣

[@Zeben84]

Reading the domain of the emails should have been where this video ended !

[@n0rbert79]

Thank you, was on my mind since seeing the first email.

[@downinohioswaglikeohio123]

"stop reading my folder names" bro was determined💀

[@Activation123]

vegas is NOT an editing software. it's a bad attempt at one. it was good before magix bought it 💀💀💀. Also yeah, you would have gotten an email from Magix, not ... Sony Vegas PR or whatever.

[@SenseiYasir]

You're right... It's the best one.

[@Activation123]

@@SenseiYasir uhhh no

[@FlushDesert22]

At least Vegas doesn't require a subscription to use, and a fee to unsubscribe.

[@Activation123]

@@FlushDesert22 yeah fair, I use resolve lmao. But in all seriousness, at least other softwares are stable most of the time... And dont require you pay an obscene amount every time you upgrade. Also Vegas just... Doesn't have much support anymore

[@justinhamilton8647]

It used to be great until whatever they screwed up. Anything I render on vegas either is littered with black frames or extremely pixely. Sticking with pirated premiere that runs on any machine post 2013 lol

[@IG7799-c4u]

The use of the word “kindly” should have been the first red flag.

[@yumeyamamoto]

5:37 "ladies and mental gen" ??

[@AlexanderTzalumen]

_Mentalgen_

[@Zakariaazzaim]

😂😂😂😂😂😂😂thankfully im not the only one who heard that

[@kedirabdu6913]

Probably a reference to an old TF2 meme. Where spy's famous catch-phrase is reversed.

[@bekbekovv111]

mentlegen. *proceeds to smoke guaranteed-lung-cancer-worth amount of cigarettes*

[@EpicXcake]

Meet the mentlegen

[@alijall]

I love that your videos don't have music. Very satisfying!

[@m241m]

This video basically shows that Windows Defender works great and why it should be on at least sometimes 😁😁

[@AnymMusic]

inb4 "thank you Virtual Box for sponsoring this video"

[@Einzigartigitsme]

there is inbuild windows virtual machine, which cleans everything as soon as you shut it down it is in "turn windows features on or off" and virtual machines hope it helps!!

[@teggolT]

isn't that a pro feature or sth

[@sunsetsonwheels]

Isn't it called Windows Sandbox?

[@somedude8728]

@@sunsetsonwheels I think sandbox is for Windows 11 only

[@JeanIngersoll]

When you begin to touch your heart or let your heart be touched, you begin to discover that it's bottomless.

[@onlywolf9981]

Windows: We have a sandbox preconfigured, optimsed and ready to use at any moments Bog: I rather use a 3rd party software with all the disadvantages 😭😭😭😭

[@itsshypixels]

Friendly reminder doing this on a VM is always still risky. Some malware exploits bugs in the virtual machine to infect your main computer.

[@rfr3fr3fr3fr3f]

7:30 POLAAAANDDDDDD RAAAAAAAAAAAAHHHHHHHHH!!!!

[@yagoonek]

yea

[@TensaZanota]

even if it was an ad it is the best ad , i already use this application from time to time , but instead of some simulating montage you gived us a big lesson

[@BlurryTheDogLover]

Once someone dmed me on Discord, tried to get me to go on a SCAM Roblox website and join their group for “free robux” (they didn’t have any group funds.) And I knew it was a scam, because 1. I was logged out. 2. The Roblox logo was swapped with the charts button.

[@unnamed_fruit8]

Free robux in general is already a huge red flag

[@BlurryTheDogLover]

@@unnamed_fruit8 nah group funds is real

[@BlurryTheDogLover]

@@unnamed_fruit8but still I agree

[@Streiyfer]

First off, this is a super awesome video. And second, I truly believe that vigilance against social engineering and phishing needs to be higher than it ever has, and this video highlights exactly the reason why.

[@hboyd2003]

This looks to be the same thing that got Linus Tech Tips' channel hacked a while back. I can definitely see this working on those less tech savvy (and a virus windows defender has not seen before)

[@ihatepinecones99]

The sixth sense of knowing you have a virus is crazy. I got the sixth sense once, and it saved me 20k in crypto. I transferred it all out to an exchange and left like $100 in eth in my wallet and when I woke up the next day it was stolen lol.

[@arghya_333]

These can sometime just install a powershell script and add it to your Task Scheduler. Which makes the powershell script run every time you restart. I was affected and had to delete the task from the task scheduler.

[@joao9042]

for virtual machines, you should use snapshots instead of clones, it uses way less storage, and you can return to a specific backup when needed.

[@Violetstarclouds]

5:04 "STOP READING MY FOLDER NAMES" is literally the funniest thing ive seen-

[@TylerTheDevourer]

Well done, sir. I would have also had some suspicion regarding this “company” (3.18 USD is hopefully _not_ a stock price you’d want to have) but the way you also handled the rest was truly remarkable. Wishing you luck in your other financial ventures

[@Nick12_45]

14:00 AHH I ALWAYS FALL FOR IT

[@trioOFmischief]

lol

[@TheStevenWhiting]

4:05 Not always. There are some out there that can jump to the host machine. There are also plenty out there that will detect if they are in a VM and not actually do anything to hide what they really are.

[@Holloww12]

7:41 poland mentioned!!!!!!!!

[@forcemanis]

NETHERLANDS MENTIONED ASWELL!!! :D

[@forcemanis]

I just realized it wasn't exactly a good thing... :(

[@KX36]

Thank you for the very useful information. I will password protect my zip files from now on.

[@kapecadam280]

7:38 yooo poland

[@sillyobjectz]

Poland mentioned

[@kernel0verflow919]

You could collaborate with Eric Parker to disassemble the trojan. Could be very interesting :)

[@lu2000luk]

Btw if you think something is a virus you should not run it in a local VM but on some online VM like Triage/AnyRun

[@lu2000luk]

Those also give you a lot of info about the file

[@Jonas-b4m]

i would love to see you scan your actual computer with hitman pro or KVRT just to make sure there are no traces outside of the VM

[@PCsAddictionZ]

Nice informative video. I didn't know influencers get this much malicious activity in their mailbox. Interesting to see. Just a few notes regarding the video: 1) As others said, simply running a malware on a VM (although typically safe) it can bypass it or tamper with ur network. Best practice is to do it on a complete "dirty" machine and in isolated VLAN (although there is also vlan hopping as an issue but hard to do) 2) Checking the URL when clicking a link is also a good practice but not 100% safe as they can use cyrillic or greek alphabet letters which are similar to latin alphabet. 3) Mail address domains can be spoofed so even if you receive an email from a legit looking domain it probably has a different "Reply To" address (something that cannot be seen with the average email client

[@itsTyrion]

3) I'd say Thunderbird is pretty average and it shows it

[@PCsAddictionZ]

@@itsTyrion I mean depends on the type of organisation u are. Most of the ones I know use outlook which it doesn't show without modifications. And outside of professional environments Gmail, yahoo etc are the average clients which also don't show it

[@TrueInvisible]

the moment you said "it copies itself and can regenerate itself" i had to pause the video, check windows defender, and its protection history.. thanks god my system is clean so far.

[@RealCenti]

How bro gets sponsored 😭 I never get

[@SusAmongud]

Verified jump scare💀

[@Tobiasxdful]

Please do an iWork vs Office. ❤ I've never seen anyone doing an in depth comparison between Apple and Microsoft in this area. Great videos. Thanks 👌

[@caisemxd]

Thanks for letting us know. Yes we are sending spam emails to you! We will do it better next time thanks for pointing out the red flags! not joke!

[@skyh]

You admitted it's spam ,right to the spam folder never to be seen again.

[@MWCMan10]

i love the folder called "STOP READING MY FOLDER NAMES"

[@Artificerhatescavs]

3:42 fine i guess I'll stop😞

[@KittyVlogs-h9s]

Lol

[@flottenheimer]

label:yoink - hahahaha. You're the funniest, Bog. Love your work - keep it up.

[@lockheedelectra]

12:28 yeeeesssss please!

[@CLOYO]

I will never stop reading your folders BOGGGGG

[@Kitsune_Dev]

i would love it for you to review a Framework 16 laptop!