Snip3 Crypter/RAT Loader - DcRat MALWARE ANALYSIS

You can register now for the Snyk "Fetch The Flag" CTF and SnykCon conference at snyk.co/john ! Come solve some great beginner-friendly challenges -- including some of my own!
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/john...
E-mail: [e-mail]
Discord: johnhammond.or...
Twitter: / _johnhammond
GitHub: github.com/Joh...
If you would like to support the channel and I, check out Kite! Kite is a coding assistant that helps you code faster, on any IDE offer smart completions and documentation. www.kite.com/g... (disclaimer, affiliate link)

[@qwqdanchun1049]

Well , I have to admit that it once is a class homework , I even make a ppt for it ! LOL

[@qwqdanchun1049]

Really cool video , i love it

[@_JohnHammond]

@qwqdanchun WOW 😆That is incredible. Thanks for checking out the video!!!

[@m3mphi5r4r7]

@@_JohnHammond Please do malware analysis on a ransomware. there is not much resources to learn. i hope you can fill the gap :p

[@emblemi6345]

That completes the cycle. Btw it's a nice uni which gives homework to write a RAT :)

[@bryanandhallie]

Haha, this is crazy how things turned out. Great piece of kit qwqdanchun!

[@diszylam1018]

I'm just learning how to code and these videos make me super excited. I never thought watching someone analyze some malware would hold my interest this well.

[@retroke6560]

lmao same, this is some new entertainment i'm able to enjoy, and each time is better.

[@product_of_august]

Same one of his vids appeared in my recommended and I was hooked.

[@Tempi_]

What are you learning and how far have you gotten in 8 months? I've just started python for data analysis

[@diszylam1018]

@@Tempi_ I started out with intro to C++ where it was the basics like how to print to screen and the likes. Then C++ 1, where we started to get more in depth and build off the basics like looping a piece of code if an if statement that we created was true and learning about nested loops and other more advanced basic functions like really simple pointers. I just finished my C++ 2 class. We started learning how to really use pointers, and that led into data structures like the use of linked lists and basic binary trees. data structures is where learning this stuff gets pretty damn difficult, please if you do get to that point make sure you're not taking too many classes at once so you can focus on learning it well. I made the mistake of taking too many classes and that made it much more difficult to learn how to code properly.

[@thisconnectd]

"he follows me" was the most fun moment by far!

[@imtm]

time stamp?

[@Zyphera]

@@imtm 1:30:10

[@onmc4754]

43:05 if applaunch is open it gets the proccess id (type in cmd tasklist its shows the pid). Then it injects itself into it effectively being run in every instance of every executable that uses dot net framework with forums. Kinda clever hard to detect which process is the one doing the malicious stuff meaning this could be hard to remove without the right tools.

[@Stagnating_]

The reason why many scanners tag it as AsyncRAT is because DCRat's code is largely built upon it, most of the core features have been copied directly. I've been following this chinese guys work for a while and came across all kinds of interesting stuff, the language barrier is a bitch though.

[@arzi2054]

This guy in one malware program wrote more code then i in my entire life xD And in description he puts "a SIMPLE remote tool"

[@raddons]

I love watching videos like this when I know absolutely nothing about scripting, it's confusing as hell but also entertaining

[@XGalaxyPlqyZ]

Same bruh xD

[@springchickena1]

@@XGalaxyPlqyZ as we all know it's a requirment to learn R to understand any youtube video about hacking.just throw away python and oracle programming. what you're going to want is to learn assembly and best way to do that is with elon musks lovelace rs fmri net since thinking is power

[@faint.2396]

@@springchickena1 Thanks!

[@XGalaxyPlqyZ]

@@springchickena1 Thanks

[@WagWanTeleban]

@@springchickena1 what??

[@callmemc6]

Idk how you do it John, but somehow you make entertaining videos while doing one of the most raw forms of data teardown in command shells.

[@arif8434]

the talking and he explaning stuff help so much

[@myndzi]

The urlencoded text was clearly not ascii text, so utf-8 was definitely not the correct encoding to use -- but I was curious what the correct approach in Python is, and there are actually a couple interesting things: - Using urllib.parse.unquote(data) is already irreversibly mangling the data. It performs a conversion step (taking the string to be percent-encoded data as bytes(?), and producing a string with unicode code points based on an encoding), with the encoding defaulting to utf-8. The gzip header includes an invalid sequence, which gets replaced by the unicode replacement character (U+FFFD), so the first four characters in the sequence (%1f%8b%08%00) become \x1f\xff\xfd\x09\x00. This is irreversable, since the data (\x8b) has now been lost. - You tried converting the result of that to bytes with latin1, but you already had the (already-mangled) data, which would have been correct if not for the implicit encoding step by unquote. The unicode replacement character can't be encoded as latin1 data into bytes, so it threw an exception. The correct code appears to be `bytearray(urllib.parse.unquote(urldata_bytes, 'latin-1'), 'latin-1')`, which gives `bytearray(b'\x1f\x8b\x08\x00')` I found it interesting that this is particularly obtuse in Python and that there seems to be no really obvious/clean way to "just do the thing"

[@stevebanning902]

Damn you are 1337 dude

[@Safex]

thanks for the explanation. that this has always puzzled me. have a lot less knowledge about what goes on under the hood than you, but parsing things from bytes to strings and between different encodings is pain in the ass.

[@myndzi]

​@@Safex I don't really know anything special about what's "under the hood" here or Python, I just saw something I didn't understand and wanted to understand it. I experimented and read docs. That's how I learned everything I know: be curious, explore. Make a habit out of that, and you'll build up a base of knowledge. You accrue all sorts of useful tidbits this way. As an example, I'd like to elaborate on my comment about "clearly not ascii text" -- I phrased that poorly (which is probably what the troll above was reacting to) -- but it derives from just a tiny bit of information about how the ASCII table is organized: Uppercase letters are 010xxxxx, where xxxx=1 is "A" and xxxxx=2 is "B" and so on. Lowercase letters are 011xxxxx. In hex that makes letters fall into the range 0x50-0x8F and space is 0x20. Anything less than space (0x20) is a control character and generally not present in text. That's a pretty restricted set of values, and once you know that "one weird trick", you can make a good guess as to whether you're looking at text or not, even if you don't immediately know what it says. (Unicode encoded as UTF-8 has clear patterns too, in addition to sequences that are invalid) Compressed data (by its nature: read about entropy coding) is pretty similar to random data. If you're looking at a compressed data stream, then aside from any magic/header bytes the values will be all over the place without much of a discernible pattern. An executable or some data file may have some bits of "ascii" text mixed in, but also chunks of null bytes, or small/large bytes that don't look like text. It will look like it has structure, but it won't consist entirely of text-looking content. With all that in mind, even the first four bytes "%1f%8b%00%00" suggests that the data isn't text-based (especially in light of the null bytes -- %00). It also suggests it isn't compressed (there's clear structure). Anyway, I just wanted to mention that there's no magic here, just curiosity at work. Anyone can do it, and I encourage them to :)

[@babybirdhome]

@@myndzi This is the correct approach, it just requires patience and persistence which is hard if you’re expecting instant results and want to be like John on day two. That said, you’ve gotten a lot further than I ever have with character encoding. I’ve only gotten deep enough to know it’s complicated as heck to step into, and only know enough that two tools are handy when you’re new and still trying to figure things out. CyberChef has two tools - Magic, and one for character encoding brute force that can be very helpful to start you off or sometimes just get you a quick result when you don’t have time to dive deep just to learn.

[@XENON2028]

I had a feeling it was the wrong encoding but I never knew unquote would encode into utf-8!

[@trottingfoxinc]

By youtube logic, nearly 2 hour long videos containing nothing but code shouldn't be interesting. But my god sir, I only started playing with C# in Unity a month ago, and not only am I loving watching all of these, but I feel like I'm learning way more than I did from any of the online courses I've been doing. I've gotten so much exposure to the inner working of computers, and how other languages look both familiar and different, and it's been FUN. There's even starting to be moments where I'll catch onto a pattern or what something's doing at the same time you do, and it's been an amazing brain exercise learning to not only keep up, but also to look for things myself. I'm learning coding both as a hobby and an auxiliary skill to my career (I work in entertainment production), and these videos are both fun and invaluable. Thank you!

[@DimkaTsv]

I just watch this like "How it's made" or some detective stuff... Feels good. And i am not even a coder (literally cannot do anything i require sometimes without google).

[@snafulegend6689]

It creates c++ code, compiles it, sets up 2 ways for the malware to execute automatically incase one fails. It replaces applaunch which start automatically with the framework and on startup. It stores itself (the "exe" is compiled in c++) in memory. Easy. Projectfud = a library stored in your memory doing things. It launches on start up 2 different ways.

[@CielMC]

Hey john, chinese viewer here, according to the author's bio, he is preparing for a postgraduate exam and all of these seem to be just passion projects he is making for fun as his bio would imply. If you have any more questions, feel free to ask, hope that helped.

[@stinkytoby]

The follow reveal was golden

[@stefsot2]

"RunPE" refers to code that loads a host process and replaces the PE (hence the name) executable with another one. This is done to execute a windows PE file (.exe commonly) in-memory without writing it to the disc since windows requires a process to be loaded/created from a file on disk. This essentially creates a "zombie" process that points to a specific PE file on disc but inside it executes (hosts) another PE file. You could of course construct a "shellcode" so you dont have to "zombify" another "host" process but this requires delicate knowledge and is more complicated. In your video the "AppLaunch" is used as the zombie file mainly because is included in all windows installations, does nothing when launched (although doesnt really matter since the zombie-host process is spawned in suspended state) and contains imports to required libraries that the "parasite" PE file needs. From what I see this is copy-pasted and not really anything advanced.

[@0rez]

Hey. U is smert

[@brinklaubscher8063]

@@0rez u is enterteneng

[@drygordspellweaver8761]

Any examples of advanced stuff?

[@edsongray3356]

I saw some similar program of excel that used the VBA macro codes, the program was made in china. What that program basically did was stole your data with some kind of get string and get tables VBA functions. The problem with security in this kind of software like excel is that you install tools from the web with out knowing that these tools contain malware. Funny story is that nobody believed that. I even got screen shots of the malware code being executed in a window macro of an excel VBA code . It's amazing how enterprises can spied whit a single .file with code. Any way awesome video, very pedagogical.

[@h8handles]

So I just started learning some offensive C# and poweshell and am finally able to wrap my head around these videos and it's helping me understand to be better at offense. Love the content John.

[@ldSt3345]

Hi! Which books/videos/courses do you use?

[@richoffremo461]

@@ldSt3345 Hey Lt, do you still need help getting started?

[@ldSt3345]

@@richoffremo461 not rn. Like, don't have much time, war, that sort of thing

[@ghostofrecon1]

Unsafe allows it to access memory space that isn’t assigned to it by the JIT (example you can’t use pointers unless you compile as unsafe)

[@benney25]

You can copy paste the URL into google translate to translate the page to english :)

[@TalsonHacks]

"Or you can use VSCode if you're that kind of human being"

[@renchesandsords]

idk i kinda like vscode

[@TalsonHacks]

@@renchesandsords I like it too ;)

[@TheIronside100]

so, i got home at 2 am from a guys night out, bought some food and wanted to watch 10 min meme vid... now i am hooked to this.

[@JustTooTactical]

"You can use VSCode if you're that kind of human being." jeez man :'(

[@dedkeny]

That twist at the end though... 😳🤣

[@generovinsky]

Very cool video.. humbled after watching you work. Awesome twist at the end.. ;)

[@bonzibuddy4240]

1:14:00 and before, it didn't show key because you wrote Console.WriteLine("key=", key), which invokes the overload Console.WriteLine(string format, object value). Since there were no placeholders (like "{0}") it didn't format them.

[@matthewmorton7231]

This is great! It's so cool to see someone take the time to make content like this; it's super helpful & not a perspective I usually see. Really useful to students of programming/security. Thanks John :)

[@willk7184]

It makes me sad that so much work goes into hiding something whose purpose is just to mess up our lives.

[@thecowman6807]

It's not though, there is massive money behind viruses.

[@frederiquerijsdijk]

Don't be. Messing up our lives is just colateral damage. There's a lot of money made here.

[@babybirdhome]

I think that from time to time when I’m investigating new phishing emails at work. Like, some of these people have genuine skills and it makes me sad to see them wasted on malicious activity when they could have real jobs actually accomplishing something and doing some good for people. Once in a while you run across something that’s quite elegant and clever, and the person who had the skill to accomplish all that should be using their skills somewhere productive, and if they’re not, then that’s just very sad.

[@charlescoult]

1:30:10 - "He's on Twitter!!" "Should we drop a follow...?" "he follows ME!!!" XD I died.

[@Imwer]

You are "decrypting" malware as I am "decrypting" old, legacy, badly, written source code. Great help and inspiration!

[@remyvanderzijden5213]

"Alright so we've done enough cyber-stalking [...] He is on twitter !!!" Made me chuckle. Then "HE FOLLOWS ME !!!" was hilarious xD

[@blakefuller5255]

I love these videos although I literally have no clue what you’re talking about. Learning cyber security is interesting, but very challenging to start off. Any recommendations on where to start off?

[@jessealves_xc]

Cyber security is a broad topic. Malware analysis, though, requires knowledge of programming, assembly language and reverse engineering, in that order. python, c#, powershell, among other things, were mentioned here, as well.

[@homesystem2287]

And I was like: “HHm..no obfuscation…” Then I saw the RUNPE variable 🤣

[@DissyFanart]

I've been binge watching these malware analysis videos after a friend of mine tore apart a virus I managed to get. If you want another exe (that at the time wasn't caught by anything on virustotal, could have changed since then) to add to the pile of things I'm sure you have to analyze, let me know :)

[@_JohnHammond]

Yes please! Email in the description ;)

[@DissyFanart]

@@_JohnHammond sent! Forgot to mention in the email but I'm sure you'll get a kick out of some of the variable names/values, no spoilers though :)

[@verolyn8459]

God i'm loving this Channel.

[@sdog300]

do you do code analysis's often? i had a lot of trouble trying to learn during high school. ive got turing complete which has helped me actually understand what is happening & how the variable names used by programing languages are used at the bit/byte level. i got a mental block once i got to the actual coding portion. mainly because the whole system is made from scratch besides the few examples they use to get you started. so its a little dificult to use useful name for the bytes with my limited experience with coding.

[@-Giuseppe]

AMSI part is amazing, thank you for the quick explanation!

[@mytechnotalent]

Great job as always John! The INSTALL and Decompress were really crazy. Great analysis.

[@yannmassard3970]

I code games, I wish I could have 2 lives to get enough time to dig into this field. Back top my days, it was only assembly and C++, now the amount of knowledge behind is immense

[@KaizenWebDev]

John i notice you are pretty high in most of these. What kind of weed do you smoke. From a fellow weed programmer. :)

[@0rez]

Instructions unclear. Ran the RAT and now infected

[@Leoshoots]

I watched 100% even I couldn't understand 10%.

[@rafaelgontijo5792]

Great video, keep up with the quality content!

[@GlutesEnjoyer]

This thumbnail gave my computer a virus ngl

[@DanOath1]

Would Constrained Language Mode prevent this attack given only certain Add-Type's are permitted? How do you feel about leveraging CLM for Powershell hardening?

[@Raser1995]

Great video. One request: add key presses to video. I love how you navigate in subline, or tinker in terminal with just a keyboard. Will be great to see what hotkeys are you using. Helps learn that kind of stuff. =)

[@Lampe2020]

This was one of the funniest malware analysis videos I've ever watched XD For example: 1:30:10 "He follows me?!?" It's funny to see you crack up laughing because of that ;)

[@johnnyhun1]

3:44 "Looks pretty suspicious right away" me who is just seeing a bunch of letters: ?? :0

[@Dinco422]

As a fucking idiot (myself in this domain)... you genuinely made this entertaining somewhat... so congrats on that, you have yourself a new sub, I'm gonna check more vids, maybe I'll learn somehow something from this :)

[@ThatBigGuyAl]

Can you send me the file? I need to update my Edge browser

[@tomshanahan3346]

That was insane! What a twist. Brilliant work and entertainment.

[@kipchickensout]

Maybe the BSOD one was for killing a System process in case admin privileges are present and then try to read passwords from the BSOD memory dump

[@milo_andrs]

I was fascinated, there are a lot of impressive things with this specific analysis and it was very rewarding.

[@Snail2G]

Lol. I don't watch coding, programming, or computer videos at all. Tonight at dinner me and my brother talked about coding for 20 minutes or so, and talked about how you could code a snake game pretty easily. Now I've got this video on my recommended. But no, they're not listening lmfao.

[@c1ph3rpunk]

Minor thing, but why do the #!/usr/bin/env python in the script when you’re calling it using python3 on the command line. The shebang (#!) is what informs your shell what to use to run that script, in that case you’re saying “use whatever python is found in my $ENV which could be anything depending on the OS (dist, version, local settings). I would either a) set the shebang to the same used (python3) or b) chmod +x the script and let the shebang do it’s job. Note that if you do the latter and don’t set it to python3, and if python3 isn’t the env default, you’ll likely get Python 2. Using both the interpreter on the command line AND using the shebang with env can cause unnecessary confusion and troubleshooting down the road. 25+ years of +NIX “what the $x?!?!” hard won pain.

[@wayoutstreaming]

What a nice little surprise when the author was a twitter follower. was not expecting that XD

[@Zapperiopa]

Very nicely presented and educational with your own trail and errors. I'm a subscriber now.

[@samuellourenco1050]

The use of gotos tells me that this is a pieced together, Frankenstein monster solution.

[@Icelink256]

You'll get no argument about IDEs from me-- I'm an Assembly programmer, so I just use plain old Notepad! :P There's so many varieties of Assembly language, that syntax highlighting is basically useless, when you're working with bare-metal.

[@wujooin]

can't believe that I watched this video without skipping any moment...

[@SomeUniqueHandle]

I recently found your channel. These deep dives are great for getting better at reading other people's code. A lot of coding channels concentrate on writing fresh, new code, but on the job you often need to read other people's work and add on to it or re-factor it to improve the functionality.

[@MikeySKA]

I'm doing my Sec+ class right now, and this was AWESOME. Will be sharing to my classmates. 👍👍👍👍

[@MrRobot-yb8cb]

Preaty cheap malware, costing for something like 600 rubles (something like 9$) for 2 month subscriptoin, so nothing special!

[@ShamblerDK]

Could you do a video on ZeroAccess V1? It's the only piece of malware, I couldn't remove without reformatting the HDD. (This was about 10 years ago.) I work in IT btw and have done so for ~20 years apart from growing up with computers. I'm from before the Internet. ZeroAccess V1 was an especially nasty rootkit, since you'd see it in Task Manager as a process that looked something like this: "ABCDEF01:23456789" and you could not kill the process in any way. Also, all software, which attempted to scan the HDD for malware, crashed when it reached the malware file itself. Yeah, fun times...

[@Tedd755]

Nearly 300k subscriptions. You do have a Sublime Text license, right?

[@emmashepard2070]

I'm slowly trying to get better at coding this video was honestly super cool. Amazing what you could end up doing

[@SuperZajara]

Sooo TLDR is they bricked their code with zippage, reverse hex-to-string-to-deci-to-binary codeage and programs within program within program^2 so no firewall can detect that shiz cuz its too much work. got it. gotta use this method when writing my helloWord.exes

[@Astralrider-0728]

Awesome video I see how you do this but Hey man I need some help I’ve been trying to find out just how many root kits I have I’ve identified jynx root kit and a few others including a worm..spreading threw everything from Mac OS to windows to Linux .I’ve spend so much time trying to rid myself if these vulnerabilities I’ve spent so much time it’s destroying my life man I was pursuing a career in cyber security and this happens it’s definitely good practice for real world in the wild stuff but I think I need to reach out to the community and get some help as well. If you or anyone is willing to assist in some advice no antivirus picks it up.

[@joshuaprice1535]

Is there anyway to reverse everything the trojan has done in the install process (Like where it patched the Amsi)? I was infected by this nasty little thing on my gaming PC recently and trying to avoid a total clean install as downloading a TB of game data again doesn't sound like fun.

[@EliteRvZ]

I have NO FUCKING IDEA of how coding works, but i still enjoy the shit out of these videos? how?

[@fordorth]

That kind of human being? excuse me sir... I use vscode almost exclusively for everything!

[@concepcionwilson5815]

Love your vids John!!! How did you repair your Amsi-Scan?

[@Amstelchen]

58:00 Win32_CacheMemory is actual hardware (CPU) cache, so of course it is not existant on VMs.

[@SandeepSingh_0x0]

Hactivitycon ended and I downloaded every downloadable challenge to do slowly slowly , as I can do atmost 😅

[@zi9a]

I have a crypted njrat servet since 2016 , and it is still only detected by two protections. Wanna have a look?

[@CySEC-LB]

bro I'm learning the analysis more here than my university Dr. I should call you Dr. John 😂 LoL

[@asbestinuS]

Dear Mr Hammond, am I comment-banned? I really enjoyed that video, very interesting, I learned a lot, thank you very much.

[@jondorf3315]

That's Dr Hammond to you, son.

[@rootney]

What program is he using? Does it decompile binary files or just a text editor. I rember hearing that tge fbi or nsa was reseasing an inhouse tool for reverse engineering of binary files

[@LooseGripHandle]

Was a few BNB invested into a BSC token, he claimed he had be attacked by a RAT im here to learn more in-depth

[@loyaltothegame89]

Dude... Garbage code and b64... do something more serious ^^

[@tylerboyd942]

I’m new . I’m looking to learn and join a community. I would love if someone could reach out to help teach me !

[@katieg2277]

the amsi break is the scariest thing I've ever seen on youtube and it's freely available 10 keystrokes away. thanks i hate it

[@ShamblerDK]

You don't have to zoom in on anything. Everything is clearly visible as-is :-)

[@timrustle6114]

I think you uploaded the version where you already replaced some encoded values with their actual values to virustotal

[@cgnewbie09]

$TP = target process id think, i didnt really think about it until i watched this video this second time 8) great videos

[@dillons6721]

I've never even touched any of this stuff and know nothing about it. Yet I watched the whole video because of your explanations! Great info for anyone looking for it. More please!

[@seraphsilent5255]

and a huge draw for me personally is the voice! the sound and personality just drew me in and he's completely speaking greek

[@idkwhattosayxD]

found it funny how you said ok enough cyber stalking and then debated on following him on twitter 1 min later haha

[@jonesconrad1]

I'd never though of pronouncing it GUN - zip before.

[@scotthill7659]

before trusting google hits for your filename use the md5 or other signature to see if you are actually talking about the same file as in the website

[@aplcc323]

So, I learned that if you're going to fuck with malware, you best use a codedom...

[@larsappel7813]

28:00 Just type "cls" or "clear" without the "" of course... Where is the problem?

[@garethjames8307]

This literally blew my mind .... I love how you keep saying "You just do this ... simple!" ....Uhm, yeah OK John ... we believe you. Real simple :D

[@silentfox8]

no idea what the fuck youre saying BUT you make this very entertaining to watch

[@NickMasseyRideon]

I have zero idea how I got here but, dang! this is sssssssssooooooooo cool! subbed!

[@DordiHOTS]

cool to see you reverse engineer and decrypt all the malware code and analyze it lol.

[@whooptapus8298]

Ohh no not me again on the wrong side of youtube acting like I know what the hell is going on

[@whatamitalkingabout3]

Why do the bytes in the array in the very beginning being of value 0-255 tell you it could be ascii character? All bytes ever are 0-255...

[@XENON2028]

they are referring to bits, a byte is 8 bits but they can refer to a 16bit character which is two bytes, or a 64bit character which is eight bytes

[@nickadams2361]

Wow that is stupid simple c# code but very horrifying

[@cuoreribelle4584]

hi, would you be able to make a DcRAT server generator

[@heatherryan9820]

So, a lot of time, I'll put on your long videos on my screen next to me while I'm working on my computer, honestly just half-paying attention to it, but I really got into this one. Quick question though, how cool was it to see that he was following you on Twitter? That's got to be an interesting feeling. Anyways, thanks for the great video, and I've learned so much from you. Super appreciate it.

[@I_Print_Like_J-Pow]

What would this profession be?? How do I get someone with your skill set to look at files just like you do but for money. Who do I call?

[@OrangeYTT]

Ethical hacker maybe? Security Analysis maybe? not sure if it has a proper name.

[@drygordspellweaver8761]

You forgot to mention that qwqdanchun is in the sixth grade.