Convert .EXE to IMAGE!

[@ebolaman_]

webhook.exe is just a placeholder (so i dont get banned), you can use the methods in this video with a token logger, rat, etc

[@Amitherabbit]

very *Educational Purposes

[@The_Wafool]

you do realize computer hacking is very illegal

[@indio1452]

have how send the code of the weehook.exe

[@Andrew90046zero]

​@@The_Wafool "hacking" is not the same as "stealing people's data and damaging property". So no, hacking is not illegal. What is illegal is using means of hacking to commit actual crimes like stealing, harassing, damaging property, etc. In the same way that teaching people how to pick locks is not illegal either. Though, in many situations, people may state that "hacking" IS "stealing data" as an over simplification of the word. This over simplification causes confusion and makes people think that Hacking is (and can only be) the act of breaking security for the purpose of stealing (and other crimes), but you can hack without causing damage to anyone. Hacking is simply the act of bypassing of security measures, or breaking some other system to gain access or priveledges. But if you have been given permission by the right people to have such access or priveledges, then it's not illegal. And spreading awareness of computer security flaws, like how @ebolaman_ has done here, helps everyone to know how to protect themselves against these exploits. If this was not shown here, it will still be shown in other places where actual criminals hang out. Showing these security flaws can even lead to an eventual patch of the flaws. So keeping this information secret can be more dangerous to everyone.

[@InstantNameOfficial]

​@@The_Wafoolno way, its very much legal man what are you talking about?

[@tenorton]

Educational purposes is pretty much the universal dev excuse now

[@F1L337]

I guess it is the same for nudity counting as art.

[@lembarkii8669]

​@@F1L337t w i t c h

[@0xF81]

Not really, he showed us how is it made so now we're aware how to be careful in case of sus file

[@BabyKnxckz]

it is educational init

[@reality5783]

I have soo many *educational purpose* ideas!!!🤣🤣

[@Theooolone]

That right to left override character in the filename was absolutely devious

[@Yazan_Majdalawi]

But I think the extension in the properties menu would still be the right one

[@Archimedes.5000]

@@Yazan_Majdalawiit will, but who looks at that In fact many scammers will just name it "pic.png.scr" and hope that the victim has the "hide known file extensions" option enabled, because it's still the default on Windows lmao

[@twー]

@@Archimedes.5000man.. Windows. I'd be on Linux still if devs supported their stuff on it more

[@RealThornZ]

the phrase educational purposes only is the one thing keeping this channel from not being cancalled

[@MAGNETO-i1i]

He hasnt done anything illegal.

[@ziadidabde3662]

Y can hide virus by this method ​@@MAGNETO-i1i

[@farn1991]

It's not like he is going to distribute any zero day exploit through youtube video.

[@VideosViraisVirais-dc7nx]

​@@MAGNETO-i1iyeah, nothing legal. It's like watching hentai knowing all characters are over 18

[@cracktek_industries]

The RLO trick is actually something I didn't know even as a CS student, thanks!

[@catorlife]

this is old one, if you do this, even Window Defender can catch this, it automatically consider the file as a trojan even when it's not harmful (test file)

[@KennyWlr]

​@@catorlife can confirm, it's been like this for a while now

[@Coxick]

The name will go back to it's original form once you upload it somewhere, so not useful even if the target has no antivirus

[@RandomGeometryDashStuff]

there are file managers that separate extension from rest of name like double commander

[@miner4236]

Wow even as a CS student ? Xdd

[@serbianspaceforce6873]

malware tutorial 😭

[@Drixpy_YT]

thatts his whole channel

[@Wilson-AM]

lol

[@Drixpy_YT]

@niikolehmainen Real.

[@serbianspaceforce6873]

@koolehmainen sure but I'm on Linux so idk if it'll work the same

[@threeMetreJim]

It's useful to know how they work. You can learn some interesting code too, help to defend people against malware and learn how to remove the persistent back doors. Just don't get hit by a crypto locker.

[@olafcio]

.scr is an shortcut for screensaver executables. It's exactly the same as normal executables, but isn't .exe. EDIT: Also, it's better to change the shortcut executable to "cmd.exe /c .\image.png", because when you leave the full path (c:\users\boris\...), it only supports your location of the folder with your username. But still, good video.

[@pizzazr]

True but you're sending it to someone else anyways

[@андрей_свиридов]

Wtf .scr is 'script' not 'screenshare'

[@pizzazr]

@@андрей_свиридов it's Screensaver

[@Meletion1]

@@андрей_свиридовeveryone is wrong it’s screen saver😂

[@андрей_свиридов]

@@Meletion1 yeah, that too. I have bubbles.scr installed as my Win11 screensaver :)

[@ontop3543]

educational purpose only. Enjoy 💀

[@Uthael_Kileanea]

Good video. Knowing how to do dangerous things helps in defending against them. For example, to defend yourself against this, use a custom system icon pack and disable thumbnails. No antivirus needed or keeping your eyes peeled for extensions. Also, your default icons look cooler.

[@Cryptocurrency69]

Could you tell that how do you switch to a custom system pack and disable thumbnails

[@blvdes]

​@@Cryptocurrency69 ask Google

[@Uthael_Kileanea]

@@Cryptocurrency69 Both answers depend on your operating system. You'll have to ask mama Google.

[@supercellex4D]

Doesn't help if you're a high value target, the real trick is to know Windows screensavers are autoran executables, and to check the file type. Or use Unix because NT has one of the most comprehensive filesystem permission systems ever that doesn't have execute as an attribute.

[@MightyDantheman]

You can also just have file extensions visible by default. But the more steps you take, the safer you'll be. The scary part is that these changes only help you if you know what you're looking for. Imagine the normal user...

[@GRPYouTube]

Bro you literally got the the info i was finding for 2 years

[@nothink0945]

I was tryna find this for so long and this was here the whole time????

[@x4dam]

frr

[@TeeChemist]

The question is whether windows defender detects it as malicious? Or does it depends upton the the exe that is being executed.

[@xodzphone]

Shit I was doing 25 years ago

[@dustindhansen]

@@xodzphone I was doing it 50 years ago

[@MarilynCol7]

Damn its very rare that i find interesting channels ln KZbin

[@alibrahym]

instructions unclear: Im in the prison cell and re-watching this video

[@zirtaontop]

this is very improtant not for scamming but for being aware so its very important also this teaches u that the best antivirus is you

[@sanchogodinho]

Its just wow 🤯 So nicely explained straight to the point!

[@antxnioo]

bro's channel is surviving with the educational purposes excuse

[@andreimateas6782]

:)))))))))))))))))

[@Bin2Hex]

RLO is already detected by most AV's .scr is also detected by most AV's now and will be stopped by WD smart screen. the .lnk method works but will be caught by behavior dynamic analysis which most AV's have. double masquerade extensions will also be caught and stopped by smartscreen.

[@phir9255]

Is Windows Defender included in "most AV's"?

[@MrGenius2]

​@@phir9255probably yeah wd is the most annoying av because it just does to much I don't have it because it even blocks my work

[@whocares4444]

@@phir9255windows defender is an AV (anti-virus software) preloaded with the windows OS

[@miner4236]

​@@phir9255likely

[@Bin2Hex]

@@phir9255 considering windows defender is default installed on all windows operating system, then yes it would be considered part of “Most AV’s”

[@btarg1]

You can embed code inside an LNK file, and have the link file run it, so you could also fit an image inside an LNK and do it that way!

[@macpclinux1]

i admit. i have been pwned by this in the past. it's such a good method

[@TSF-NexusVoid]

mixing this with being able to view other desktops and holy hell you're goated

[@vasilis23456]

The fact that Windows lets you use the RLO in filenames and it actually works is crazy. They didn't think at all about how this could be used, or they did but didn't care. There should be some kind of indication of every type of character in a filename, be that a color change on reversed text or whatever.

[@Lagger625]

What about Arabs and Asians, millions would be pissed about having to type their filenames in reverse

[@BytePix_]

This is scary simple. I don't know if I am suppose to be scared or surprised.

[@kamimatsuyama]

you can check the file extension and size when downloading files

[@AresEverett]

both

[@BytePix_]

Have you watched the entire video? because it can look like a png or whatever file and still run as a cmd. @@kamimatsuyama

[@Ransomwave]

the RLO method doesn't work after uploading a file to 99.9% of file hosts online. you shouldn't be scared. if you're skeptical, you can always just right click and check the properties

[@potthegrunt]

bro is helping the scammers😭

[@chillappreciator885]

Slick demonstration man! It was fun to finally know how do they do this

[@makar4ik_cat]

Thanks to you, now malware creators will make the fake pngs

[@AussieCricketOnTop]

Cant wait to use this for educational perpousus only!

[@orren6999]

I remember this video

[@avocadoricardo6957]

The amount of people who think that clicking the image sent on discord will execute it is hilarious

[@pinguluk1]

Wasn't there an exploit that basically did that?

[@freen1364]

They just send the embed from a other device once they click the image it’s all a scam

[@avocadoricardo6957]

@@pinguluk1 no that’s not possible because of how discord works. When you send an image, discord harvests that information and displays the image, more or less like a middleman, in other words it’s literally just an image, you can’t hide executables in it.

[@aidaonYT]

thats why you only look at the embed

[@Hackedpw]

@@pinguluk1 yeah there somewhat was. for others in the replies: .WebP (note; webp wasn't the only thing that was exploited nor was it only discord related but its the one with most information.)

[@lamborghinigamer]

Now I'm scared for images. Luckily I'm on linux so no exe's, but still scary to think how easy it is to hide the real file extension

[@infectieon]

So ANY image on discord could be laced like this??? Wtf how do you even stay safe from this? Idk how to work linux

[@Phobos001_youtube]

​@@infectieonUploaded images with machine code execution will get rejected because they're not REALLY images; The headers and offsets are wildly different and be considered corrupt or invalid. You only need to worry about fake 'images' stored directly on your file system, and make sure not to run them.

[@dnchplay-archive]

Also the reversed text trick used to spoof the file format works only on explorer and a gew other programs, in the most of apps this trick won't work and the original file format will be shown

[@CluelessGeek]

"linux is free if your time is worthless" proceeds to get hacked by an image

[@yashi0412]

​@@CluelessGeekthis was the cause by my change to dual boot windows/linux to just linux 😅

[@aigg_]

i'm torn over liking this for the educational purpose but also not liking so less people use this maliciously. nice explanation tho, kinda scary

[@lowHP_]

what a legendary mic stand

[@unknown-yo2tx]

cool old techniques you covered

[@firebolt3626]

yo man, idk from how many days I've been looking for something like this. thanks a lot for this buddy.

[@KalkiKrivaDNA]

So have u been bleto tech virus to Gmail ?

[@guili-p7m]

I'll give a huge reward to anyone who can make it

[@firebolt3626]

@@guili-p7m i was able to do it. so what u gonna give me?

[@wallaguest1]

damn it, the RLO trick is quite surprising, for things like this you just better drag the file to the image editor

[@letsqooo]

why is the hardest part to find the ico image😭

[@cwypto4488]

that's really cool! im not interested in doing this but i like the style of your videos and your explanation. Subbed.

[@touyaakira1866]

I'm like a lot of people here I'm like a lot of people here who are really scared if youtube bans you. Your knowledge is amazingwho are really scared if youtube bans you.

[@catorlife]

the RLO trick is not gonna work since even Window Defender can catch this, it automatically consider the file as a trojan even when it's not harmful (test file)

[@ILoveTinfoilHats]

Yeah this isn't actually a danger to anyone. The only reason windows isn't freaking out about the file is because it was made on his computer. If you were to upload that to the Internet and try running it on another computer it'd get instantly sent to the shadow realm by even the worst of anti viruses

[@Lar_me]

@@ILoveTinfoilHats I tried making my own, and Windows Defender successfully stopped it from executing. Maybe the video uploader disabled Defender for the sake of the demonstration?

[@ILoveTinfoilHats]

@@Lar_me yes exactly my point, even the crappiest of antivirus programs would catch this low-level bug

[@BellaTheUnicorn-ko5yt]

def gonna use this for educational purposes

[@muuqii]

appreciate it man keep up the good work

[@ancestrall794]

First video I see of your channel and you definitely earned a sub. Tbh I don't really see how the "standard users" could not fall for this

[@Islandpulledfromthesea]

This is getting out of hands Thank you tho

[@shinydewott]

Now I am immensely paranoid of all of those background remover and image downloading websites I have visited in the past! Wonderful!

[@elepentx2]

One day bro is gonna hack the NASA and say that it was only for educational purpose

[@mgtgamer6029]

The best Explanation❤

[@svenrawandreloaded]

you should show people how to detect these files

[@pilgrim_gaming]

Do you still see a shortcut thing? Yes. It’s not perfect, but that’s pretty good.

[@artiflefy1371]

Now I'm scared of discord img

[@Aurora.Astralis]

Love some good bass boosted Xenogenesis by TheFatRat

[@arshamshayan]

thank you for this tutorial ebola man

[@alvinrahmanwafi]

My man earned a subscriber

[@MiguelWilson0]

fun fact: there is no educational use for thst

[@jasii7206]

I am taking Cybersecurity as a trade, this is educational to me. :D

[@tomasprochazka6198]

how come? I learnt that Win is still a mess in these days.

[@Noahitis]

? It doesnt have to have an educational use, he's educating on a subject, which makes the video educational. Whether that be if you were educated on how to infect other peoples machines or to better protect against having your own machine infected, this video was by definition educational as it taught something

[@MiguelWilson0]

@@Noahitis that comment was from 5 months ago...

[@Noahitis]

@@MiguelWilson0 people comment on my stuff from 6 years ago, it doesn't change the validity of what I just said

[@user-CosmoGT]

i love this man

[@xodzphone]

Man i remember doing this in like 2001

[@LeZylox]

Old person.

[@Will_of_Iron]

I wasn't even born yet lmao. You're awesome 😎💯

[@HhVhji]

Yes thats what i says its too old 😂😂

[@NolenFelten]

That grassy hill image was taken in Sonoma County, California, where I grew up.

[@Ali-wf9ef]

so if you open an image and it opens it doesn't necessarily mean that it is not a virus.. great job microsoft

[@pinguluk1]

this is insane, I better be careful with downloaded images from now on 💀

[@NuggetDevs]

Same here

[@Otherwise_1]

Same here

[@Ransomwave]

the RLO method doesn't work after uploading a file to 99.9% of file hosts online. you shouldn't be scared. if you're skeptical, you can always just right click and check the properties

[@RoachJr695]

underrated content creator

[@zmudzin4493]

ok how to avoid it now

[@ZeroEight]

don't download anything

[@Pr0toPoTaT0]

I subscribed right at.... you know. The one nobody buys. I totally never bought this program but damn if it doesnt seem to always be activated. Crazy.

[@HTDMAS]

but wont Windows diffender block that file if someone trys to download it

[@enty-3035]

Its depends. If has a malwer blocks it if dont it not

[@user-tc9uz7zy8d]

Fantastic video

[@anony-mousex]

Insane most of this stuff is just baked into the OS.. Windows really has no regard for user safety

[@Calamite-n3p]

Bro that's insane i really didn't know those techniques before holy shit that's scary

[@AdrianLee]

Why not just make the shortcut point to the hidden webhook.exe file instead? If they're looking at the properties in any case, they'll see that it points to an .exe and not an image 😅

[@guili-p7m]

I'll give a huge reward to anyone who can make it

[@sab_33fr]

This is very interesting. Might use it against scammers

[@PhantomZaya]

when i do extention spoof #3 the output file is (img name).png.lnk why?

[@ebolaman_]

.lnk is the shortcut extension

[@brunio167761]

nice dude, next turorial: how to empty someone bank account (just educational)

[@htgg9006]

Skid material We don't need more 15 year olds roaming around discord sending malicious files to other kids

[@ebolaman_]

i’m literally a professional skid

[@htgg9006]

@@ebolaman_ lol, why not progress deeper tho?

[@b4rlvnna]

@@htgg9006 what makes you think he hasnt

[@beamsandshits]

the only thing skid here is the skidmarks in ur underwear bro

[@htgg9006]

@@beamsandshits your channel is literally roblox exploits, why you bein a kid instead of doing real sh*t? No need to get mad but if you're into cyber do it all the way and not like a clown

[@spartv1537]

technically, you can go deeper with shortcut method without spoiling hidden file but it's gonna be multi-task command for cmd

[@natoplly]

Hi I noticed that there is no multi-tool video at your place. Could you please share this video on e.g. Google Drive or something else.

[@ebolaman_]

github.com/EbolaMan-YT/Multi-Tool

[@natoplly]

@@ebolaman_ thank you good person!!

[@AsterLight]

Ngl downloading a file from this guy is the last thing I would do

[@nonstoppe9]

Educational purposes=educating hacksers

[@Darkbeamer01]

can you make a slightly less complicated version?

[@ebolaman_]

alr

[@Darkbeamer01]

thanks alot first time a youtuber actually responds to their viewer good job@@ebolaman_

[@pyro4888]

i mean its already simplified enough its not that hard to follow

[@Darkbeamer01]

for me it is@@pyro4888

[@EvanVR1987]

thanks, now i "educationally" know how to give someone a virus.

[@OfficialSwazzzy]

hello do you know how to make a hwid spoofer? been watching these videos and tryna make one using the multi tool method as well.

[@ninjaxboy]

Educational purposes only is the special key to not getting banned

[@Xaredion]

what app did you use to 'short cut' the unicode rlo character?

[@ebolaman_]

right click>insert unicode character

[@Dino-zg2vx]

@@ebolaman_ he wants to know how youre able to see that unicode thing

[@nuggetvb]

@@Dino-zg2vx when youre renaming the file just right click on the file name and it should give you those options. he literally told you to pay attention

[@joedartonthefenderbass]

@@Dino-zg2vx it's just built into windows

[@mapg519]

WE ARE MAKING A RAMSOM WARE WITH THIS ONE 🗣️🔥🔥🗣️🗣️🔥🔥🔥🔗🔗🔗

[@ௌௌௌௌௌௌௌௌௌௌௌௌௌௌௌசழ]

“Ramson”

[@phsycdelic]

When uploading it on discord, does it act like an actual png. Also what stubs do you recommend for roblox

[@ebolaman_]

idk abt roblox stubs but yeah it only works w discord if u zip it

[@phsycdelic]

@@ebolaman_ damn, are there any stubs you'd recommend

[@omggggggggg-jkyss]

@@phsycdelicjs learn c stop being a skid >w

[@Sown.]

​​@@omggggggggg-jkyssmalware in C is very annoying to make

[@pyro4888]

@@phsycdelicwhy u wanna beam so bad😂😂😂

[@entic207]

Thats why I always use the “show file extension names” option

[@TSMSnipeMan52YT]

doesnt save you buddy

[@WukCR中文]

how does the webhook exe work

[@_neins]

Discord bot

[@luimu]

it sends post request to an url

[@cyber8972]

bro is a prodigy

[@boing7679]

what about doing it by adding the executable to the shortcut as an alternate data stream so you only need to download one file

[@deeeeeeeeeep88]

You will have to go into the registry to show the file extension but since the file extension for a shortcut is .lnk, it would seem really suspicious

[@memmoman]

Thank you ebola man

[@HeyVSauce]

this is why i avoid windows at all costs; over here on linux, you need the executable permission/flag set if you want a file opening to result in it running code

[@Bo0mber]

Don't pretend that linux doesn't have a shit ton of other vulnerabilities. And I'm not even talking about how painful it is to use

[@HeyVSauce]

@@Bo0mber "painful to use" clearly you havent used windows with it's painful constant crashes & all around instability "vulnerabilities" true, however let's not pretend windows doesnt have the same ones + a bunch of phishing ones - this video essentially describes a text-rendering bug allowing you to perform a phishing attack, something that i would like to see happen on linux tricking users into opening an "image" is way easier than any phishing attack that relies on literally anything on a modern, up-to-date linux system ever will be also, since we're now comparing actual vulnerabilities, i can still load genshin's kernel mode driver for free kernelspace privilege escalation on a system which never had genshin installed - it's still trusted by windows :) microsoft doesn't give too much of a fuck about fixing legitimate vulnerabilities, linux kernel & other critical-inifra developers usually do.

[@HeyVSauce]

to clarify: the text-rendering bug is only a bug due to it's possible use-cases; I get the use for an RLO, it's just considered a bug due to it being abusable in this specific context.

[@Bo0mber]

@@HeyVSauce saying I haven't used windows is so ridiculous I don't think you believe it either. As far as stability goes, from my quite limited experience with ubuntu, I can say it is way less stable and usually when you try to make something work in linux it takes several hours of recearch, whereas in windows it just works right away. I also don't remember the last time I've seen something crash, maybe it is because my computer isn't 20 years old? As for vulnerabilities, I'm not arguing about how many there are in each os, I'm just saying it's quite dumb to pick an os based on this factor when "preffered" os isn't even free from them

[@HeyVSauce]

​@@Bo0mber ubuntu is maintained by canonical, a company not known for anything except being idiotic amongst the linux community. when I run windows for testing shit, I'm running on like 2-3 year old hardware, and the amount of random crashes I get when doing the simplest of things is insane - sure, it won't just crash when opening notepad, but it is a very unstable operating system. even just the APIs it provides to usermode applications cannot stay stable for 0.3ms

[@thereaper3796]

Esto podría ser bastante útil algún dia en el sentido "educativo"

[@fredo13377]

Release the code that sends the message to the webhook as well as to the logger.

[@ebolaman_]

the code that sends the message to the webhook is an placeholder for a token logger

[@KyuDoesCode]

C# ? C++ ? Python ?

[@Maxx23]

c#@@KyuDoesCode

[@freen1364]

Look for it on google

[@hoangat7188]

Keep it up man! That's awesome

[@imauser301]

you can literally teach people how to obtain interesting substances and add "educational purposes only" and completely pass off youtube

[@thelibyandxer]

Imagine doing this in school 😭💀

[@IamOsvy]

it's very obvious that no one is going to use it in an educational way and they will use it for doxing.

[@CramePus]

hahahah really? main point you donkey, have a good xmas tho and stay safe

[@mrhonkhonk6116]

no shit sherlock

[@GodPhazer]

I'm impressed by RLO, I didn't know.

[@guedaigegedeon2042]

THANK YOOU

[@ebolaman_]

nppp

[@tryingtonot3369]

casualy doing gods work

[@zerayde]

what is ur patreon

[@ebolaman_]

www.patreon.com/EbolaMan

[@toNieh]

I know you're saying this is for "educational purposes" but this mainly enables bad actors to do these kinda of stuff

[@nolansrich]

are you dumb...

[@QuavanteZingletonTheThird]

Ebola man!

[@davidddo]

Proud to be a thiojoe watcher

[@riveralonzo]

I’m literally working on defense against file extensions and file uploads right now… gonna see if spoofed files get through what I wrote.

[@ThatNerdGuy0]

Ehehehehe Definitely going into the saved videos

[@SDRIFTERAbdlmounaim]

i clicked expecting to see the exe binary turned into tiny black and white squares in a photo and converting that photo back to executable code