How this "Movie" was actually a Virus
Vložit
- čas přidán 11. 09. 2024
- How this "Movie" was actually a Virus
Official Discord Server - / discord
Follow me on X - / atericparker
Disclaimer: The content in this video is for education and entertainment purposes to showcase the dangers of malware & malicious software. I do not encourage any form of illegal hacking, nor do I encourage the usage of game cheats, cracks or hacks.
Cracks are sometimes shown to highlight the dangers of software piracy, my content is not intended to teach anybody how to pirate, or maliciously hack.
More Malware Investigation Videos:
→ The latest "NORD" Malware - Nordsecured: • The latest 'NORD' Malw...
→🧧VIRUS WARNING🧧 NEW Optifine for Minecraft 1.16 SCAM: • 🧧VIRUS WARNING🧧 NEW Op...
→ The wilkreate CZcams stealer virus that started this whole trend: • Fake sponsor DESTROYS ...
(C) Eric Parker 2024
TL;DW: It's a CMD/ PowerShell command disguised as a shortcut
Thanks what a waste of video
@@ndwxxdIt was informative, why are you pressed lol
I see the term "TL;DW" quite often. But wtf is the meaning? xD
@@forcii1 It means too long didnt watch
@@westbrook0853 Yeah idk what he's on about. The video is good. I just wish Eric would add summaries in the video description for people that want quick bits of information without having to sit through rambling and debugging ngl
What on earth is “Sex positive 2024”
A family friendly movie
When you watch it, you get sex. When you watch sex negative, you get sex removed
The mistake he made at 1:23. (Eric Parker if you see this, you’re welcome)
A shit tier “””movie”””
maybe that is TF2 sex update
Japanese porn videos has less censor than that...
and yet its still visible at 1:22 lmao
1:27 !!!! eric!!!! you let the profanities slip!!!!
You mean to tell me there is sex in my christian youtube video?
Edited after upload using CZcams's editor
HOW DARE YOU. MAYBE GOD WILL BE IN YOUR LIFE@@lollermann
OMG PROFANITIEEEEEEES😱
Just remember I can hide the entire bee-movie script within the HD image of a bee, with it being displayed correctly. Steganopraphy is easier than ever
You've been able to do that forever
Why the bee movie💀
@@MadPsyclone because its funny and its an easy copy paste from github
what the heck "S*x Positve 2024"
It is the family friendly movie he was talking about
@@dr.robertnick9599 I know I typed that because I wanted to let him know to edit it
you know what, cat ears, a maid suit and cat ear headphones
hes using linux of course hes gonna do it eventually (i also use arch btw)
@@block_place1232 I wasn't expecting that
Wait.. cat ears AND cat ear headphones?
@@hziebicki yes.
Me irl ;3
this video was a bit hard to watch because of your editing. first of all the structuring of the video is quite hectic, sometimes i can’t really tell what you’re doing at first because you don’t really explain it, whether you’re trying to unravel the payload or something else (i’d imagine it’d be even harder to follow for someone who isn't knowledgeable on the topic of malware analysis).
second, this seems to be a trend with a few of your analysis videos, but the vm randomly zooming extremely in and slightly out plainly throws me off. particularly i assume you’re doing the zooming in in this video to hide the contents of the movie, but references of its name were still left in. if you just censored the file thumbnail (hell, even changed the view of the file explorer to a list so you wouldn’t need to do that), the movie itself (if it even popped up in this video..? hard to tell) and nothing else i think it would be fine.
not sure what video editor you use, i know your options are a bit limited because you’re a linux user, but if it doesn’t allow you to do very sophisticated edits then i guess you have to find some workarounds. honestly the editing for this channel sometimes feels like it’s randomly generated to bypass some checks by youtube or something.
edit: don't get me wrong, despite my criticism i still find myself watching your videos because they are interesting topics. i have been watching most of the videos on mobile so i understand the reason why you'd want to zoom in to things, but other youtubers tend to use built-in zoom features in terminals, browsers, notepad etc. to improve the experience for mobile viewers (i use a computer most of the time but i find myself watching a lot of youtube on mobile as well). also, i find it weird that sometimes that you tend to cut off your train of thought in editing. this is why i feel like the editing is randomly generated sometimes, the clips seem oddly cut when you cut off something that you're about to say and the cropping and zooming in just seems abrupt in some cases. just a thing that came to mind.
yeah i downloaded gta 5 from a pirate site and all i got was pirates of the Caribbean. was very let down
I thought people got the Yakuza games...
@@Mario583a lol tried that to and all i got was jarhead
You use probably a low rated website
I tried to download a demo back in 2013 and the zip got a few super high resolution images of paintings
@@jmbkpo gta 5 just released that time bro so that is obvious you can now get gta v very easily
Since you're using Wayland, what WM or DE are you using? Wayland screen capture is pretty mature on everything but discord (but that's because they use an old version of Electron). However, if you're using something like Cinnamon, it might introduce its own issues since the session is experimental.
Interesting🤔🤔🤔🤔🤔🤔🤔🤔🤔🤔🤔🤔
@@Soccera0 I believe he's using standard kde, seen from his previous videos
@@ionutsoimu6628 KDE has a pretty mature Wayland session, so he shouldn't ever have issues with OBS.
this is why you check your movies people
didnt censor the title or poster of the movie in at least 14 instances lel
edit: as everyone else has also pointed out, but I doubt it will be trouble legally, right?
it was confusing to follow what file you were inspecting, was the movie now the bad file or the lnk? also i would never think of clicking on an lnk
@@kipchickensout I would have to assume the movie is just a blank corrupted file and the pirater would instead tell you to run the movie using the shortcut instead, which would then execute everything else, but then again, due to all the blurring and lack of explanation, I couldn't exactly tell what happened
Movie is a zip containing an actual video file, but encrypted. Jpeg contains some bytes (despite being a valid JPEG).
I have edits pending to fix, I don't think anything will happen copyright wise.
@@EricParker Ah thanks, does it still play it?
@@EricParkercopyright was _never_ going to be an issue, sir.
When I was still running windows, I had a registry edit that showed the .lnk extension among a few others because I wanted to know if the file was executable.
it feels dumb that "showing extensions" still doesn't show .lnks
I can't comprehend why. When I was younger I spent quite a while trying to figure out how the magic worked, but it's quite boring really.
Another interesting one is a folder named .app on macOS (or hellosystem for that matter) shows as an executable file, rather than a folder.
Well you missed the head of the nail with this one, when you said you were not gonna show identifying things.
The name of this “movie” is shown on a couple occasions.
"If your family-friendly movie looks like a command prompt, you have probably not downloaded a family-friendly movie." No, what you have downloaded is actually a NON FAMILY FRIENDLY MOVIE *insert evil dio laugh*
Hmm, that's very interesting. So, technically, you can execute code with an .mp4 file? But it doesn’t play anything because it’s code and not a video. Can someone make a video that looks like a normal video when you play it but silently executes code?
But don't shortcuts have the arrow subicon to indicate being shortcuts?
Also quite bold hardcoded "C:".
20k more until the cat ears, eric.
NO
YES@@folder4183
Did I miss something???
19999 now that i know there's cat ears at stake
20k til perfection.
Might want to make a cut to 1:27, when VLC gets minimized the folder and contents gets shown for a split second.
processing.
There's a lot more places where you see them
@@EricParker Few other times it shows it or the file name is uncensored I found if you don't know already, 2:35, 2:37, 2:57, 2:59, 3:00, 6:41-6:57, 7:44-7:51, 8:02, 8:37-8:50, 9:06-9:11, 9:14, 9:22, 9:39-10:25.
A shortcut can have any icon. If you get creative, that icon can even be bundled in the torrent itself or pulled over the network (yes, explorer will happily reach out to UNC paths to fetch icons). Also, welcome the Wayland!
Great video as always 👍 love seeing you explain how different types of malware work
This might as well have been a podcast. Was it really that hard to just rename the file so the screen didn't have to blurred at all times? As a video this is useless.
if you rename the files the scripts might not work properly or work differently
I don't have any experience in malware analysis but your videos make it quite accessible and interesting. Thanks!
eric could you possibly make a other video on gaxlay swapper fortnite? I want to make a video on it and even window flags it so yea please respond
Pirates: YOU CANT STOP ME NOW!
I remember those 700mb "movies" that only said "Download the codec to watch" and it had a text file for the link or had it on the video.
This has 3 stages and one redirection.
First stage in the shortcut drops the next ps1 script and unpacks the rest from somewhere.
Second stage is the "lain.ps1" (probably encrypted in caesar10), which unpacks the movie from the nfo and compiles the actual malware from the NTUSER.DAT{xxx} files into an executable.
Third stage is the task it created (probably with SYSTEM rights).
And because the user got what he/she wanted, it will be "Ok" - totally ignoring the newly added funky file, running on boot.
Pro tips to "acquire" digital entertainment of any kind: 1- If the "subject" isn't an MP4, don't go for it. 2- If the MP4 doesn't get a thumbnail when it "fully reached" your device, don't open and instead delete it promptly. 3- Find another source using Yandex (Google behaves like an autistic when the subject is how to get copyrighted "things").
most "secure" way is to drop it into a hexeditor and see what the header of that "movie" is.
Here before you get flamed by sjws due to using autistic
most "movies" in real sites is in mkv file format
'Find another source using Yandex'
Yeah, unless you are looking for something that *is* copyrighted in Russia. Those parasites called copyrighters are same no matter the country
1:27 you can see it all also 3:00 and 9:22
oh jeez.
and at 9 mins
Gotta download this movie asap
@@PaksuPoika shame.
No judgement but its a shame for your computer.
what
Man, you'd think by now people would have moved to automation like the 'arrs or Stremio/Kodi instead of manually downloading like a caveman.
got me scared to even click this lol
u accidently showed the movie unblurred at 2:34
Wie Linus das nächste mal gehackt wird:
if u use linux you don`t worry abt virus going from vm to host cus it won`t work
The NTUSER.DAT file is a registry file in Windows operating systems that stores user-specific settings and preferences. Each user's profile directory contains an NTUSER.DAT file, which contains data such as desktop settings, application configurations, and other personalized system settings... That is one sketchy "Movie"
does the thumbnail say malicious lnk instead of link or am i stupid
1:24 you can see the file name which shows the movie title on the top of vlc. and you can see it at 1:21
2:55 File name: 🎷 Position
🤣🤣🤣
It’s 🎷positive
@@Fortnitegam 🤧
this is so sad that you should subscribe for cat ears at 100k
The good 'ol "seeing a commandprompt open up on pirated content"
You showed the name of the content at 1:23
get better soon man you sound really sick
Eric, once you see it, you cant stop seeing it 😭
9:17 I think the name was leaked here too
1:27 who is your editer?
I think he edited it out.. What was it? 😅
@@hziebicki he show the friendly family things lol
@@LouLinux Oh I see.. Same ones as 2:36 then 😂
@@hziebicki I know
You could have just renamed the files, but instead you blurred the entire screen...
No i couldn't because the payload wouldn't work.
You must be a fan of those 24hr nocuts bootleg livestreams of shows here on CZcams the way you edited this video.
at the timestamp 1:27, it displays the movie
You know, it would have been a lot cooler to just rename the file rather than censor the entire screen and not let us see any context.
Serial Experiments Lain!!!!!
hell yeah
And you don't seem to understand... A shame, you seemed an honest man...
@@pcwway2dawn And all the fears you hold so dear
Will turn to whisper in your ear
@@ROBeatBard And you know what they say might hurt you
And you know that it means so much
And you don't even feel a thing
John Hammond did a video about this malware method
3 minutes in and seen the name twice
When i see "movie" i instantly think of zlob
Very useful video, thanks! Recently, I downloaded what I thought was a "movie", but it just was a 1.6 GB exe file, so Windows Defender was blinded by the size of the file. I have a feeling it was a sort of stealer, because somebody tried to log in into my microsoft account trought multiple locations (vpn).
uh youtube started the video halfway...
me when lain:
YIPE
me when no lain
YIPE
6:37 powershell also gave out the name. FIX!!!! QUICK!!!! OMG!!! also at 1:23
so how was the movie?
Oh hell yeah, Eric is an SEL enjoyer- Let's all live Lain! :D
Undercover Weeb
1:20 sex positive 2024
So you did all the blurring in CZcams Studio for this video? Because it sure does look like it, guess the money’s more important than a reupload. L.
1:25 edit fail 😡😡😡😡
Set File Explorer to show file extentions and never fall victim to such things.
.lnk files don't show either way
what vm software u use ?
1:20! the title gets shown!!! edit and 3:02 ok i guess you showed it so many times it doesnt even matter
It shows like 20 times 😂
Gave up on removing the title given it's embedded in the powershell. Successfully got rid of any visual content.
@@EricParker thats good nice
@@EricParker can still see the thumbnail for a bit, but there's no xxx in the part we can see just some faces being family friendly and stuff.
@@EricParker 2:56 nude picture below!!!
Please, next just change the name cuz the whole screen moving and all of that makes it less comprehensible... ):
dude u should not censor like this, its painful to watch.
u explained more weird stuff on this channel.
i dont get it here my honest dislike
Wrong mic?
Love the vids but that censorship hurt me. Didn't really do it's job, the movie is Sex Positive 2024 lol
you need to censor more i saw the title 2 times in a row 3 minutes into the video
Get well soon man. :)
3:00 here it's
what a family friendly movie called that name, L)OL
I wonder where you searched for the virus :)
I was given a link.
@@EricParkerFor research I believe :)
@@ionutsoimu6628 It's very easy to find as we know the file names.
oh for fuck's sake you're not tricking me with a shortcut script, just enable show file extensions, if nothings shows as an extension, it's fake, i am disappointed that people fall for this virus
what if the shortcut is named movie.mkv ?
@@YumekuiNeru it still has a shortcut symbol, i am not falling for dumb tricks
@@thecakelover4578 your first post talks about extensions instead of icons though so I feel like you are more complacent about this stuff than you think
@@YumekuiNeru yeah but the file he showed did not have a file extension at the end
@@thecakelover4578 you argue the issue is solved by showing extensions but (I think) shortcuts can be named anything (e.g. end in .mkv) so you cant rely on extensions as a solution like your first post claims
hide this filth, you allready show everything
Anyone who wanted to watch that trash should have their media consumption permit revoked.
Forgot censor 9:22
get well mate
You're 20K away...
cat ears
Hi
uhm 1:23 you migth want to edit agine brother 2:37 and this one two 2:56
Jump In!
i cant wait for 100k!
really interesting one
we love you eric!
I have also similar thing.
hyprland ftw
love mpv! yes the windows install process is shit
1:22 and 1:27 u can see it
😂😂
it was hiv positive !
I hate windows too lol
I am so early
remember the cat ears, mike? 20k...
Interesting name...
9:40 Wow, I knew about the Martin Shkreli thing kinda but not that he clicked an *.SCR file 😓 that's cringe, sometimes it's nice to not be rich cus you actually know how to get stuff for free and become street smart online.