$2 MILLION DOLLARS STOLEN in Bitcoin/Ethereum - JScript Malware Analysis

[@_JohnHammond]

Update: Thanks to @Wikidude in comments for pointing this out. The "Mizu" address that I didn't do a good job of digging into is apparently a BTC address. Looking this up, it has over 2.5 MILLION dollars, with transactions in March of 2021. Absolutely crazy. www.blockchain.com/btc/address/1NSrjTotDiuK7S1xMm9yuppq4dr4Uf9saM

[@hackingguy]

It was really awesome!!! It felt like a real movie hacker like stuff 🔥🔥🔥🔥

[@void_p]

change the video title for moar clickbait!

[@wikidude]

We are Big Boi investigators now xD

[@Basieeee]

Holy smokes

[@SV_Sangha]

Wow.... makes one wonder doesn't it.... all stolen or mined, hmmm...

[@jht5225]

I just wanted to say. You have inspired me. I have officially enrolled in university again as a mature student finally and will be working towards a bachelors in Cyber security

[@philipstringer4425]

same i didnt know what i wanted to do in life, but john has shown me a path

[@deepergodeeper7618]

@@philipstringer4425 you now know the way

[@Nunya58294]

Hell yeah!

[@chillytheprogrammer]

I am currently studying cybersecurity too!

[@hackman44]

@@chillytheprogrammer Best field to get into. Lot's of money to be made as long as you have the right mindset.

[@alessandro.rossini]

39:05 this is in a language that I do not speak: Proceeds in realtime reading and translation from Italian to English with no issues

[@MrCyphersphinx]

Excellent work, watching this helped me realize that this cyber security degree I am finishing up is something that is achievable and interesting. So much of our classes are report driven and it is great to see a real world example of what actual analysis looks like and the progression through it. Thank you!

[@EmaCannella]

The Threat Report PDF at 38:53 was in Italian and yes was a report about a similar malware Italiani facciamoci sentire :)

[@valeriobertoncello1809]

Spaghetti code ftw

[@heinrich3427]

This video inspired me to get into ethical hacking. I literally watched over 20 hours of videos about hacking in the last 2 days. I haven't been this excited since I started programming 17 years ago. Just hacked into my Bose soundtouch 😂 Thank you for bringing back the fun and fire in me for computers 😁

[@royslapped4463]

This video inspired me to make a bot net that is spreading around the earth and sending millions of dollars to me from "inactive" crypto wallets. 😉 I am almost on the leader board of top 500 humans!

[@Flaneur27]

How Tf did you have that

[@jeromed.salinger647]

Updates? Was it short-term hype or you stick to it up until now?

[@wikidude]

Hey John, the BTC address (Mizu in the sample) that you didn't check properly on blockchain explorer, has received $2.5 Million. Should probably change the title. $2.560.000 looks better xD

[@_JohnHammond]

Holy shit.

[@salticidae1.618]

@@_JohnHammond yeah it's 72 BTC at 44,000+ USD each xD

[@jimmyadaro]

@@salticidae1.618 BTC is up to $56k each right now

[@jbarriossandrea]

Is 13 millions now

[@BigBeesNase]

It was an interesting dig and got spicier with those dollar numbers. Keep up the good work!!

[@kingpopaul]

I think this is pretty small compared to ransomware in terms of value and damage. Though it's nice to see a John spambot.

[@LuisSieira]

Impressive how you managed to understand obfuscated italian though

[@haloball12]

...

[@HatTrex]

Bruh

[@LinuxJedi]

🤦🏻‍♂️

[@dumbidiot1119]

So just Italian?

[@deutscher649]

What is being insinuated here? Just curious.

[@SV_Sangha]

Great work... love how fluent you are in this. Kudos to you John!

[@SV_Sangha]

@John Hammond Thankfully I have not. However, I try and stay isolated as best I can. I love the programming and security in the videos.... and am doing some entry level hackme items trying to learn. Your inspiring, thanks!

[@_asidy]

Sailing Sangha that was a fake account

[@SV_Sangha]

@@_asidy agreed... but good interactions help the algorithms 😁

[@Masterism88]

I know this video is a couple months old, but I'll still say that These videos are much better when you go through the malware for the first time, rather than explaining what you've found previously.

[@joacoordonez1973]

Man, i love this vids, you'r an absolute genius. I learn a lot

[@kristiyangerasimov6708]

John thank you for the great video, I'm a complete newbie to software development, debug and analysis. I'm able to follow you perfectly, understand most of what is presented and am having a great time!

[@andreastefan3825]

39:08 that is Italian :)

[@asdqwery7593]

Thanks bro

[@jakubklecki2963]

Scammers these days pose as people who have literally just said in the video they don't know shit about crypto

[@joryiansmith]

This malware analysis is nothing short of magical

[@imjustwolf]

I love that I found your channel! I want to get into cyber security so watching you go through code and explain things is fascinating! I do have one thing to say... why do you NOT use dark mode on EVERYTHING? It is so much easier on the eyes using Window's dark theme and any dark theme where sites allow it (like twitter...).

[@mikeylazokUkraineupdates]

Good Job , John "MALWARE" Hammond , Lovely to See and Hear Your Enthusiasm For Malware Man you Nailed IT.👊👌🤚✌🔥🔥🔥🔥As Usual 🔥🔥🔥🔥👌✌👊👊

[@rickybennett9410]

You rock, John! Thanks for the cool videos and for being such an inspiration to all of us aspiring info-sec pros, and for educating the general public! You're the man!

[@NB-ph6cv]

Man, I don't understand all of it but now I remind myself that I was supposed to do other stuff and 32 minutes gone like a slap, or wait what does suppose to mean? And yeah, it's really interesting stuff! John, you are a Legend! :D

[@juuse94]

That clipboard trick is really slick

[@hexearth8258]

57:11 once you make a cryptocurrency transaction, it's public, everybody can see it.

[@_Fen]

_laughs in monero_

[@pahvalrehljkov]

ammount of good advices and the fact you actually read them and use them is really creating that community vibe... me like it... also, i like it more when you come somewhat uprepared and research this like you would usual, sometimes it feels like you wanna make these videos to be explorations when they are clearly well prepared demonstrations, that feels more natural to me... and ofc tnx for all the good and spicy insides on how this is done! 👊

[@Tramontano_T]

You have no Idea How much i love your videos ❤️

[@kerbatonbaton8108]

pls someone make something that looks like malware but in the end it gives you a youtube link to rickroll (and send this to him, pretending its crazy malware)

[@SpoiledBread24]

Lol

[@CZghost]

You know what? You bet! :D

[@CZghost]

@John Hammond Shut it off, we know you're fake ↑ Real one would have a tick next to his name, as an author of this video highlighted name and updated profile picture...

[@tylercoombs1]

God, i learn so much from watching John's videos it literally takes me 3 days to digest one

[@OmniPhantom]

I know right it's amazing

[@kylefaust7743]

You know I have searched extensively to see if anyone actually does anything like what you do for this malware/virus/ransomware/ect... No one displays it like you. This information digging explorer style of the software. Most try to show off a tool or explain how you can learn to go do this and how it benefits you career. But no one is doing what you're doing here. I can't get enough of it cuz it is incredibly awesome.

[@timothysnyders1426]

Yo Johnny!! I've been a fan of yours for the longest bruv! Malware analysis is a neat content twist👌🏽.. Looking forward to more bro. **Side note : PLEASE CREATE YOUR OWN MALWARE, AND UPLOAD A VIDEO EXPLAINING THE CODE AS WELL AS A DEMO USING IT.. PRETTY PLEASE!! 😭😍🔥🙏🏽

[@pedror9314]

Exelente video!! Gracias por compartir

[@StanLTU]

excellent stuff. Love your content. Keep it up.

[@structure7]

The only thing me and you have in common is that we both speak English good, but man I love your content, style, etc. Thanks for doing this and please keep it up! Subscribed. And I watch until the end.

[@heinrich3427]

As someone who works as a Software Developer since 17 years I am suprised how trivial the malware is. What I like most is how creativ it is with the clipboard. Are there common malware patterns?

[@alvarocarrascosapenabad4355]

Malware authors to me are some of the most creative people. I am sure there many patterns for achieving specific tasks, one I see a lot and here for example is to find the Startup Windows folder and copy it self to it. Some of them even go to the extend of making the icon invisible in said folder

[@fra1897]

that pdf was in italian! c: very entertaining video :)

[@sorrefly]

39:05 greetings from Italy ❤️

[@2514ben88]

great job John fascinating stuff as always

[@NikolayRogchev]

So the whole script relies on people not checking what they paste when sending money?

[@code-to-design]

Why there is request to localserver if the video is only about what u said

[@TheSauxer]

57:32 that's batman voice noice

[@Hitmonkey420]

Love your content, John. I've learned a lot just listening while I work. I have applied a bunch to using Linux and have implemented your techniques starting Hack the Box. Just bought a shirt from ya👍. Keep up the good work. It would be cool if sometime you could make a mini series specifically about writing little tools, but I know your videos often contain python scripts you write on fly (which is really dope btw).

[@kunma3214]

dude you are doing really cool stuff, keep going!

[@chervesblezz]

Great job... I've learned so much... plz continue with this... cya

[@paashaasXD]

I have one question, this script changes your clipboard with another BTC/ETH address right? But do they hope you immediately send btc after that or something? What happens when you ctrl C something else, will it overwrite? I don't get that part.

[@skalman2262]

I do not know why this came up in my feed ... I understand absolutely nothing of what I'm watching ... Good work to get a subscriber who has no idea what he is subscribing to. and yes the text is with Google translate ;-)

[@internetdoggo4839]

Love em. keep em coming

[@chillytheprogrammer]

53:51 Has he made a video on the minecraft malware??

[@sammo7877]

Would have been interesting to see this part @51:45 via Burp suite :)

[@Henchman0077]

Great fun again John. Great work

[@hgjfgjghfj8920]

have u deobfuscated a pyarmor obfuscated script? (python) a video on that topic would be interesting, thanks!

[@mjmeans7983]

Is there a Windows policy that will just disable this pattern "Function(string)()"?

[@logiciananimal]

On the POST - the server doesn't have to answer - it could be doing nothing visible to avoid another IOC. Also, for all we know it could have been compromised itself, partially taken down by intelligence or law enforcement, etc.

[@GabrielSultanGabyyy]

where do you find these?

[@kherkert]

Hey John, base64 decoding multiple js comment blocks as one base64 string will certainly not work out. First split up the different /* ... */ blocks and decode them separately.

[@rastabong420]

love your videos john keep it up!

[@foxdk]

Another great video. Keep it up!

[@Dan-uo9fw]

I'm curious what infection vector they use to get this into a victim machine and executed.

[@hunterhunter6517]

From downloading pirated software i suppose.

[@szymusu]

I love how self-remove is "UnMonk"

[@custume]

I actually use ESET several years now and for me looks good, also not expensive, sure have some things that can take it down but mostly gets a lot of things

[@pxdav]

Stage 1: beautified Stage 2: beautified Stage 3: beautified Stage 4: beautifiee Stage 5: BEAUTIFIER

[@trieulieuf9]

How does this malware author get it installed in victim machines?

[@dar1n_fgp]

I'm wondering that too (I'm new)

[@420Schmat]

Amazing as always!

[@creativereasons7588]

LIGHT MODEEEE AHHHHHHHHH MAKE IT STOPPPPP, and then you beef me for JavaScript.. low blows dude low blows xD Na for real keep it up dude these viddies are great

[@ivanboiko8975]

many thanks for content, man

[@blazi_0]

line 220 in 4:51 it's variable but without name 🤔

[@mihalachebogdan1]

Microsoft Defender better watch out

[@FalcoGer]

I think the simplest thing would simply be to rewrite the "eval" function to print instead. it would also be somewhat more secure since it might be called from other places as well.

[@imroot2454]

Where can I get the original sample? :(

[@rydmerlin]

When does this actually trigger? When does it hijack the clipboard?

[@paashaasXD]

What if the maker of this scripts is watching this video xD "oh shiiiiii"

[@mauritaniainjector3736]

Very Good my teacher 👨‍🏫

[@jameselliot9114]

0:30 onions aren't spicy, John 🤦‍♂️

[@killerskincanoe]

Is wscript enabled by default in win 10?

[@mpcabete]

why did the developer used the "new function()" syntax in the first layers instead of an eval? it is an evasion technique?

[@maxpowell3528]

Solid chance this is the reason why ! Also maybe just to throw off researchers.

[@Freeak6]

It feels good and sad to see that these guys put so much efforts to obfuscate and encrypt the code, and you can just remove the eval function and let the computer decode all of it for you ^^

[@theSidyous]

Could you try the notpron riddle - see how far you get?

[@pedroneo4103]

do you have a discord server?

[@eugene5096]

How they make people to download and run this script ?

[@bhagyalakshmi1053]

Why to file Wi-Fi hack the handling.

[@BryceChudomelka]

I would be interested in building something that automatically beautifies. We could use Go and an API call. Thanks for the content.

[@bbowling4979]

John, where do you get your malware samples from?

[@guilhermebotossi]

I was going to ask the same thing!!!! Hope someone answers!!!

[@guilhermebotossi]

maybe is something from virus total!!!

[@guilhermebotossi]

after asking some friends about this, I found this repo github.com/Virus-Samples/Malware-Sample-Sources

[@regishbabu1790]

hey John, i am new to cybersecurity ..just subscribed

[@yourfellowhumanbeing2323]

Malayali aano

[@3xpl0i79]

@@yourfellowhumanbeing2323 alla

[@grandmakisses9973]

@@3xpl0i79 lla

[@gotithowigetityoutube8144]

Now what are you consider this kind of code malware spyware or adware

[@yourfellowhumanbeing2323]

@@3xpl0i79 hehehe

[@strong2147]

hey everyone I was asking me one question, how can we get tha kind of Jscript/VBS/VBE/... files can someone help me thanks for your answers

[@whtiequillBj]

I love how languages over lap -- di comando e controllo

[@custume]

great video 😉

[@Bluscream]

Thanks John. You really inspired my to sit on my lazy ass and continue watching your videos!

[@heizenbergwhite5669]

Your the best men 🔥❤

[@DarkAngel-ov2fu]

I am surprised only eset detected it

[@letsrugem]

i don't even understand it but I still keep watching. I don't know why.

[@cloud7982]

I was laughing so hard as it went further and further down the loophole and when it got to stage 6 I was dying

[@ieatpushpops]

I enjoy your videos because of the not-so-awkward silent moments.

[@cweasegaming2692]

I am once again asking you to beautify the code

[@bhagyalakshmi1053]

Thanks 🙏

[@DawnBriarDev]

Now if only it was this easy to find their current physical address. I'd go say hello to them, and introduce their backend to a soft viper.

[@caleboleary182]

I've heard of similar malwares that have a whole dictionary of addresses bundled with them, and will sub in the one that most closely matches the real one they're replacing. Spooky scary. Always check your addresses thoroughly, not just the last couple digits!

[@theairaccumulator7144]

Was about to comment that whoever made this malware should've done exactly this.

[@sandeepkrishna504]

Is there some tl;dr for this video?

[@gauthamkrishna.s2912]

Don't mind me, just keeping up the engagement.

[@Californ1a]

Any plan to do the Wreath network? Would love another super long livestream like Throwback going through the whole thing.

[@grandmakisses9973]

Yes ^^^

[@giovannitomczak6826]

Dude that box keeps disconnecting. I really hope he does it so the devs can see how bad the box is.

[@lawalargungu4257]

I'm still thanking everyone who recommended *4matic_hack_* here, you all are the real Life savers,my business account is back finally with his help.

[@danthe1st]

In other words: Don't use js for malware...and also don't use other languages for malware

[@pXnEmerica]

Why write a tool to unpack it? Write a tool from the parser/processor and list/breakpoint when functions happen. You run the code, it tells you it tried to access these methods, this many times. Skip a ton of obfuscation possibly and get more to what it's actually trying to do. When it tried a shell.run, print the commands, when it tries a sendhttp, don't and print the request.

[@alvarocarrascosapenabad4355]

A tool to unpack it is obviously much easier to program than what you are suggesting, but this is indeed a great idea!

[@leuropaische]

its march 10th 2020

[@metalpachuramon]

Wait, so is there a way to report your stolen btc, or do these people simply get away with it?

[@aoufiayman6274]

cryptocurrencies transactions do not have a third party to manage them ( like a bank ) so yeah they simply get away with it

[@randykitchleburger2780]

1:15 almost slipped out a BULLSH**