Full transcript
0:00I received this email titled DMCA
0:02guardian briff from monale
0:05pm1978gmail.hu
0:09Hu allegedly system administration with
0:12the text, "Hey, I'm filing this notice
0:14on behalf of the copyright owner through
0:16the platform's reporting form.
0:18Authorized representative is Michael
0:19Travis. The work and its locations are
0:21listed in the form fields for this case.
0:23You can review the full report here with
0:25the rebrandly link, just a short link
0:27like tiny URL or bit.ly or other
0:30similar. We believe in good faith that
0:31the use isn't permitted. I state under
0:33penalty of perjury that this notice is
0:35accurate and I'm authorized to act for
0:37the owner. Please promptly remove or
0:38disable access to the material and
0:40confirm once processed. No response
0:41needed. The case will be updated on the
0:42platform. Process within 96 hours. Okay,
0:45so this looks like a fishing email,
0:46right? This is pretty clear, not real,
0:49not legitimate. This is complete scam.
0:51But the premise is kind of neat. So I
0:53thought, let's go take a look at what
0:54they're cooking up here. So I'm looking
0:56at this inside of Remn, the reverse
0:58engineering malware Linux distribution.
1:00And I'm just going to get a web browser
1:02open for us to take a look at this. Of
1:04course, we could be using a VPN. Maybe
1:05we take a look at this through tour. But
1:07this is our DMCA report at
1:11dmca-security.com.
1:14That is where the rebrand link took us
1:16for report 2716.
1:19Now, this actually looks kind of maybe
1:22convincing. They note the platform here
1:24is YouTube probably trying to make some
1:26ploy that oh video content theft. I
1:29stole some material from LA Productions.
1:32Apparently, Michael Travis apparently
1:34submitted over a month ago, though I am
1:36recording in November. High priority.
1:39And we have the report materials here
1:41that we could download. And then the
1:43application access to enter in our
1:46report ID. Looking at the footer here
1:48though, this is kind of funny. Copyright
1:502024. We can go take a look at the very
1:52top of the page. There were other pages
1:54here. DMCA guard, I don't know if you
1:57saw that for a quick second. Then
1:58switches to DMCA security. our services
2:01professional DMCA takedown fast
2:03processing legal compliance global
2:05coverage track record of that submit
2:08report search reports learn more let's
2:11go ahead and try to submit a report just
2:14curious what is here on this web page is
2:16it kind of real is it legitimate
2:18searching reports does that work part of
2:21me is thinking this is probably just
2:22some AI generated website that had a
2:25domain that they were able to go ahead
2:26and use can I just search for any of
2:28these okay it found one presumably
2:30Looking for exactly my code. But can I
2:32just search for anything here? Does that
2:35have any results? What if we did 1111?
2:39Nothing. Let's look for things separate
2:41from mine. Nothing above or below. I
2:45want to keep poking at that, but let me
2:46go look at the other pages. Here we have
2:48the about page that I think is
2:51everything we've kind of already seen.
2:52But a lot of this looks fake. Expert
2:54legal team, proven track record, 24/7
2:56support. Nothing else here. What does
2:59the contact us page have? Uh, different
3:02email addresses for the domain. It's
3:04missing the hyphen between DMCA
3:06security. Phone number obviously not
3:08real. Office address obviously not real.
3:12[laughter] The phone number is so bad. I
3:15do want to keep trying to search though.
3:17Let me look at the network tab as I
3:19search for something. Interesting. The
3:21response from the actual uh code that I
3:24have does give us a worker Sri Lanka
3:28includes some of the details for what
3:30would have been my specific report
3:32allegedly, but I hadn't been able to get
3:34anything else coming back. We could
3:35brute force if we really wanted to, but
3:37I don't know if we care that much. I do
3:38want to try and submit a takedown
3:40request and see how this looks. Doesn't
3:43look like there is any sanitization in
3:46submitting these things. Select all this
3:48crap.
3:51It just says an alert. There was no
3:53network request. It never sent anything
3:54to the server. All fake.
3:59Get API got a config. I wonder if
4:01there's any stuff in the API we could
4:02look at. Interesting.
4:05If I were to send a message, what
4:07happens? Can I send a message? Oh,
4:09actually has some client side validation
4:12at the very least. And we could look at
4:13that if we wanted to. Yeah, does not
4:15submit anything. No requests coming
4:16through. Just an alert. Is this entire
4:19website set up to fish me? Because I'm
4:21not getting any other results. Looks
4:23like it is trying to log when someone
4:25views a report. Let's go ahead and
4:28download our report package and let's
4:31see what it really is and what it's
4:32doing. It will prepare a report package
4:35collecting evidence and material. Oh,
4:36goes to download and then forces a
4:39download of an executable. Now, I have
4:41downloaded this previously just to be
4:42able to take a look at it, but look at
4:44these network connection requests. It's
4:45going to get this from GitHub. Look at
4:48that. GitHub Bradley Shing visibility
4:51sha. Curious what that might be. And
4:53they download the actual file. So, let's
4:55go see what their GitHub repository
4:57might be. Oh, here's our boy Bradley
5:00Shing. [laughter]
5:02No activity in this public repository
5:05that was made 3 months ago with the only
5:08executable contributed with the commit
5:11message of one from openx media. Are
5:15there any other GitHub commits? No, just
5:18open X media submitting that thing.
5:20Well, looks like OpenX Media is another
5:23account with not a lot of other
5:24activity. Uh, and OpenX Media has Ooh,
5:28interesting. A fake partnership contract
5:30media content advertising 102424.zip.
5:34Hm. Should we look at that one, too? I'm
5:36kind of curious. Anyway, we have this
5:39thing downloaded. We know it's going to
5:41be malware. We know it's probably an
5:43info stealer. Let me move from my
5:45downloads folder that take down
5:47executable file and put it in the
5:49current directory for us to play with.
5:51What does it look like? Taking a quick
5:54look. It's just an executable file,
5:56right? Nothing fancy, no net assembly,
5:59nothing that we might be able to poke
6:00and play at. So, I think we'll just opt
6:02for a quick and easy dynamic analysis.
6:04Maybe we run detected easy. Try and
6:06browse for this thing. See what it looks
6:07like. Visual Studio. Couple overlays in
6:11there. But beefy file, 44 megs, right?
6:15Well, let's make this a quick video and
6:17do some dynamic analysis inside of a
6:19sandbox so we could see this thing in
6:20action. I think the fun for this video
6:23was really just seeing that website that
6:25they probably AI vibecoded to crap
6:28together something that looks legitimate
6:29and then got a whole domain and then had
6:32some functionality to sell the fish to
6:35sell the lie. Any run is cooking up with
6:38a Windows virtual machine for us to play
6:40with. And it needs our report ID, which
6:43we knew was RPT271
6:47for our case. And maybe some of the
6:49other access things were for a another
6:52different kind of individual report,
6:55right? Oh, look, it needs a UAC. It
6:57needs a user account control. And I know
6:58the quality here is kind of shot, but
7:01loading video content. Uh-oh. Player
7:05error. Critical error. Dude, that looks
7:07so bad. That looks so fake. Establishing
7:10encrypted tunnel is what that is trying
7:12to say. If you can't see it, verifying
7:14content signature. All of this is not
7:16real. I've hidden the any run uh display
7:19of what's actually happening. But if we
7:21were to close out of this, okay, it's
7:24done a lot of damage. So, we've got
7:25PowerShell commands that are setting
7:28some exclusions to be able to run MSHTA.
7:31The Microsoft HTML application and
7:33engine querying internet actually
7:36errors. Checking if a key exists in the
7:38options directory. Ooh, options
7:42dictionary. It's looking for attack
7:44service reduction rules. That's a little
7:46neat. Conhost, of course, is executing.
7:48They do this over and over and over
7:49again to be able to MSHTA. Oh, is there
7:52more to this? Is there just going to be
7:53like hta or jcript or visual basic
7:56script that we might be able to carve
7:57out? Trying to add more exclusions to be
8:00able to run out of the directory. More
8:02exclusions. More exclusions. More
8:06exclusions. This is dumb. And these are
8:09setting antivirus exclusions, right?
8:11Ooh, interesting fake directory that
8:14gets made with index.exe.
8:16And that's going to end up running
8:17aspnetwp.exe.
8:20And that is the Ratamanthis info stealer
8:23malware. Oh, and Llama potentially, but
8:25anyone has already been able to carve
8:27out and extract the config and a lot of
8:29the dump of the material here, right?
8:31Okay. So, it's tracking the IP address
8:33that the C2 would call back to along
8:35with the endpoint. And that's that more
8:38info stealer crap. Whatever. Which of
8:40these connections are made that actually
8:42try to reach something? Takedown does go
8:44to somewhere and send some traffic, but
8:48that's all over HTTPS, so not important.
8:50Wait, did that have a domain? National
8:52competition arise0000.org.
8:54What do you look like? [laughter]
8:58Just the Apache 2 default install page
9:01on Ubuntu. Okay. And then aspet_WP
9:05is making communications to whatever
9:08that is. Whatever that IP address is
9:11waiting for data. Yeah. So there's
9:13nothing coming back. Okay, whatever.
9:16Info stealer malware. Do you think we
9:18could try to carve out any of those
9:19strings like the PowerShell exclusion
9:21commands or the hta if it were to run
9:23like jcript or visual basic script? We
9:26could try to use floss uh maybe
9:27binwalker foremost if we really wanted
9:29to. Let me foremost on our takedown
9:32binary. Ah oh floss is going to give up.
9:34We could try to give this to like
9:36dbloat. It did say it had overlays. What
9:38would foremost carve up? Anything
9:40output? Oh, that is stuff. There's a DL.
9:45There's some HTML. There's an image. And
9:48that's just the icon that we saw. Okay.
9:51What does the HTML give us? Oh, wait. Is
9:54that the HDA itself with a lot of
9:56garbage in it? What is that? Um, okay.
10:01I'm pretty sure it's just junk. At least
10:03at like first glance, none of this looks
10:06like actual code and just horrible
10:10nonsense to bloat up the binary. That is
10:14pretty hysterical though. This whole
10:16thing is kind of hysterical. Like the
10:19fact that they made this stinking
10:20website and it just funnels back to
10:22GitHub. Maybe RPT was not the right I I
10:25was just going off of report, but maybe
10:27there are some ABC ones that we could
10:29search for. If there even are, if this
10:31is like actually used in multiple
10:32campaigns. This all looks fake though.
10:35This all looks AI generated and the most
10:37chatgpt fish that I could see. Oh, wait
10:40a second. I want to look at the files
10:41that are dropped here. And this is
10:43actually kind of interesting because uh
10:45if you're using any run, the only
10:47important checkbox will show you just a
10:50couple of the files that are dropped.
10:51But if you wanted to see absolutely
10:53everything, unchecking only important
10:56and then trying to get to when this
10:58would have detonated cuz I think a
10:59couple of this is like any run
11:01boilerplate stuff. And one of these is
11:03an XML file for a task like a scheduled
11:08task in Windows for a little bit of
11:10persistence, right? because scheduled
11:12tasks in Windows are all just XML behind
11:14the scenes. So, we could see the
11:16interval when this would run, when it
11:18fires, when it starts up, and then the
11:20actual command and executable. Uh, and
11:23it's using MSHTA to go to
11:26mstamppingfor.com
11:28ad launcher content. And that is neat.
11:32Can I see what that might be? Oh,
11:36automatically downloads an hta file. So,
11:39let me look at that. Add launcher.ht.
11:43[snorts]
11:45Okay, we got maybe a little bit more to
11:47do. Dude, do we really want to? Do I
11:50really want to look at this? [laughter]
11:54Oh my lord. This is clearly their
11:58persistence mechanism though because
11:59this was set up as a scheduled task and
12:02this is like obfuscated to hell. Random
12:04file names. Oo, maybe some shortcuts
12:06getting made there. We we could make
12:08sense of some of the syntax, right, for
12:10the methods and modules and functions
12:11and libraries and things that are called
12:13that are just native to the language.
12:15But okay, sure. Yeah, we found our hta
12:19file. This is pretty clearly malicious
12:21code, but look, we could just give this
12:23to old chat gpt and see what it does. Is
12:26there anything else interesting in the
12:27any run output? Not really. There is a
12:30little bit of a neat thing though
12:31because this required you to type in the
12:35report ID. Then it's like a key to
12:39unlock the malware actually executing.
12:41So in its own right that is an antivirus
12:44evasion or anti- evasion little thing
12:46where you would have to follow along for
12:48the fish. You'd have to fall for the
12:50social engineering to end up having the
12:51malware execute. So it on its own like
12:54this binary just being thrown into a
12:55sandbox isn't going to end up
12:57detonating. So let's try and upload the
12:59hta file and see what it does. I have
13:02added the nerf file extension just so I
13:04never accidentally click on it on my
13:05own. But if I tell any run don't change
13:08the extension. I can do that manually
13:10and then I will invoke it myself uh just
13:13to have it detonate and run in the
13:14sandbox. Yep. It doesn't need to be
13:16opened as nerf. It does need to be
13:18opened as a 1 2 3 4 5. removing that
13:23ahta file which if I were to double
13:26click and have msghta execute. What do
13:30we got going on? Couple more threats.
13:32Query and registry.
13:35That's it.
13:36That's all it did. The process already
13:39ended. Wait. MS team ping 8 7 9 10. Is
13:44it doing some like neato domain
13:47generation? Not to say domain
13:48generation, but like yeah, it's trying
13:50to get stuff. msampping8.com.
13:54Other calls from there and 10 97 and
13:58others that all funnel back to this IP
14:00address. The ones that are online are
14:02hearkening back to this IP address. Does
14:05that live? Oh yeah, some Cloudflare
14:07tunnel does not like direct IP address.
14:10So let's use the actual MS ping
14:13team8.com.
14:16Was that the name of it? Uh other way
14:17around. msping8.com
14:21suspected fishing. Yep, yep, yep, yep,
14:23yep. I know it is fishing. Real capture.
14:27Ignore and proceed.
14:29Dead. Hey, sorry, John from the future
14:32here. Different day, different shirt.
14:34Uh, I had recorded this video yesterday
14:36when I first got the fishing email, but
14:38later after that, I had seen there was
14:40some chatter over on Twitter. So, big
14:42shout out, big kudos, credit where
14:43credit is due. Uh my buddy Tanner, he is
14:45a friend and fellow over at Huntress
14:47where I work, working with me there.
14:49He's at the security operations center,
14:50so I don't get to chat with him as much
14:52as I'd like to, but he caught wind of
14:53this and started to do some hunting on
14:55Valadin to see what else might be out
14:57and about. And he had some interesting
14:58findings. So, we could follow in his
15:01footsteps. I'm over here at
15:02app.valadin.com and we could straight up
15:05search for the domain we've been working
15:06with, DMCA-security.
15:09And taking a look at this, we could
15:11track down some of the other
15:12relationships. They have a ton of cool
15:14insight here uh with recent OSEN
15:16reports, other websites that might have
15:18been chatting about this, how it
15:20resolves over DNS and that clues us into
15:22a couple of the IP addresses and the
15:24historic data as to when they might have
15:26been associated with this. One that
15:28sticks out is kind of the earliest one
15:29that resolves and I think Tanner was
15:31tracking this 101.99.92.246.
15:36So clicking on that IP address to pivot
15:39off of that, we can get similar data,
15:41but the resolutions here are really
15:43interesting because it clues us in to
15:45some other potential domain names that
15:47this has been using. DMCA Hub, DMCA
15:50Shield, DMCA abuse.video, DMCA Guardian,
15:54blah blah blah blah, takedown.com,
15:58takedown global media. I don't know what
16:00some of the others are, but these are
16:02obviously a couple years delta 2023 when
16:05now the 2025 campaign looks to be what
16:08is up and atom. These are the same
16:10domains that Tanner was tracking he had
16:12seen. So, we're just retracing his work
16:13here. Again, all credit to him. But he
16:15had found something a little bit neat
16:17and uh worthwhile including here when he
16:20pivots to show and we could use Showdan
16:22or Census or many of the others. We
16:24could see some of the other ports that
16:25are open across any of the different
16:27domains that we might have seen here.
16:29and he catches their entire server.js
16:31file like the backend code may very well
16:33be visible. So here is the funniest
16:35thing. If I search for that IP within
16:38census I'll use that one here. Couple of
16:40the ports that they mention of course
16:42port 80 and 443 but they were also
16:45tracking 3001. And it looks like a lot
16:47of these different variants maybe some
16:49of the other hosted domains or if there
16:51are other instances would use some 3001
16:5430002 3003 up to like 3009. He saw one
16:58on 3009 and if we keep falling down the
17:01rabbit hole for a couple others, we
17:02could probably see similar. But let's
17:04see if we could track down the server.js
17:06file just as well and see that backend
17:09code. This is hysterical going to 3001
17:12gives you like a completely different
17:14landing page. And this like looks a
17:17little bit better. Still AI slop, right?
17:20But this looks a heck of a lot better
17:22than whatever we saw originally on
17:24DMCA-curity-hub-guardian-guard.
17:28It still has bogus like contact us
17:30details, but uh has the correct
17:32copyright at the very least. And this is
17:35the funniest thing, right? /server.js
17:38is just outright exposed.
17:41So this is the backend actual NodeJS
17:45Express application that is serving this
17:48scam and fish at least the landing page
17:50here. So let me go take a look at this
17:52in the source code. This is where all of
17:55our suspicions about some stupid
17:58horrible dumb AI vibecoded thing really
18:02is just about confirmed. Take a look at
18:04some of the syntax here. Obviously a
18:06whole lot of comments and the
18:08explanation of how to use all this
18:10stuff. This is atrociously
18:14evident and clearly some crapped out
18:17chatgpt cursor whatever uh syntax we
18:21might be able to track down. Oh,
18:25okay. Sorry, squirrel. Uh we could see
18:28maybe some of the different report IDs
18:31here. R should have been included,
18:32right? RPT2716.
18:34So I had the right hunch that it would
18:36probably be prefixed with RPT for
18:38report, not just some any other random
18:40letters. And they are of course
18:42funneling a lot of this to Telegram. So
18:45any of the interactions, probably even
18:47what we were fumbling with, it would go
18:50ahead and send that along so they could
18:51track it. I won't drag us down the
18:53entire rabbit hole here, but I thought
18:55that was kind of neat to be able to pull
18:57back the curtain, see even some of the
18:59behind the scenes and shout out some of
19:01the sweet work that others in the
19:02community are up to and some of the
19:04other cool tools that they would be
19:05using. Look at this send telegram
19:07notification. Digging it. I love some of
19:10those. Anyway, this is that send
19:12telegram notification function which has
19:15that I suppose and it just echoes out
19:18everything with console.log log and then
19:20uh funnels it over. Uh I don't think
19:22we'd be able to see the Telegram link in
19:25this case, but that was silly and fun.
19:29All right, that's all I wanted to fumble
19:31around with. Don't fall for fishing
19:33emails with fake DMCA security takedowns
19:36from Gmail addresses with misproen
19:38websites uh and AI generated content.
19:41Clearly bad details on their contact
19:44page. if you were to try and vet that.
19:47This just reeks and is hysterically bad.
19:49DMCA guard as it comes back and forth.
19:52Thanks for watching. See you later.