How to not get hacked: real example

Sdílet
Vložit
  • čas přidán 3. 08. 2023
  • I have been consistently spammed with infostealer malware links on google drive designed to steal my login credentials and hack my CZcams account. Here's an in-depth analysis of the technique and how to not get hacked. Join a live Q&A with me on Discord: discord.gg/MgBm5sy9?event=113...
    Get Crowdsec to stop DDoS and brute force attacks: www.crowdsec.net/?mtm_campaig... (sponsor)
    Buy the best antivirus: thepcsecuritychannel.com/best...
    Join the discussion on Discord: discord.tpsc.tech/
    Get your business endpoints tested by us: tpsc.tech/
    Contact us for business: thepcsecuritychannel.com/contact
  • Věda a technologie

Komentáře • 784

  • @itenthusiast5988
    @itenthusiast5988 Před 9 měsíci +272

    Thanks a ton. I have seen many videos like these but this one helped me up my knowledge by large also I was glued for the entire 13mins. It has all a user needs to know. More important complicated things explained in an easy way. I liked the crowd sec mention

    • @user-mn7ot9bf1u
      @user-mn7ot9bf1u Před 9 měsíci +3

      ...And he still made money from the sponsorship :)

    • @midogaming2141
      @midogaming2141 Před 8 měsíci

      @@user-mn7ot9bf1usmart man

    • @nagat2809
      @nagat2809 Před 6 měsíci

      ‏🔥مرشحه الرئاسه التونسيه ترد على المتطاولين على المصريين من الدول الناشئه
      ‏⭕️يا مصـــــــــرى.. لما حد يقولك انت منين
      ‏⭕️رد عليه قوله انا من البلد اللي فيها
      ‏الفلسطيني والعراقي والسوري والليبي واليمني والسوداني عايشين فيها و مفيهاش مخيمات
      ‏⭕️قوله انا من البلد اللي ياما كست و علفت
      ‏و لبست حافيين من غير مقابل
      ‏⭕️قوله انا من البلد اللي مفتوحه لكل اللي بيسعي ع شغل و اكل عيش مهماكانت جنسيته و من غير كفيل
      ‏⭕️قوله انا من البلد اللي حررت ارضها بدم ولادها مطلبتش من حد يموت عشان يحررها
      ‏⭕️قوله انا من البلد اللي استقبلتكم كلكم لاجئين و لما اتحرقت ف العدوان الثلاثي محدش من اهلها لجأ لحد بره حدودها
      ‏⭕️قوله انا من البلد اللي جدودها بالدهب مدفونين .....
      ‏⭕️قوله انا من البلداللي مفيهاش عيل قفل حمام ع ابوه و خد منه الكرسي
      ‏⭕️ولا فيها ولاد منها في الصحرا "بدون" جنسية مرميين ....
      ‏⭕️قوله انا من البلد اللي آوت المسيح و امه
      ‏و نصفت يوسف بعد ما اخواته فالجب رموه
      ‏⭕️قوله انا م البلد اللي شعبها كله جيش وجيشها خير جنود الارض ...
      ‏⭕️قوله انا من البلد اللي قامت فيها ثورتين ولسه اللي يلمس طرف مجدي يعقوب فيها بسنانهم ياكلوه
      ‏قوله انا من مصـــــــــر ام الدنيا 🇪🇬🔥🇪🇬
      ‏⭕️لو لم أكن تونسية لطلبت من الله أن أكون مصـــــــــريه
      ‏حفظ الله مصـــــــــر 🇪🇬❤️🇪🇬Omar Hashish

    • @chrisdawson1776
      @chrisdawson1776 Před 6 měsíci

      "Japanese website"
      All that geekiness and still can't differentiate languages. Lmao

    • @CatgirlExplise6039
      @CatgirlExplise6039 Před 5 měsíci +4

      @@chrisdawson1776 Its like he only knows the things he knows, i know, unfathomable.

  • @MadMaxRoadFury
    @MadMaxRoadFury Před 10 měsíci +2120

    And this is why Windows shouldn't hide file extensions by default.

    • @abhisheksinghsolanki3750
      @abhisheksinghsolanki3750 Před 10 měsíci +67

      Even this can bypassed(kinda) by using text-inverter characters

    • @markganus1085
      @markganus1085 Před 10 měsíci +132

      and this is why you should avoid windows altogether

    • @DragoNate
      @DragoNate Před 10 měsíci +9

      @@abhisheksinghsolanki3750 how so?

    • @abhisheksinghsolanki3750
      @abhisheksinghsolanki3750 Před 10 měsíci +19

      ​@@DragoNate ThioJoe made a video about it. Basically some languages write from right-to-left instead of left-to-right as in English. To achieve right-to-left, a special character is used. This can be exploited to show fake extension of file in the display name
      Edit: In "properties" it will correctly show "executable" but in display name it will show different
      Edit: Like this
      text:"fdp.file.exe", an executable
      it will display as this(this contains the special character, you can copy it and try): "‮"fdp.file.exe

    • @oh-ox9sj
      @oh-ox9sj Před 10 měsíci +84

      makes me mad that windows is moving to be like macos w none of its benefits and all of its downsides

  • @Nickwilde7755
    @Nickwilde7755 Před 10 měsíci +543

    In case anyone's curious why Screensaver files are executables: they're not videos, they're programs that run in real time on your pc

    • @kingofstrike1234
      @kingofstrike1234 Před 10 měsíci +21

      just think it as a script, but even so the windows name / icon formatting is kinda bad by showing as pdf, xls, etc

    • @DragoNate
      @DragoNate Před 10 měsíci +31

      @@kingofstrike1234 windows isn't showing it as those files, that's what the scammer has told the system it looks like.
      you can also make "windows show it as" another file type by putting .pdf before the .scr - if file extensions are hidden, you'll think it's a pdf.
      but that isn't windows' fault. and believe me, i'll criticize windows and complain about it for every little tiny thing.

    • @uniktbrukernavn
      @uniktbrukernavn Před 10 měsíci +24

      I wonder what the thinking was behind letting SCR files have all the privileges, reminds me of Visual Basic scripts in Word and font preview pane in Explorer. What was the developers thinking; wouldn't it be nice if you could install a screen saver from Word and then let that screen saver create an admin account.
      Some of the weaknesses in Windows stems from Windows 1.0, and I'm guessing most of the code. That's a joke but I'm also kinda serious. It makes sense because the developers lived through the hippie era, peace & love (maaan).

    • @SilverAura
      @SilverAura Před 10 měsíci +3

      Oh wow, this one actually makes me feel old. 😢

    • @xE92vD
      @xE92vD Před 9 měsíci +15

      ​@@uniktbrukernavnexactly. why did the devs decide to let a screensaver file's code have basically the same power as a normal programming language?

  • @jvdg_hanna
    @jvdg_hanna Před 10 měsíci +209

    Actually that website was a legit Korean website, and the kakao email adress domain is like a South Korean gmail, it's the standard there. When a regular person has that it's nothing to worry about, but when a company uses that in their official email instead of a company domain it's definitely something that should set off some alarm bells.

    • @NopWorks
      @NopWorks Před 9 měsíci +20

      Meanwhile in some countries, we have legit businesses, larges institution, academic orgs, and even countless government agencies proudly sporting Gmail address as their official mail.

    • @jonathaningram8157
      @jonathaningram8157 Před 9 měsíci +1

      But now with chat gpt it would be quite easy to create a fake website filled with company infos etc.

    • @ViroRads
      @ViroRads Před 9 měsíci

      @@jonathaningram8157 yup, almost fell for a scam involving a translation job from english to spanish, there was no malware involved but the "company" that wanted me to work at had this somewhat impressive webpage, or at least on the front-end cause most links were broken and the address was on some non-existant place in Canada.

    • @LaroTayoGaming
      @LaroTayoGaming Před 9 měsíci +4

      Probably the email has been spoofed

    • @LatestTechinCyberSec
      @LatestTechinCyberSec Před 5 měsíci

      Lots of small businesses use Gmail as their official address. Large businesses have the option to have Google host the e-mail for their domain, either on the GMail platform or just in the cloud.@@NopWorks

  • @Alberos
    @Alberos Před 10 měsíci +554

    As many people pointed out already, that's Korean not Japanese. Here's a quick way to tell CJK (Chinese, Japanese, Korean) characters apart for all English speaker out there. A) If it has lots of circle, it's Korean. B) If it has lots of line and square and the character looks "blocky" and "complicate", that's Chinese. C) If it's not of the first two and it has lots of curvy character mixed in with some square and line, that's Japanese. The Chinese and Japanese is a bit tricky because Japanese do mix character from Chinese (Kanji) in their language. However, the Japanese character will standout from the Chinese one, they will look less "blocky" and "less complicated" and has lots of curve line. Hope you learn something new!

    • @BakrAli10
      @BakrAli10 Před 10 měsíci +12

      Bookmark comment later

    • @abhisheksinghsolanki3750
      @abhisheksinghsolanki3750 Před 10 měsíci +33

      Chinese characters have lot of corners and less curves, japanese characters have frequent curves. Japanese looks like it is in Comic Sans by default
      Edit: About japanese, there are 3 systems(?), Hiragana(like あ) has frequent curves, Katakana has less curves. But both look like Comic Sans to me. These two are most popular.

    • @JJFX-
      @JJFX- Před 9 měsíci +23

      ​@@abhisheksinghsolanki3750"Japanese looks like comic sans by default" is a great way to put it!

    • @NopWorks
      @NopWorks Před 9 měsíci +2

      ​​@@abhisheksinghsolanki3750I absolutely do not understand why Chinese insist on writing their characters in sharp angled & outdated looking font when Japanese already moved on to a tidier font that's easier on the eyes, even though they share lots of the characters.

    • @basspig
      @basspig Před 9 měsíci +15

      Japanese have actually three character sets. They derive more complex Concepts with Chinese characters and they use syllabaries to phonetically spell out words. One syllabary for Japanese words is hiragana. For foreign words they use katakana. Katakana is much more sharp and angular looking whereas hiragana has much more rounded curves to the letter forms.

  • @RobotsWithKnivesCartoons
    @RobotsWithKnivesCartoons Před 10 měsíci +44

    I've made some pretty suboptimal PDFs in my time, but 600+ mb for a PDF would be a huge warning bell for me.

  • @toddsimone7182
    @toddsimone7182 Před 10 měsíci +198

    So let me get this straight. The hackers decided to try and scam a youtube channel by the name "The PC Security Channel" and thought you were an easy target. I'd be offended!!

    • @DragoNate
      @DragoNate Před 10 měsíci +76

      they were hoping he'd be caught off guard.
      Jim Browning, the guy most famous for scambaiting and shutting down entire scam operations, fell victim to one last year I think having his youtube channel removed.
      the important thing to remember is that ANYONE can be scammed. even the people who are extremely extremely careful about security, even the best of the best who have so far never been scammed.
      once you think you're invulnerable, you become _more_ vulnerable.

    • @PipoZePoulp
      @PipoZePoulp Před 10 měsíci +25

      "You only have to lose once."

    • @mr.highschoollocksmith6080
      @mr.highschoollocksmith6080 Před 7 měsíci +3

      I mean... it would be very ironic wouldn't it?

    • @randompost78154
      @randompost78154 Před 7 měsíci +5

      Like Linus Tech Tips?

    • @hotsauce2446
      @hotsauce2446 Před 6 měsíci

      @@randompost78154 theres a video about that on this channel

  • @OtherWorldExplorers
    @OtherWorldExplorers Před 10 měsíci +17

    Right off the bat, that opening line is a Chinese greeting
    Likely AI used

    • @pcsecuritychannel
      @pcsecuritychannel  Před 10 měsíci +9

      as I put on screen, thanks Chat-GPT!

    • @ryanasazaki1291
      @ryanasazaki1291 Před 10 měsíci +4

      In any case, we, or at least I, don't speak like that though.
      "High spirits." isn't something I'd say in an email. (Maybe that's just me.)

  • @Sonyboj
    @Sonyboj Před 10 měsíci +24

    Kakao is Korean. Its like Whatsapp.

  • @Bellicosy
    @Bellicosy Před 10 měsíci +68

    I was already aware of this information partially in thanks to your channel, but it is always good to be reminded in order to stay sharp of real and ominous threats that are just a single click and slip of the mind away.

  • @cinna9552
    @cinna9552 Před 10 měsíci +75

    Ah yes.. I love opening screensaver files.

    • @Freegame4.
      @Freegame4. Před 10 měsíci +13

      Me omw: to open a .scr file thats about 500mb

    • @meemuboi
      @meemuboi Před 9 měsíci +1

      ​@@Freegame4.Don't worry guys it's just a really cool screensaver!

    • @guydreamr
      @guydreamr Před 2 měsíci

      So you have chosen death.

  • @featurebreaker
    @featurebreaker Před 10 měsíci +23

    I love your videos, TPSC! Keep them up!

  • @omgabaddon
    @omgabaddon Před 5 měsíci +2

    Thank you for the video. I already knew about all this but still stuck because you go straight to the point and don't waste the viewer's time, unlike those videos where there's a 4-minute intro asking you in 15 different ways whether you were hacked before.

  • @Gxjlchfyou
    @Gxjlchfyou Před 10 měsíci +16

    Correction on 1:07
    that is a South Korean website

    • @NaldinhoGX
      @NaldinhoGX Před 10 měsíci +3

      Edge even says it's detected a page in Korean, haha.

    • @waryth4475
      @waryth4475 Před 5 měsíci

      It's an honest mistake.
      This CZcamsr is from UK. Its not easy to tell Chinese and Japanese characters nor Chinese and Taiwanese characters or Vietnamese or Thailand characters.
      It's going to be the same for Asians, they'll mostly treat every English speakers as Americans when English originated from England.

  • @businesscatlimbo
    @businesscatlimbo Před 10 měsíci +9

    I love this channel. As someone starting my bachelors in cybersecurity I love learning about this.

    • @SM-1010
      @SM-1010 Před 10 měsíci +3

      Exactly the Same over here bro!

  • @Gazzz696
    @Gazzz696 Před 10 měsíci +3

    I've been having the exact same email myself (amongst many similar others) , I swiftly block and delete.. another great informative video. keep these up )

  • @goatrecap
    @goatrecap Před 4 měsíci

    Found your channel today, Really enjoying it!

  • @wannabedal-adx458
    @wannabedal-adx458 Před 9 měsíci +3

    Great video as always. As to the people who says you go to in depth and would never do some of the things you show doing your videos, well then they shouldn't watch these videos! Leo you are here to educate and impart some of your knowledge and experience to help "The lay people" (i.e. me) understand a little more about cybersecurity. Secondly, to impart some experience and provide examples of real life threats to students of Cybersecurity and Network Administrators. I am treating this as a hobby while learning to strengthen my own families' Cybersecurity posture. So Thanks for all you do Leo.
    Also with regards to ChatGPT, yeah thanks! Seems like the unintended (or maybe intentional) consequence of its creation is to help cyber criminals. :(

  • @velotheworld4860
    @velotheworld4860 Před 8 měsíci

    Great Tips! For someone who isnt into Tech, these are good Tips and examples. I really appreciate this Video!!!

  • @Vandelay666
    @Vandelay666 Před 10 měsíci +9

    Love the channel, thank you for all the knowledge

  • @st.clairjrharris4211
    @st.clairjrharris4211 Před 8 měsíci +3

    Thank a million 👍🏻. As someone currently studying cyber security. This video is actually helpful.

  • @jondo7680
    @jondo7680 Před 10 měsíci +67

    From the privacy perspective it's nice to see that Google has problems with scanning big files. Also using a pdf icon as an icon for an executable is very smart I never thought about how easy that could be done (probably because I never made actual maleware, If I would would have to think about the icon at some point).

    • @Splarkszter
      @Splarkszter Před 9 měsíci +8

      It's not that it has problems is that they won't place the resources on scanning random files that are too big because that costs money, they still archive and store copies of your data anyway.

    • @ieatthighs
      @ieatthighs Před 9 měsíci +2

      pdf icon is the oldest trick in the book

    • @FusionXZ
      @FusionXZ Před 9 měsíci

      ​@@ieatthighsfr imagine pdf icon doc.exe no one falling for that

    • @SqualidsargeStudios
      @SqualidsargeStudios Před 9 měsíci

      Why is it nice that google has problems with scanning big files?

    • @ieatthighs
      @ieatthighs Před 9 měsíci +1

      @@SqualidsargeStudios they won't gather info about your files

  • @TediousSecurity
    @TediousSecurity Před 9 měsíci +10

    These are some awesome tips for someone that hasn't seen a piece of malware that mimics a pdf. I did an incident response scenario for the first time and kept seeing that MZ on the malicious files and sad to say I didn't know that about pexe files but I knew it was malicious.

  • @jeoffer
    @jeoffer Před 9 měsíci

    Thanks for sharing. A very helpful and clear explanation of what the scammers are up to.

  • @manprinsen8150
    @manprinsen8150 Před 10 měsíci +44

    Would be nice with a antivirus comparison of the 658MB file. E.g. how does kapersky, eset etc handle the file when it’s downloaded and also when it is executed.

    • @defnotatroll
      @defnotatroll Před 9 měsíci +17

      YES. this is what I was thinking while watching the video. How would Kaspersky deal with this?

    • @paularvie9473
      @paularvie9473 Před 9 měsíci

      anyone?

    • @Unknown-qr7mj
      @Unknown-qr7mj Před 9 měsíci

      got answered ?

    • @FraterSorax
      @FraterSorax Před 7 měsíci

      ​@@defnotatrollit force deletes it 😉

  • @GodwillhandleIT
    @GodwillhandleIT Před 6 měsíci +1

    Thank you for sharing this, super insightful and helpful. Can you please let me know what material you studied to become a malware analyst?

  • @henryD9363
    @henryD9363 Před 10 měsíci +12

    With regard to the 600 megabytes of all zeros.
    It seems to me that if you zip the 650 mb, file it would compress down to about the actual code size.
    This extreme compression could give a big clue about what the heck it is.

    • @duplicake4054
      @duplicake4054 Před 10 měsíci +3

      Yes, it would encode the number of zeros it was removing, you are correct

    • @3lH4ck3rC0mf0r7
      @3lH4ck3rC0mf0r7 Před 10 měsíci +5

      Yeah. But antimalware solutions don't do this because you still have to read the entire file and count up all those zeroes in order to compress it down, and it would take a long time and CPU horsepower the user might actually want.
      And even if you did, malware makers could just replace the filler pattern with anything else that happens to compress well. Now, if an AV could check inside already compressed files and perform the analysis without resorting to decompression, eg, by applying the compression to its own malware database and checking compressed patterns against compressed patterns, maybe you could get somewhere. Encrypted files would throw all of that work out the window, though. But when the user types in the password to decrypt the file, that gives the AV the opportunity to intercept the file's password in memory and analyze the file before the user has the chance to decompress, let alone execute it.
      This is in no way trivial, as you would need specialized versions of all the heuristics, reengineered to work with compressed data directly. And you would need to do this for every major compression format out there. Fortunately as all lossless compression formats are wholly deterministic, it is at least theoretically possible to do this. I doubt any AVs would, though. It'd be pretty costly and difficult to do this, let alone maintain and support.

    • @duplicake4054
      @duplicake4054 Před 10 měsíci

      @@3lH4ck3rC0mf0r7 you said ' by applying the compression to its own malware database and checking compressed patterns', that's not how signatures work, signatures are a set of rules

    • @Vilvaran
      @Vilvaran Před 9 měsíci

      Nope, not for log files!
      I've seen gigabytes of system log get crushed into a 12 meg ball, since 99.9% of the text is identical, it can get pretty small by only keeping one copy of the recurring lines, and just counting the number of times it repeats!

  • @IslamAudioStation
    @IslamAudioStation Před 10 měsíci +1

    Amazing tutorial my friend.

  • @xloppyschannel4881
    @xloppyschannel4881 Před 9 měsíci

    Increased my confidence that I did the exact same steps as you did, though I am guessing you left a lot of the technical stuff out as well, is there any resources you can point me too?

  • @pauldeacon6123
    @pauldeacon6123 Před 10 měsíci +1

    Great stuff keep up the good work

  • @pcsecuritychannel
    @pcsecuritychannel  Před 10 měsíci +69

    We will be doing a live discord event tomorrow associated with this video, feel free to join in here: discord.com/invite/MgBm5sy9?event=1136673606273871983

    • @MultiSokka
      @MultiSokka Před 10 měsíci +1

      Hey is there a video or link with all of the tools you use? If not, would you do a video showing us all the tools you use and links where to download them?

    • @MRNotAbdoOFF
      @MRNotAbdoOFF Před 10 měsíci

      they tried to hack the wrong man

    • @privatechannel1272
      @privatechannel1272 Před 10 měsíci

      The sudo command didn't work, but I just asked ChatGPT to give me instructions on how to install the sudo command and WSL

    • @sansin0
      @sansin0 Před 10 měsíci

      Bruh, I can’t be there 😫😩 - By Juls

    • @galaxystars6409
      @galaxystars6409 Před 9 měsíci

      Can we get hacked by a pdf file?

  • @squingussquingle
    @squingussquingle Před 9 měsíci

    Hello I have a few questions regarding another video you've done that sort of relates back to this one.
    Have you heard about the new exploit " bleedingpipe " on modded minecraft, and are you going to make a video discussing that?
    Are minecraft mods from modrinth, or curseforge still dangerous to download and run?
    What is your opinion on the frequency of attacks being launched against Users using mods?
    What are the best options that you would personally use to defend yourself against harmful programs that are currently undetected, ready to be deployed as zero days against consumers?

  • @aventureirose-sports2525
    @aventureirose-sports2525 Před 9 měsíci +1

    What a fabulous explanation.

  • @pete1996
    @pete1996 Před 10 měsíci +1

    Great informative video. Thanks

  • @MisterQuacker
    @MisterQuacker Před 10 měsíci +4

    Why don't these anti-virus's see if the file is full of empty space? If we can manually check to see where the tail end is, I'm sure an AV could as well. Then It could truncate it and scan it as needed.

  • @emrose3308
    @emrose3308 Před 5 měsíci

    This is helpful. I've always wanted to touch into analyzing files to check if they're malicious. Having this in the back of my head will probably be helpfull if employees call in with suspicious files

  • @williamshenk7940
    @williamshenk7940 Před 5 měsíci

    Excellent video and tutorial, thanks.

  • @gmichael264
    @gmichael264 Před 9 měsíci

    Great and informative video! What Windows theme are you using?

  • @wilfredotorres6628
    @wilfredotorres6628 Před 10 měsíci +13

    Hi Leo, as far as I know on a lot of the antiviruses you can tweak the setting of the size of files you're scanning. This way the scanner can look at what's inside zip file at any size.

    • @seinodernichtsein8710
      @seinodernichtsein8710 Před 10 měsíci

      That’s neat. Do you know if this works on windows defender?

    • @the-Gammaron
      @the-Gammaron Před 10 měsíci

      ​@@seinodernichtsein8710sadly, no, since Defender is designed to be a product for all users, even those who know almost nothing about computers, and don't even know they need and should want protection - which is why you can't really customize anything. It's basically a set and forget program, but without the "set" part.

    • @henryD9363
      @henryD9363 Před 10 měsíci

      Hmmm. This comment shows 5 replies. But when I open it up there's only one. Plus mine if it shows up.

    • @the-Gammaron
      @the-Gammaron Před 10 měsíci

      @@henryD9363 you should see comments by ​ @seinodernichtsein8710 and me ( @the-Gammaron )

    • @the-Gammaron
      @the-Gammaron Před 10 měsíci

      @@henryD9363 tell me if you see my other 2 comments (you can type random letters if you wanna)

  • @Draxis32
    @Draxis32 Před 10 měsíci +8

    This channel is basically a public utility for youtubers specially

  • @anthonynorton666
    @anthonynorton666 Před 9 měsíci

    One more question, could they use unprintable character codes that will affect text order or visibility of other characters to spoof the extension of the file?

  • @ashystyle
    @ashystyle Před 3 měsíci +1

    8:00 why does antivirus programs have size limit?
    What does it take to create a solution for that so that AV's can actually scan past the 650MB limit?

  • @liameyles1450
    @liameyles1450 Před 10 měsíci +1

    love this channel keep it up

  • @Sonicstillpoint83
    @Sonicstillpoint83 Před 9 měsíci

    Thank you. This was quite useful when just dipping your toes into security.

  • @SchinTeth
    @SchinTeth Před 10 měsíci +1

    Very helpful video, thank you

  • @sepremz
    @sepremz Před 10 měsíci +3

    thank you for all this info.

  • @bazo0ky
    @bazo0ky Před 10 měsíci +1

    When you opened the file with Process Explorer, it didn't show up, so it means that there might be viruses on a PC and even with Process Explorer it's difficult to detect them? I am new to this so sorry for this "nooby" question. Yesterday I did a full scan on my PC with Windows Defender and tried to look for malicious files in Process Explorer and found nothing. Now I ain't sure if my computer is clean because of this...

  • @thetitant_t
    @thetitant_t Před 9 měsíci

    I was wondering are all malwares downloaded need to be executed in order for them to work ? Or some by just downloading them on your system you get hacked ?
    Because I have downloaded Unreal Engine Project from github and got hacked not sure it was the source of the malware or not.

  • @annablaster
    @annablaster Před 9 měsíci

    Hello. Can you recommend some good real time malware scanners you were talking about. Thank you. I just found your channel and this is very good.

  • @schmutly
    @schmutly Před 9 měsíci

    So although I use vmwarepro to Loren suspect files ect what do you think of Windows Sandbox?
    I have used sandboxie to do my browsing and installing of unknown software etc but was curious what the strength/quality of Windows Sandbox is. Thoughts?

  • @mnbhr2144
    @mnbhr2144 Před 9 měsíci

    thanks for the video although it was a bit intimidating to me.🙂
    but basically what I understood that to have a VM dedicated for that subject would be safer for the PC
    but what about my network and the router will they be easy to attack or is it safe?🤔

  • @seansingh4421
    @seansingh4421 Před 10 měsíci +3

    Also that’s why you enable all the eventlogs audit logging. If you parse those logs you’ll get a very detailed idea about what happened.

    • @keepanopenmindlookatallthe2540
      @keepanopenmindlookatallthe2540 Před 10 měsíci +1

      Ransomware deletes event logs after the dirty deed is done.

    • @DragoNate
      @DragoNate Před 10 měsíci

      @@keepanopenmindlookatallthe2540 setup some script that automatically copies them somewhere or sends them idk
      but that might also do nothing, waste resources, be unreliable. never tried it.

    • @mcdazz2011
      @mcdazz2011 Před 10 měsíci +1

      @@keepanopenmindlookatallthe2540 - not all ransomware does, just like not all malware does. It depends on the actual ransomware/malware and what it's designed to do.

    • @counterleo
      @counterleo Před 7 měsíci

      @@mcdazz2011 And whether it really wants to prompt the administrator dialog (suspicious) instead of just phishing your MetaMask credentials while staying sneakily in userspace.

  • @Yuvalby
    @Yuvalby Před 9 měsíci +1

    might be dumb question and obvious one but what if i download the scr file and change its type to lets say txt and run it? would it still run?

  • @rieper123a
    @rieper123a Před 9 měsíci +1

    Heavily obfuscated / self written malware usually not getting detected in one drive or any other drive / cloud services... All in all still a good example!

  • @Inter-stelar
    @Inter-stelar Před 10 měsíci

    can google develop some kind of an OCR thingy that reads the content of the archived files for weird extensions?
    or the browser API does not allow that?
    I'm not a developer, just a normie wondering...

  • @TechVirundhu
    @TechVirundhu Před 9 měsíci

    Thanks a lot bro, very useful.

  • @casev799
    @casev799 Před 9 měsíci

    ~4:10 The file description read as SketchUp installer? Afaik isn't that Google's CAD software? Unless there's a specific installer suite called that, it's confusing me

  • @sathirawickramatunga
    @sathirawickramatunga Před 10 měsíci

    Hi Leo, can you please provide the download link of the hex editor you used in the video in the description?

  • @alexk3168
    @alexk3168 Před 9 měsíci

    Can you do a video where you talk about how you get into the malware analysis field as a job? What positions to look at right out of college etc?

  • @CoolJosh3k
    @CoolJosh3k Před 10 měsíci +6

    I think you should have had a bit at the end showing where to get those tools and how to know if they are the legit versions.
    And mention at the start that you’ll give those instructions at the end.

  • @PatrickBRHu3
    @PatrickBRHu3 Před 10 měsíci +2

    awesome video, i learn a lot with you!! Greetings from BRAZIL!

  • @alfascarlate
    @alfascarlate Před 3 měsíci

    Loved the video, could you breifly teach us on how exactly do we use the HxD properly for analysis, i could not find a good video about it.

  • @erniesulovic4734
    @erniesulovic4734 Před 5 měsíci

    What about scanning a file once downloaded using malware and virus scanners? Would that work? I use AVG (free), Malware Bytes (free), and Kaspersky where I can scan a file I have downloaded.

  • @mnageh-bo1mm
    @mnageh-bo1mm Před 9 měsíci

    I really really enjoyed this video .

  • @teddym2808
    @teddym2808 Před 9 měsíci +1

    I really miss your AV test videos, I keep waiting for one but they don't seem to happen anymore. Am I the only one who wants to see tests of 2023 AV vs malwares?

  • @arete_
    @arete_ Před 5 měsíci

    Would love if you could take a look at the Adobe GenP method that is becoming increasingly popular.

  • @henryijeoma
    @henryijeoma Před 10 měsíci +1

    when you reduced the file to 15mb and put it on your desktop, why didn't Windows Defender flag it down? Or do you not have an AV on your VM?

    • @SmilerRyanYT
      @SmilerRyanYT Před 5 měsíci

      Likely upload speed. It would have to send 600+ mb to defender's servers before it can even start scanning. Assuming a 3 MB/s upload speed, it would take about 5 seconds to upload realistically, a 600mb file would take over 3 minutes which by then they would have probably clicked it already.

  • @ivans.935
    @ivans.935 Před 8 měsíci +1

    Bottom line -
    1. enable “show file extension” in explorer.
    2. Don’t run files with extensions such as exe com scr bat files unless you known what they actually are.

  • @akif7699
    @akif7699 Před 5 měsíci

    Hey man! How can I download the HxD editor that you use or similar?

  • @charleshepplewhite7384
    @charleshepplewhite7384 Před 10 měsíci

    I was wondering if utube videos could also be a problem in sending you an executable file?

  • @jeffreyneltner1
    @jeffreyneltner1 Před 21 hodinou

    What company do you recommend to monitor and detect this activity?

  • @MarcCastellsBallesta
    @MarcCastellsBallesta Před 10 měsíci

    If I don't have an hex editor, can I resize the virus by changing its extension to .txt, open it in a notepad, deleting empty lines, save, and give it back its original file extension?

  • @mohdaminbinahad-38
    @mohdaminbinahad-38 Před 10 měsíci

    Hi Sir, I got 1 question, the step on 5:15 the dot dot dotdotdot was the malicious code? or the code "pretend to size up" the file? Which one you wanna extract? Thank you very much sir for this video! I really hope you will make more video like this one on the fuutre, so we know how to encounter a malicious treat. TQVM!

    • @1p2k-223
      @1p2k-223 Před 9 měsíci +1

      It was the filler bytes

    • @mohdaminbinahad-38
      @mohdaminbinahad-38 Před 9 měsíci +1

      @@1p2k-223 thanks for the reply, so he was deleting the filler bytes. TQVM

    • @Polish_Editz
      @Polish_Editz Před 2 měsíci

      The dots were the filler bytes, which is why the file had the massive size.

  • @abitterberry2149
    @abitterberry2149 Před 10 měsíci +26

    Changing a single value, Microsoft could greatly reduce the success rate of these attacks, but file extensions are just too unsightly to be visible by default.

  • @brunob.7792
    @brunob.7792 Před 9 měsíci

    we need to reestructure the way we interact with file execution / command execution. We need a persistent shield watching the onmouse over and onmouseclick events, not allowing user to "execute" a command, before the destination of that "click" to be scanned. I was trying to implement a python-based resident shield that disables all execution commands at startup and only allows the click, after checking its after events. Tried to manage the virustotal api to do the hard work. Im still developing it, hard, but on the go

  • @RubenGonzalez-sx7lb
    @RubenGonzalez-sx7lb Před 9 měsíci

    Could you do "cat file" in linux and would serve the same way as with that editor you're using kn windows?
    Amazing video

  • @Rickoshay
    @Rickoshay Před 9 měsíci +2

    If I received an unsolicited email from an unknown sender, I'd immediately delete it. On top of that, if the attachment was any bigger than a 1 or 2 Mb and didn't have an ext that I would expect like in this case a pdf - I'd be even more suspicious. Even then, sending a contract without even contacting you directly to discuss the matter is very odd, setting off even more red flags and alarms!
    The danger is if you are busy and wading through tons of email. The best first line of defense and safeguard would be to use a mail filtering gateway like mimecast. They would pick up and flag 99.9% of all questionable incoming mail and hold all email from unknown sources - prior to release.

  • @kite-kiteajo8952
    @kite-kiteajo8952 Před 9 měsíci

    Hi im just curious, what will happen if a linux machine that has app Bottles from Flatpak and then installing pirated software/game in the Bottles? Is it will affect the linux machine?

  • @SweetNightHealing
    @SweetNightHealing Před 8 měsíci

    They did the same thing with me, offering the collab to advertise a little bit on my video and they sent the agreement and the video but I click on it and my system told me it was password stealer malware or virus but it was too late. So I don't know what to do, they hide it in the winzar or something. So I tried to do the whole fresh window install.

  • @AlexanderTatsumaki
    @AlexanderTatsumaki Před 10 měsíci +3

    to make it obvious since it was not clearly stated. do not doubbleclick to run files / scripts from unkown sources. since this is what they want. always when you recieve files like this think first about what it truly is. the default application is what "they" want their script to run with.

  • @pwilkutowski
    @pwilkutowski Před 9 měsíci +3

    Well even for a layman, rule of thumb is if an agreement document is 600+ mb while it should be 20 megs tops (and that's generous) - somethings up.
    Simple rule to follow

    • @JJFlores197
      @JJFlores197 Před 9 měsíci

      I agree, but you're assuming a layman understands file sizes. A lot of people don't understand it and don't care to do so.

    • @pwilkutowski
      @pwilkutowski Před 9 měsíci +1

      @@JJFlores197 srsly???... i guess my definition of a layman was to generous ;-/

    • @JJFlores197
      @JJFlores197 Před 9 měsíci

      @@pwilkutowski Have you ever worked in IT support or provided tech support to people? You would be surprised at the amount of stuff regular computer users don't understand about technology.

    • @Goldbeach_
      @Goldbeach_ Před 13 dny

      From this video. How to exact without downloading?

  • @Editxor
    @Editxor Před 8 měsíci

    I got the same mail and I clicked on the PDF file. But luckily I didn't use my primary pc. I used an old laptop. There was no browser logged in to that laptop. But there are some video files on that laptop. Is it safe to use those video clips?

  • @msohaib7128
    @msohaib7128 Před 9 měsíci

    What is best certification of malware analysis

  • @Wolfennar
    @Wolfennar Před 9 měsíci +1

    Seems so weird to me that by now AVs and such don't have any means of detecting such file padding. I get padding could potentially be a lot more sophisticated, but come on simply hundreds of megabytes of null bytes at the end of the file? That seems trivial to detect idk.

  • @ghostHackd
    @ghostHackd Před 10 měsíci

    Thanks, Leo!

  • @toniemojekonto3956
    @toniemojekonto3956 Před 6 měsíci

    7:00 im soooo proud of myself for understanding what you talking about

  • @brutlern
    @brutlern Před 9 měsíci

    So which AV would be capable of detecting that the 658mb file is actually malware if most AVs nowadays are cloud-based?

  • @nahakuu
    @nahakuu Před 9 měsíci

    Why Av just do not check the file from end, and if there is loads of empty space just flags it?

  • @officalcassiopeia
    @officalcassiopeia Před 10 měsíci +20

    You called korean japanese..

    • @pcsecuritychannel
      @pcsecuritychannel  Před 10 měsíci +10

      uh crap, there was another japanese one and I thought this was similar, my bad.

  • @NotGeri
    @NotGeri Před 10 měsíci +5

    Funny, Atomic Shrimp uploaded a video today that also had this scam briefly mentioned. Thanks for sharing!

    • @ryanasazaki1291
      @ryanasazaki1291 Před 10 měsíci +2

      Probably bulk-sent to a bunch of CZcamsr's email. Doesn't take too long for a less tech-savvy channel to fail for it.
      Thankfully, they sent it to the wrong channel here, once a a malware analyst make a video about it, more channel are going to be aware of it.

  • @rifwann
    @rifwann Před 10 měsíci +4

    What makes this analysis scary to do is the fact my mouse have tendency to double click on accident..

    • @meemuboi
      @meemuboi Před 9 měsíci +1

      Same lol i need a new mouse

  • @anthonynorton666
    @anthonynorton666 Před 9 měsíci

    If I understand this right, I can right click the file. Choose open with notepad, and I should see the decoded text part of your hex editor. I will not get a message saying this file cannot be opened with notepad, or something to that effect. Am I missing something?

  • @leonsoldier7438
    @leonsoldier7438 Před 10 měsíci

    I got a question about CrowdSec. Do I have to install this on a Linux/Windows server? Or can I install it on my Windows 11 machine to protect it?

  • @JohanlastZa
    @JohanlastZa Před 9 měsíci

    It still baffles me that Adobe do not enable security on their Adobe Reader by default. I do not use Adobe reader because it literally sucks at protecting against infected documents, thus I use another PDF reader that actually encapsulates each document it opens to not have system access and I use Avast but with Hardened Mode enabled. This is probably the best option to enable because it literally blocks everything (all ransomware I have tested so far) that just looks at it sideways.

  • @kb8570
    @kb8570 Před 10 měsíci

    Thank you for this video. Sorry but I am not very computer savvy but how do you know if the file being sent to you with Google Drive has been 'archived' ? Also, can you please kindly explain what you mean by 'Windows Defender is not going to be able to do a cloud lookup for a file large file'?

    • @DragoNate
      @DragoNate Před 10 měsíci +1

      if a file is "archived" like how he's mentioning, I believe that means it's in a "zipped folder". this would be a normal looking folder icon but with a zipper on it.
      windows defender is the built-in anti-virus on windows computers. how it works includes sometimes searching online databases for similar files/malware/viruses/etc to check against and scan your files - this is the 'cloud lookup' - if a file is too large, it will not be able to do this search & scan and will therefore be unable to detect it as malicious.

    • @kb8570
      @kb8570 Před 9 měsíci +1

      @@DragoNate thank you. Why is cloud lookup limited to small sized files?

    • @DragoNate
      @DragoNate Před 9 měsíci

      @@kb8570 I believe it's because there are so many files stored for cloud lookup (or the potential for there to be so many) and storing those files online available for lookup has costs. the larger a file is, the more it would cost to store it.
      There could be other reasons as well, like computing power or time, but ultimately cost seems to be the most important factor.

    • @JJFlores197
      @JJFlores197 Před 9 měsíci

      @@DragoNate I would also say: upload speed. The majority of people don't have very fast upload speeds. If you're trying to upload a file that's over 600 Mb with a slow upload speed, it will take a very long time to upload.

    • @DragoNate
      @DragoNate Před 9 měsíci

      @@JJFlores197 could be part of it as wel

  • @THUNDER52
    @THUNDER52 Před 8 měsíci

    I never use windows for email and I’ve never read a spam or scam get me - it never formsts or looks right on iPhones mail app and makes it easy to spot.

  • @gothixxx12
    @gothixxx12 Před měsícem +1

    Whenever they say, "I hope this message reaches you in blah blah blah" then you know.

  • @elcat0
    @elcat0 Před 9 měsíci +2

    that kids yay noises scared me fr in the intro section

  • @V4mpirella
    @V4mpirella Před 10 měsíci +1

    Wow, I learned a lot from this video.

  • @versq
    @versq Před 9 měsíci +2

    I would like to see a test between f-secure Bitdefender and Malwarebytes