VBScript & ILSpy Analysis of a RAT

[@originalgaming9062]

No body’s seen the video yet, but 13 people have already liked it. I think this goes to show that people (including myself) LOVE these malware analysis videos

[@originalgaming9062]

@@Marko-wi1lb I just feel bad for the one poor fellow who missed the like button

[@herotrojan1645]

can you tell me the best malware analysis course to begin with

[@herotrojan1645]

can you tell me the best malware analysis course to begin with

[@flawlesscode6471]

Alternative Name: John from the future getting annoyed by his past self doing stupid stuff

[@Nuclear__HS]

John, I LOVE all these cuts "from the future", they're hilarious xD

[@ca7986]

💯

[@donovanelliott9060]

I really wanna like this comment but I can't because it has 69 likes

[@AnoNymous-ie3wc]

For you this video might me "amateurish" but for me it's 1. entertaining 2. i can learn from your mistakes 3. it helps me even more to understand what you do 👍 from me

[@uumas]

ok the 3min 50s self flame is freaking awesome. absolutely love the humor ! Keep it going man. Just the second video i watch from you but can already tell i'll probably watch some more for the personality alone

[@philipstringer4425]

john gotta admit I don't mind seeing the mess ups, its very organic and wholesome I appreciates it

[@AnoNymous-ie3wc]

Same here.

[@AkAk-jv7ig]

This is rad learning with jokes lol! You're awesome John please keep em coming!

[@QuibbleTrouble]

I think the revenge rat used here is a fixed version that's open-source on github by a person named NYAN-x-CAT which showed up in the config.

[@AhmedFromKSA]

The banner at 38:47 says "encrypt(ing?) all servers the rat clean" so you were probably in the right place

[@gowthamujjineni8422]

These type of vedios are wonderful to see. I love these type of vedios with comedy sprinkles in between

[@yasincomps2056]

i thoght you wouldn't have noticed but you have a great sense of humor

[@TheDuerden]

I have watched a lot of your videos lately - and I am subbed - but this is my favourite so far...hilarious :)

[@mustafamotiwala2335]

mr john yet another malware analysis?! it is indeed an auspicious week for us all. seriously these make my day so much better, thank you for doing what you do!

[@bryanleong2846]

keep it up John, really like all your malware analysis videos

[@duncan3144]

Another great video even if i am late to watch it. I enjoy decoding viruses etc and writing fixes. I am currently re writing my happy99 virus fix. I coded it back in 90's. Needs an upgrade.

[@y6nv]

“hey what’s up” I love how this feels like I’m just talking to a normal being, not just some KZbinr

[@ripcityraider9469]

Dude you are so awesome!!! I can't stop watching your videos. Keep up the great work!

[@batteryman2852]

Ah yes , i like to call my Object variables by the names , vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvnnnnnnnnnnnnnnnn , and my String primitives, qaaaaaaaaaaaaaaaaazzzz..

[@abeecee]

*verbose*

[@dr.humorous447]

You are a very underrated youtuber you deserve better to be honest. Im new to your channel and I love your content that I subed for more I have no experience in hacking but I know a lot about computer both software hardware and some networking. Keep up the good work 👏 👍

[@tuckerward9844]

'John from the future' bit got me, thank you John

[@thecaretaker0007]

I had to watch the whole video when I saw 5:45 Also Hackthebox T-Shirt

[@hoodieman04]

Dont worry if IPs and ports dont match up to reporting, its very common to have actors jump to new IPs or be booted by the VPS provider

[@bhagyalakshmi1053]

Thank you brother amarphal always love dance santa

[@imTyp0_]

Love these kinds of videos :)

[@dancingtiger577]

these vids are so fun and educational

[@arronk3]

2 videos basically back to back? pog

[@roykositzky2252]

god damn man your are my fav person right now thank you for being here. was that evillimeter tool a vuln or im i just a idiot? love ya man have a great day.

[@errollgnargnar9534]

Thanks for keeping it real

[@48pluto]

It was a interesting video as always. I like these decoding stuff. What caught my eye was at @53:13 Set objFSO = CreateObject("... Next line set objFSO = Nothing That was funny :)

[@almostanengineer]

I enjoy these and I've absolutely no idea why 🤷🏼‍♂️

[@davidmiller9485]

For those who don't know Hwy 75 that runs through Dallas all they way through plano and Richardson and beyond is just chock full of high tech companies. I miss the drive at night, i don't miss the fucking 110 F days.

[@Cyberducky]

Future John getting frustrated by his past self is my new spirit animal xD

[@norboost]

John sounding like Olivander in Harry Potter. "After all, insert-virus-name-here does great things. Terrible! Yes. But great."

[@BackWithTheBoom]

Creating some in GO while watching this, lets goo.

[@__theycallmeaadi3316]

What you creating in go ?

[@hdconnoisseur7932]

@@__theycallmeaadi3316 I assume a RAT

[@__theycallmeaadi3316]

@@hdconnoisseur7932 yea i think so i'm also creating malware in go that's why i asked

[@__theycallmeaadi3316]

@@j.u.g.y nah that's they call me "aadi" aadi is my name.

[@__theycallmeaadi3316]

@@j.u.g.y no problems I'm lone enough that these things make me happy 😅

[@tortotifa5287]

Hey John, Sometimes when you see that 'Client.exe', that might means that it could be some kind of RAT (talking based on experience). When I saw that ILSpy gave it to you as Lime, I was pretty sure it was Lime Rat. You have its source code on GH ! Also I do not think that with ILSpy you could do some refactor, but definitely you can with dnSpy. I suggest you to swith over a Windows VM when doing some .NET analysis, it'll get you life easier

[@donutcream4944]

I love this series ! Looking forward for more ;)

[@jaymar921]

He looks like a senior dev looking at the code provided by the junior dev 😅

[@devilemox2824]

"MATH IS HARD" :) **Agreed**

[@MySisterIsASlytherin]

John From the Future is my spirit animal

[@Mustardoable]

Dallas has a few data centres, I'd expect the IPs to be there as that's where they were running the RAT (Remote Access Tool) controller / CnC (Command and Control) server from there

[@Lars-ce4rd]

John from the future @ 3:40, I see a lot of myself in you. Such a misunderstanding is so relatable for me

[@Basieeee]

Coool stuff. Ahmed

[@obitorasu1760]

John from the future bullies present John for 1 hour straight.

[@slygamer01]

They ran the C# DLL through an obfuscator. Trying to decipher obfuscated code is not a trivial task.

[@danieldaszkiewicz7313]

These videos are great, keep them coming! :D

[@talinross]

Keep up the great work love these videos

[@SF-eg3fq]

Hi john, i speak arabic n stuff this guy's content are nothing more than skiddie stuff? in fact 99% of the "arabic hacking" videos on youtube are just a bunch of script kiddies being utra cringe. the page you saw on facebook is not a marketplace it just for his "tutorials" cringy kind of sutff, i even doubt he's behind the vbscript's, those guys really thinks once they learned how to setup kali virtual machines they become "hacking masters" or somethin 🤣, nice video and please do not take those guy's seriously in anything🤣🤣

[@TheItalohugo]

"Heavly edited" : Three jump cuts lololol

[@yamsol1911]

Dude... this guy is sick kkkkkkk I love your videos

[@alincraciunescu]

Thank you, you are unique !

[@Zebby2013]

Finally made the start of a video!

[@MrRAGHUSHARMA]

thanks John....

[@xn1kkix]

Mavis Beacon Teaches Typing

[@mindzhd]

​"bah, fuckin ILSpy, stop" lmfao

[@sammo7877]

Here we go again :D cant wait!

[@dedkeny]

Dude, that is the funniest intro you've done yet lol

[@solpex]

John what ssh client do you use and open a new shell and so forth I really love it fotgot - got what you said with Thanks alot!

[@blackjackdealer204]

Nerf fumble in the future..but still #respect .. I learned the $ replace with itself thingamajiggy you did

[@slygamer01]

C# DllImport uses the method name as the function to load if no explicit function name is specified.

[@samh3355]

At first, I was thinking.. Optic Scump??

[@chrisbishop6928]

Dude these are just the right blend of comedy and learning on the fly. Math is hard!

[@bhagyalakshmi1053]

Gidra assembly code in the bic checking.

[@1wk407]

dallas needs an intervention

[@Lars-ce4rd]

Here's a funny problem to consider, who gets more value out of .Net code obfuscating itself at build time, good guys or bad guys? Have we made life harder on ourselves?

[@logiciananimal]

The stuff you looked at in IL seemed to be possibly an un-selfpacker, like the WSH rat stuff you browsed through.

[@temolantern9091]

POV: you're in the comments to see if world of hacker replied to the video with "thanks for the shoutout!"

[@eklypzn]

I see you have the Huntress shirt too. You can use -o with curl to download. John is about to get DMCA'd by these hackers PepeLaugh

[@stevejamal241]

I bet ya that Mr Ahmed is from Eygpt cause that background is almost like Egyptian way of piracy and hacking stuff 😅😅

[@0xlol64]

this why most people who sees his profile hate us egyptian and arabs btw im egyptian

[@hpimpact]

egypt isn't the only arabic country tho

[@ko-Daegu]

@@0xlol64 why thou?? I don’t get why I will hate an entire country( 100m+ people) cuz of a banner ? Also we have Russian and Chinese hackers I’m not hatin Russia or China cuz of them You are worrying for wrong reasons

[@DavidAlvesWeb]

⚠️ MATH IS HARD SHOULD BE A MOVEMENT! ⚠️

[@HalValla01]

37:19 Cover you ears, kids

[@maliusribeiroborges7578]

Damn, this is way above my level lol

[@jwbulmer]

It’s all above my level.

[@nickreed7277]

if it makes you feel better John. im not one of those people who notice anything wrong that you do. im a noob :)

[@zitrax506]

Arab hackers: A group of hacker children who depend most of their concept RAT While do not realize what are the foundations of the penetration "I mean the majority "

[@gabrote42]

Hilarious 20 20 retrospective

[@thekurdgamer8366]

John from the future 😅😂

[@tomasgorda]

Hahaha i like John from future and his comments 🤣🤣🤣🤣🤣🤣

[@TheSxW]

18:54 - yes you can

[@BSJuliaMagna]

Hackers from Texas? Yeeehaaaackers?

[@luks1337]

omfg, I love this edit ... btw john u edit in Linux?

[@rckrs-jf8lb]

Excellent video man, if you can share the sample, would be great.

[@diddyman1958]

I like it :)

[@scor-_-pions5094]

por favor faz mes que to tentando...> executar o emulador do ( ps1 duckstation ) com um comando bat para iniciar a iso do jogo sem abrir o emulador ou seja iniciar automaticamente com um click no comando .bat?

[@surajsawant6469]

hey, it's fun to see your vids. could you please also share the samples?

[@rrkatamakata7874]

i am cse student and i feel like oh god there is no way i can write this stuffs. (i want to mention the hardness of these stuff not the hacking part)

[@h8handles]

your videos have gotten SO FREAKING GOOD which is hard to imagine because i have loved them since the python tutorials.

[@TheAngelOfDeath01]

C# code... and it's not the engine behind a chess game that code there covers!

[@TwinTailTerror]

Update that ip is a vpn in tex by nord i think

[@Tan444]

you should put the hash in the description so people can follow along

[@watchdog2864]

Where do you get these samples from John? I’d love to do some of this myself!

[@TwinTailTerror]

Server is victim in the world of rat. Client is attacker on the norm

[@arivanhouten6343]

i was here before you could even watch it

[@Scaramouche122]

van houten

[@fade8148]

Best dud

[@dougbongqueque]

I liked it 🤷

[@ivanboiko8975]

ho ho ho, time to malware :D

[@killerskincanoe]

Math actually is hard yo

[@jonchicoine]

So where did you get the vbscripts from?

[@Dodo-rb4zf]

me doing code review on my company

[@SamyTessier]

Is this any malware written in Python? would be interested in an analysis of that

[@ThatBoringDeveloper]

I am by no means a ethical hacker or someone who is into malware analysis i am more of a web developer than anything but isn't this dangerous even in a virtual machine?

[@bhagyalakshmi1053]

Vvvnnn is power files open.