PowerShell CRYPTOSTEALER through DNS

j-h.io/snyk || Try Snyk to find vulnerabilities in your own code and applications FOR FREE ➡ j-h.io/snyk
🔥 KZbin ALGORITHM ➡ Like, Comment, & Subscribe!
🙏 SUPPORT THE CHANNEL ➡ jh.live/patreon
🤝 SPONSOR THE CHANNEL ➡ jh.live/sponsor
🌎 FOLLOW ME EVERYWHERE ➡ jh.live/discord ↔ jh.live/twitter ↔ jh.live/linkedin ↔ jh.live/instagram ↔ jh.live/tiktok
💥 SEND ME MALWARE ➡ jh.live/malware

[@Aurem_YT]

Powershell is so cool, you never have to worry about installation. Makes it easier

[@rodricbr]

yeah, I've never had much disposal to deep learn ps but it's really cool

[@manisharrora9525]

Already stopped the same attack thanks for this. Also did the malware analysis of the .ps1 file.

[@DS6Prophet]

John, you are an amazing Fella who always makes AAA+ quality videos! Huge props to you!! 😊 I really have obtained lots of knowledge from your videos!

[@Lampe2020]

18:35 That looks like someone actually modified the malicious DNS record instead of just removing it XD

[@autohmae]

yes, exactly

[@justinpinson8575]

Love this content! Thank you for the analysis as always ❤️

[@allurbase]

That UUID at the top of the script in the registry is probably to change the signature of the script.

[@bhagyalakshmi1053]

Sho talented person. translation master and brother.

[@stopper0203]

Love these videos 😎!!

[@DarkFaken]

Thanks man!!

[@hyklmcjger9232]

Great video! Almost went into the rabbit hole together with you :D

[@averagejoe404]

yeah right

[@theblankuser]

Powershell stuff is interesting af

[@luketurner314]

13:01 and I'm here for it

[@NederlandsPersoon]

uuh, wtf. I found this on a pc two weeks ago, 3 PowerShell files with a name of 4 random characters with the exact same contents. I correctly identified it as a virus and did some research, after deleting it there still remained some other parts which I could not find (I am a noob on this), so wiped everything. Amazing to see a video on it

[@NederlandsPersoon]

I did think of sending it to you, just to see. But did not do it in the end, idk why

[@muhammadtaha2578]

love your videos sir

[@pdkama]

thanks

[@Sestain]

I had this too and not sure where I had gotten it.

[@khush1980]

Good stuff here.. thanks What editor is that please

[@smtp4626]

sublime text bro

[@mynamesaretakenwtf]

How are they injecting and running the PowerShell? It feels like we’re missing the initial attack.

[@Dakktyrel]

Phishing or adware would be my initial thoughts.

[@UnfiItered]

Temp files/adware/malware. Unprotect your computer and visit as many fishy websites as you can. Then turn on your protection and watch it pick up a bunch of stuff in your temp folder.

[@raiddesu9687]

coolbase64 package for sublime would be useful for this kind of stuff since you do a lot of decoding ,you can just select and decode in sublime directly

[@TechSY730]

For a moment there I thought scambot (EDIT: now banned and deleted) was doing a ^this style comment to reaffirm your suggestion. Which very well may be the first and only actually useful thing it did.

[@mattchub9887]

Do you ever go live??

[@bhagyalakshmi1053]

Great master

[@muhammadtaha2578]

great

[@asbestinuS]

How did you get to stage 2? Did I miss something? These ps1 scripts are just reading from registry and getting values. What values are they getting?

[@UnfiItered]

So after the first stage ran, it output a base64 code. He decode it and it shows a block of code. That code is the second stage.

[@3WL2]

Stop fast forwarding through the video and you won't have to come to the comments to ask dumb questions.

[@BryanLu0]

Obviously, this malware sample comes from a Windows system. He just pulled the registry values off the system

[@asbestinuS]

@@BryanLu0 I see, thank you kind sir.

[@VulcanOnWheels]

3:23 Shouldn't that have been, "to be able to be *run*?"

[@demotedc0der]

aaawesome !!!

[@bhagyalakshmi1053]

More videos also following master

[@muhammadtaha2578]

nice

[@htconex19062012]

This is so crazy 😂

[@jpsl5281]

Why they store payloads as byte arrays?

[@Sestain]

Most likely harder to detect since it needs to be put back together

[@brylozketrzyn]

One more reason to analyze DNS traffic

[@scrpiona]

how to? any software or tips?

[@brylozketrzyn]

@@scrpiona Suricata + Elastic Security with Machine Learning module. Easiest, but needs ML license. Still few orders of magnitude more accessible, than some popular solutions

[@bhagyalakshmi1053]

One 🕐 login all

[@chicoern]

Mind-blowing how these files brutally murder PowerShell. Even if you think about creating a file that doesn't make sense, to help disguise the malware, these scripts are terrible.

[@DiSiBijo]

huh?

[@keylanoslokj1806]

He tripped?

[@ancestrall794]

I think he meant that the person who wrote the powershell script did a really poor obfuscation job

[@Meletion1]

Second view including him!!!

[@animeworld4775]

What is crypto jacker

[@blackpinkmedia]

It's JM

[@animeworld4775]

@@blackpinkmedia JM ?

[@blackpinkmedia]

@@animeworld4775 Joe Mama

[@imyoubutbetter9951]

bro i m overwhelmed what programming languages do i need for cybersecurity?

[@taureon_]

what are you attacking?

[@imyoubutbetter9951]

@djr thanks man appreciate it also what can i do with java?

[@ytsine404]

😅

[@logiciananimal]

Ingress/egress by DNS is so brutally annoying!

[@onmc4754]

Wat

[@Meletion1]

Lol holy 20 secs early

[@gavithgethmin8373]

I am in sri lanka. Fifteenth yeah old.

[@dannyuwu3741]

You will one day be very powerful

[@techjack1848]

Nice!

[@hackvlix]

Yeah!

[@Redstoneprojrjr]

Grape! You will be good.

[@pakekoding]

They tell me to keep comment on your video to get more subs. so, am I need auto comment bot or something? 🤔

[@yours-truely-sir]

third

[@bhagyalakshmi1053]

Codo details (echo Iymjmjimy) creation of the code different

[@bhagyalakshmi1053]

So experience tools and codo nt mes tycopo mistake never to give up open tool hydel.

[@commanderpaladin]

The guys that saved everyone from becoming victims. GG

[@JavierVelasco8]

Omg i was like 1000 🥹 thank you, John. Amazing content as usual