Unmasking what a fake Fortnite Skin Changer is really doing...

In this video I setup MITMProxy with kali linux so that I could intercept and read exactly what the malware was doing. I learnt how the fake skin changer actually steals your data, then I show how to remove the virus.
Follow me on Twitter - / atericparker
Disclaimer: The content in this video is for education and entertainment purposes to showcase the dangers of malware & malicious software. I do not encourage any form of illegal hacking, nor do I encourage the usage of game cheats, cracks or hacks.
Cracks are sometimes shown to highlight the dangers of software piracy, my content is not intended to teach anybody how to pirate, or maliciously hack.
More Malware Investigation Videos:
→ Cyberpunk 2077 Highly Compressed: • Video
→ The latest "NORD" Malware - Nordsecured: • The latest 'NORD' Malw...
→🧧VIRUS WARNING🧧 NEW Optifine for Minecraft 1.16 SCAM: • 🧧VIRUS WARNING🧧 NEW Op...
→ The wilkreate KZbin stealer virus that started this whole trend: • Fake sponsor DESTROYS ...
Much of the music in my videos comes from the KZbin audio library, especially this amazing music creator: / @patrickpatrikios2050 .
Outro Music
Track: Lost Sky - Where We Started (feat. Jex) [NCS Release]
Music provided by NoCopyrightSounds.
Watch: • Lost Sky - Where We St...
Free Download / Stream: ncs.io/WhereWeStarted
(C) Eric Parker 2021

[@MP3Crypt]

You gotta upload more dude,you could get a cult following with this stuff,absolutely amazing.

[@1teamboy]

That’s happening. As I type this

[@Kykof]

Holy, haven't seen a video from you in a while man, nice to know that you still post videos. All of your videos are super helpful and informative, I am glad that you make these.

[@Awesomium3]

3:40 eric's voice sounds like COD:MW2 silenced M21 when he said can

[@Awesomium3]

btw question, does using sandboxie save you from actually getting way more infected? since it cant use most of the files, the files inside the sandbox

[@ShinyCoder]

@@Awesomium3 it can see what you're doing on your computer (keylog etc), basically everything but messing with files

[@prohax1]

S​@@ShinyCoder

[@ShinyCoder]

@@prohax1 more like W

[@LastSkill19]

Is that possible that you maybe make the right side of the screen (where connections are shown) bigger than the left side? It could greatly improve the video quality as it would be a lot easier to read which I find (and probably a lot of people) very interesting. Very cool video, great job! :D

[@EricParker]

Yes, I'm still thinking about the best way to format this kind of video. I zoomed in where I thought it was specifically interesting.

[@jacobtinkle9686]

Absouletly great, interesting and informative content!

[@mariocamspam72]

Ayy welcome back

[@yxngsellei]

This dude is a modern OS oriented danooct1

[@b4sicallyf0x]

Love it! Keep it up!

[@Jesus.Christ106]

some things never change, putting password stealers in fake software was already popular and easy 15 years ago. also never try to manually remove such malware, there is so many out there and the risk of missing traces of the malware and being exposed again is too high, just format your drives and move on with a new OS installation. (also if you save passwords on your pc/phone, atleast use a paid password manager and not free software or 100% not the built in browser password savers)

[@icantcomeupwithnames469]

Why would you use paid, proprietary, probably networked software instead of free (as in freedom) software like pass or keepassxc?

[@BonziBUDDY]

I remember falling for something similar when I was young and stupid. It was a TF2 item generator, and it wasn't really hiding what it was trying to do. It had fields for sending both your steam and your email username and password. I don't know why I thought that was even remotely a good idea. Thankfully nothing happened to my steam or email, but still. It was alarming that I didn't care that much. I'm surprised my steam account never got hijacked after all these years. I do wonder if it did anything else behind the scenes though. It was just some exe file in a zip.

[@Daniel-hz6pt]

The WinRing0 is interesting, what malware family is this? The fact it’s downloading a driver that gives r/w kernel access is very interesting, possibly for rootkit functionality?

[@EtherealVortexYT]

i remember meting a "hacker" that "made" something like this

[@georgecrutchfield8561]

very cool and interesting video

[@Bombexploid34]

what do you use to see what the hackers are doing?

[@EricParker]

Tutorial on this coming out tomorrow actually!

[@hasupasu]

hi should i download op auto clicker i know you made a video of it but i dont know if i should download it or not and where should download it

[@Stratxgy.]

its safe

[@hasupasu]

@@Stratxgy. thanks

[@trimidsmod6391]

@@Stratxgy. can confirm

[@danonaogrosso1518]

Can you check if Projecto Nova has viruses?

[@pelaajahacks8358]

just dont download it. why would you even need it anyways?

[@raaptex]

very interresting, but impossible to watch on 1080p...

[@watercloud]

4:15 in the paste in are 3 exe with a download link I suppose at least for: lol miner and xmrig those should be legitimate mining tools. However you shouldn't get these bundled with unless you specifically want to mine, duh. Also you can see the custom flags for the specific miners, aka the malicious persons crypto address. You can mine using the CPU though it is inefficient for etcash, xmr is designed to only be mine able on a CPU. I checked the current address that is listed there, it has a total of 1.4k USD in it in ethc. The ethcash from the looks get transferred to the in video shown. And on that address 16k USD was transferred out last month 😮. So apparently it is lucrative, I can't say how long it took to 'earn' it.

[@watercloud]

Interestingly the pastebin link still works and shows new command and controll server

[@THEHACKERVIP]

ah yes, fortnite skin changer in hackcatalog, with arcade riven logo

[@alexmoura3065]

Can you do a video on M0nkrus Adobe collection 2024? He is "trustworthy" among the pirate community and people don't report problems with his individual adobe products, only the collection. I wonder why that is and how he is still "trustworthy" if there is indeed malware in his collections. Thanks for your videos, always helpful.

[@Awesomium3]

i can confirm theres no viruses because i downloaded premiere and it was just working fine without any issues, its actually trustable

[@WindowsDaily]

I trust him and have the collection, but the then again i've only installed PS/AI in a vm to make a portable version of it.

[@CHILDM0ELESTOR]

interesting

[@AkiraKarube]

Rip headphone users.

[@Biggerman159]

o7