Free Coding Tool Distributes Malware

[@_JohnHammond]

To be clear, the website freecodingtools[.]org no longer includes this malicious payload in their obfuscator. They reached out to me over email and explained this was due to a previous breach of their servers, but this has since been fixed. Free Coding Tools made it clear they never intended to distribute malware, and I had no intention to suggest that they did. ✌

[@hackeronx]

Firefox flagging as malware, would be interesting if you find anything on it

[@UltimatePerfection]

That's good to hear it wasn't done on purpose. Too bad their security sucks enough for them to get hacked like that.

[@advertslaxxor]

@@UltimatePerfection And that their practices suck enough that they don't mention it on their website!!

[@jamalabdisalam8578]

bit late of them, once something like this happens they should be done as a service.

[@cozajeden]

@@UltimatePerfection I hope that they learned their lesson and improved security.

[@amateurprogrammer25]

very polite i think of the people who wrote this malware to leave the comments in their code when they shipped it, to help future security researchers

[@scragar]

I don't think they wrote the malware, not really. The script looks like the output generated by a few tools to write installer wrappers for you. The only thing unique to their application over any other admin application to run at startup(for legit reasons like providing a VPN or checking a hardware device/driver) is the naming, and often that's pregenerated from a prefix by tools to ensure that it doesn't conflict with other logic sharing the script.

[@furttech]

i always comment my malware... dont want others to think i am a troglodyte.. :) // this prints a message console.log("a message");

[@ChrisWijtmans]

its a bunch of libraries and tools they used to make the malware not the malware itself.

[@tecknows]

A good mentor always teaches his protege'/s discipline, which proper commenting is considered good house-keeping and proper etiquette. ;-)

[@Sparks621]

There are so many flaws with the obfuscator website's logic. If I'm trying to PROTECT my intellectual property, the LAST thing I'm gonna do is take it and paste it into some random stranger's website. And then running the "obfuscated" code on any of my machines is even more mind-boggling. It's almost as bad as the low-budget nigerian ransomware meme where they just leave a text file on your desktop asking you nicely to encrypt all your files and give them the key. You'd have to be truly unhinged to fall for this.

[@serkhetreo2489]

Abeg why u add Nigerian there😢😂

[@Tonksec]

@sparks621 Nigerians are 10 percent in NSA.

[@0LoneTech]

Are we just ignoring that the primary function of obfuscated code is to disguise malware?

[@inverlock]

@@serkhetreo2489 scammers lie about who they are in their emails they send to elderly folks to try and trick them. Pretending to be a Nigerian Prince is the most famous example.

[@DallasGraves]

EXACTLY!

[@realMattGavin]

I stop watching John for a few month maybe longer.... He had 250k subs... When did he hit 1 milion? 😮 Congrats john!

[@scbtripwire]

You can tell a base64 encoded string is not what it claims when the string generated is WAY too long compared to the original code.

[@rembautimes8808]

Good that n8n sponsors content creator. Will keep a look out for it

[@DeNikow]

Last time I had to deobfuscate an obfuscated python script I just turned the exec function into a print. Seems a bit easier.

[@Hellscaped]

doesnt work when its multilayered, that only works when its a monolayer obfuscator

[@jordanmatthew6315]

Man programmed viruses are so amazing, just the sheer mental process in order to make it happen - its like being a detective at a crime scene piecing everything together the deeper we go . . . . i love it.

[@electrified0]

It should come as no surprise that executing unverified code is extremely dangerous. Anyone doing obfuscation should be using one of the many open source options you can run locally on your machine with full confidence that it's not stealing your code or injecting anything naughty.

[@kleinesfilmroellchen]

The weird HTML looks like part of the Brotli compression scheme's static tables. Since Brotli is optimized for Web content it contains things like JS and HTML keywords in its tables. I'm guessing that this is part of the bundled Tor client's Brotli implementation, since the standard Tor client is based on Firefox and Firefox has native Brotli support as an HTTP transfer encoding

[@samwood3691]

This is awesome (and scary AF). Great to see a peek into some malware. Subscribed

[@lalanotlistening]

Hi John! I love your vids! I learn tons from them and always find them interesting. 🙂 I have some audio-related feedback I hope is welcome: I think there is an overly aggressive compressor somewhere in the vocal processing chain. I think relaxing the settings on this to preserve more natural dynamic range will reduce listening fatigue in your audience and may result in longer watch times. Thanks for another banger vid!

[@loptatyson8095]

Yep. With my Sony headphones it's easier to hear, I can lower the volume but I still hear the voice on steroids somehow. But I guess most listeners don't hear / don't care .....

[@nordgaren2358]

The volume is normalized to KZbins standard. Stop listening to things on full volume.

[@lalanotlistening]

@@nordgaren2358 I’m not talking about normalization, which is just a flat volume adjustment across the board, I’m talking about compression, which modifies loudness by different amounts over time to bring the loudness of quiet sounds and the loudness of loud sounds closer together.

[@danielsanichiban]

Definitely too dense

[@nordgaren2358]

@@lalanotlistening voiceovers are compressed. That's how it is. They need to be. It's for clarity.

[@dipereira0123]

I cant express in words how fascinating your content is =) keep it up!

[@Grommish]

HID = Human Interface Device? Could it also be a keystroke logger?

[@raspy_on_osu]

could also be Hardware ID, but i think that's usually HWID instead

[@ChrisWijtmans]

keylogger and perhaps a usb file downloader or usb identity/crypto device stealer,

[@xorinzor]

That HTML page looks like one of the pages you sometimes find in google results from completely random domains that just try to match on some keywords and get you to click on them. It probably then tries to redirect to some scam site, or download a file. My guess is it's not intended to be deployed on regular desktops, but perhaps will be used when it detects a webserver process running.

[@tecknows]

I would want to look more at the HID component. It isn't likely, but possible that it could use USB peripherals for other purposes, or attempt to locate storage to copy itself to.

[@paulthomann5544]

"... obfuscation, this method makes it difficult for hackers to gain access to your sensitive source code." - free coding tools python obfuscator page shown at 13:57 . Obviously it does not. All it does is make it hard/impossible for much less technical people to read the code. Such as the users of that page :P I of course hate malware in the wild and anyone who spreads it. But to be honest, there's kind of a satisfying instant karma component to seeing "security by obscurity" used against the very people subscribing to that mind virus :D

[@fascinatingtome]

Once you've noticed the lack of a pop filter you can't go back

[@nordgaren2358]

Yet nobody can point out timestamps that need editing

[@skylarkblue1]

@@nordgaren2358 As I read this, another pop that was super annoying happened, 14:26 it's constant through the video.

[@iusegentoobtw]

it has a windscreen on it already. An additional pop-filter is silly in this context. Also, the audio sounds great.

[@skylarkblue1]

@@nordgaren2358 Well I did try, seems like the comment got deleted. Hm.

[@JeffTiberend]

You have me hooked. This so fascinating and scary.

[@elytra8]

You deserve more viewers!

[@furttech]

I have seen this a few times before on "free tools".... An attacker will embed a script into a compromised server, package or tool. This was a creative method for propagation. I wonder how long this was active...?

[@makkam7575]

Just thinking about it I have 2 things in mind. 1. How dumb are you to create an obfuscator for an interpreted language like python where at the end of obfuscation you can have the original variable names. At least obfuscate those and do some random stuff 2. The scary part is the at 127 rounds of deobfuscation necessary to get to the "raw" code. Theoratically the actual malware execution steps could be split and executed during the steps of deobfuscation which can make it hell to debug and reverse engineer

[@ericmyrs]

So workflow automation is what we rebranded RPA as?

[@GRHmedia]

I suspect given the compilers and such they offer there.Someone may have used one of the online tools to infect them.

[@AaronFord-bn7dm]

Then I’m your number two fan!!

[@cpallphotog]

The miner section, I wonder if this was a decoy or its main purpose. Was it setting machines up to be mining bots?

[@MyCodingDiary]

Your channel is like a hidden gem on KZbin. So glad I found it!

[@nvs-different-ideas]

Hi, just want to know to detect app that output music on Android, because I can NOT find app that will do that, and this annoying music plays every 1:16am or 2:00pm and the 3C Tools(3C All-in-one Toolbox) do not show app that is outputing the music(I try killing apps/tasks and the music do not stop) + Android do not show the music in notification menu

[@furttech]

i wonder on the C# hid device library... could that be used for parsing keystrokes>?.. detecting 2factor like ubikey.. detecting hard wallet?

[@Z3rgatul]

It can be used to get keyboard/mouse inputs (however there are a lot of ways to do this) It can be used to detect any USB devices

[@tutacat]

I think these websites may have advertently or inadvertently used the same infected pypi module. Or X website also hosted their module on their own website. Or a site was exploited.

[@FeckOffTeaCup]

*Sees title* Me: "It's VSCode, isn't it?" *Watches* Me: "Damn it."

[@ZM-dm3jg]

Another Dev on my team hated VSCode. Now he's been fired for low productivity while I got a raise.

[@owlmostdead9492]

@@ZM-dm3jg And everybody clapped

[@wafinashwan8242]

Neovim and emacs maybe the best editors

[@Master120]

​@@wafinashwan8242 Neovim is no joke, i used to use VSCode, i tried Neovim and it really makes you do things faster, also doesn't spy on you.

[@MAX-nv6yj]

This will be interesting to watch. Thanks John

[@Nightritual1332]

Longer the video the better. I enjoy watching your videos

[@TheGamer_Zero01]

What keyboard is that!?

[@jonohiggs]

@38:20 System.Reflection.Emit.ILGeneration - Very interesting to see there, I don't think it is a standard include for dotnet and would allow JIT compile of any code within the malware that is further obfucated or was being sent back via TOR

[@Z3rgatul]

It can be used for legit purposes, like generating serializers on the fly as classes in dynamic assemblies.

[@YoutubeWatcher264]

Bouncy castle is an old cryptography library

[@hharris712]

About 35 minutes how did you write multiple lines at the same time, think it was 25 and what was the editor

[@februalist4686]

i love long videos John

[@borgo_yz]

Just to let you know, i got a malware from this some time ago... Edit: I removed the malware by deobfuscating that .pyw file and came to the conclusion that my antivirus blocked it because for example in the task scheduler or windows defender exclusions the specified paths didn 't exist, i still removed everything tho

[@aldak8635]

The icons that you found, looked like ms sql icons. Maybe a light sql client?

[@Hybrid_Netowrks]

John the KING

[@jamalabdisalam8578]

using a obfuscator site is something else, if you want to hide your intellectual property there are better ways, e.g. create a web app.

[@NSA-admin]

That html looked like it was encoded via whole ass words lol. That makes me want to write a script.

[@bestnewb]

the legion of the bouncy castle...

[@AgentM124]

Really enjoyed the last 2 minutes of the video. Sketch.

[@smedley76]

Sounds like it does similar to that one package that got found in aur

[@sakuchi4914]

This is such a cool vector of attack, that exclusively pointing towards cyber researchers. Should really be more mindful when doing this :V

[@MrRecorder1]

Ah yes... good obfuscators blow up my 20 byte script to a 40 MB file when starting with a string like `print("Hello World")`. Nothing strange about. Let's just copy-paste that whole thing!

[@chrisclark5135]

Amazing, John! Thanks so much!

[@parshva3516]

10:58 what's this terminal? Anyone?

[@nordgaren2358]

Terminator

[@jvsonyt]

Who owns the website?

[@BuyMore88]

When John disapears for 4 days you already know he's balls deep in terminals and sublime text editors contracted to figure out what no-one else can in the latest and biggest breaches yet! (CHANGE HEALTH THATS YOU, SORRY! I'm ready for the video John! You are friggin genius tbh man; You can learn a shitton watching your videos and I appreciate them btw & fyi! 👌✌👍🤜🤛

[@lorenzo171200]

DO NOT USE THE SITE! STILL ADDS THE OBFUSCATED CODE AT THE BEGINNING OF THE SCRIPT

[@bakedbeings]

I don't know why we're shouting!

[@Sypaka]

This may be a wild guess of me. They drop a TOR exit node, which can only be used by certain users. The discord webhook thing should tell them, when a node is up AND also sends keypresses using the HID lib. So they mine XMR on the victim and also use their bandwidth exclusively for shady stuff.

[@BsktImp]

Just makes my point that unless you're someone who can use a disassembler, understand source code and even decode hardware I/O voltages you cannot trust anything. Anyone got a cave going spare? 🤣

[@perroes]

anyone knows if anaconda could have pulled a malicious package by default?

[@richbaird9407]

wayback suggests the change to remove the malware happened on Feb 18

[@djrobSMV]

"Thangs MR JOHN HAMMOND"??

[@julianweber1113]

I wanna guess what the malware shall do: 1. After setting everything up, it connects to the Wallet via Tor due the specific notes 2. Cryptomining 3. Reporting status to a hidden dc server (maybe also due the noted Tor notes)

[@chri-k]

the HTM file looks like a weird n-gram cipher with a corpus of HTML and Chinese ( maybe??? ) I don't know what's happening with all of the missing spaces and the random dump of Unicode though.

[@CU.SpaceCowboy]

the author put in so much work but ruined it by using desktop runtime

[@NinoValbiskoni]

keep it up 🎉

[@cvall1710]

John: We could open Ghidra on this code chat... SQUIRELL! Lets look at this over here in ILSPY... SQUIRELL! WHOA guys look at this sketchy code running over here...SQUIRELL! Pick a lane John XD Love, Love, Love your videos. Dont change.

[@PlayXVIP]

Bro is a top tier genius how in the hell. I feel sorry for any future ex girlfriends 😂

[@GoatZilla]

Lord this isn't 42min worth of material

[@mehraproductionkathua9343]

Sorry for that what are u say I m understand so may I request KZbin pls translate to hindi language becoze I m not understand . This is option is very important us Like mx player etc enother apps Regard mehra production

[@imbadatcod7208]

why do you only use one finger to type with your right hand?

[@tutacat]

The amount of scammers using discord as a free less-traceable server is unnerving

[@motbus3]

Maybe their code detects if specific libraries or snippets of code exists and only activate on those situations

[@centdemeern1]

Why is there a whole lot of nothingness at the end of the video

[@DM-qm5sc]

Look at the keyboard and type with only one finger? I was told that you cant be successful unless you dont look at the keyboard and type over 75 wpm

[@outtakontroll3334]

you were lied to

[@TheGamer_Zero01]

Did you think about running the script in a virtual environment. Maybe the website will allow access to the script.

[@K5RTO]

great vid

[@EnLopXf]

LOLBAS next upload Jhon

[@Im_Blue]

Casio ❤

[@vojtechhron1528]

wow thats cool

[@shadowplay56]

I also used that website. I stumbled upon this video only now though (about 8 days after first using said website and when searching my filesystem for "Windows Update Script.pyw" It shows in the History as visited once.) Oddly though: I don't have an "%LOCALAPPDATA%\Microsoft\Windows\Application" path. Neither have I found any traces of msedge.exe (I uninstalled edge a year ago) nor a Runtime Broker.exe and no Scheduled services the are malicious. Have I gotten away from the stealer or was it because of my jank filesystem structure? (I have many things moved to a different drive so that I have mor space on my Windows drive, it's only 128 Gigabytes and the installer would probably not even have had enough space on the drive to be installed lmao)

[@yante7]

w video man

[@djrobSMV]

"WOW"

[@SkyRiderJavelin]

Take too long to get the point

[@NyscanRohid]

"obfyewwscate", you say?

[@donnabuckalew-wagner6431]

❤❤❤❤❤❤❤❤❤

[@Kioki1-x8p]

It's called Ob-fuss-cator not Ob-fuse-cator.

[@pmcgee003]

Noooo

[@fadiallo1]

Yes yes yes implode yes

[@akerioth]

You destroy the Channel,where is the CTF Videos,i start watching you Long Time ago ,only for CTF ,and now ,i have Not watching anymore ,do more CTF Videos

[@_JohnHammond]

Would you like just anything from CTF time, or like TryHackMe/HackTheBox/practice wargame sites?

[@akerioth]

@@_JohnHammond hackthebox

[@MdHannan-qg8pq]

❤❤❤❤

[@UltimatePerfection]

One more reason people should stop using Python for anything important.

[@jamalabdisalam8578]

more importantly a good reason to stop using code you let a foreign agent encode without having an idea what it's turned into.

[@0LoneTech]

Python is not the issue. It's designed to promote legible code, the exact opposite of obfuscation, which on the other hand is highly suspect. Trusting someone else with manipulating your programs like this is also absurd from any security perspective, which are the only ones where the operation could be motivated to begin with.

[@UltimatePerfection]

@@0LoneTech Exactly. And this is why it's a favorite language of the spineless beancounting PHBs dreaming of replacing his staff with graduates that will do the same work for less. A good programming languages promotes job security over code legibility, because as soon as someone else understands your code, you can be easily replaced. That's why Perl should be used instead - not only it is way faster than Python will ever be, but it also provides a natural facilities to ensure that the company you work for cannot fire you or their software will not be able to be maintained anymore and would need to be rewritten from scratch (a huge cost compared to keeping you employed).

[@MrMeow-dk2tx]

I read your latest reply. Uhhh, sir: what if I'm sending my goddamn code to be open source??? Like, is not just bean counters that need it to be legible!!! What if you're part of a team, or, again, want your code to be open source? You are making a bad argument for your perfferd language, you are pretty much admitting that, because you don't want to be fired, you'd kill other developers time.. . Just to try and screw over big guys? Seriously, dude.... If you wanna really fight the big folks, don't make your code unreadable just to work for big tech, make good, open source alternatives that are BETTER than what they have (don't forget to use the GPL, so incase they wanna use your code they need to open source their project.) In short: don't mess with other folks in your position, just to mess with the big guys. Do something that allows you to work with them so you can do a more direct attack

[@UltimatePerfection]

@@MrMeow-dk2tx Then you can make it legible yourself by following good practices. But under no circumstances you should be FORCED to do it.

[@carsonjamesiv2512]

3rd!😃

[@wafinashwan8242]

2 hours ago

[@MagicPlants]

why are you yelling?

[@nickadams2361]

You would get more views if you include more viewership, this channel is basically a honey pot for idiots to commit crimes and get caught. You'd get more views if you included how to not get scammed

[@MadManMarkAu]

You stopped going through the DLLs right before the last one in the list, the c2hash_00061952.dll.cs. That file is not a DLL, but is actually a .exe that was renamed to a .dll. That was probably the "main" application that gets run here.

[@realdestr0yer]

Next time, keep going. 6 hours straight or bust. We all watch Joe Rogan and Dr. Jordan Peterson because they do 3+ hr videos. Step it up!