Hi there and welcome to Little Garden on the Prairies. So in today's video we are going to be planting some cucumbers indoors from seed and we're not just talking just any old cucumber like an English cucumber or a pickling cucumber. Today I'm going to be planting up some what I like to think of as more of the exotic varieties of cucumbers. So I've got three different varieties here I want to try out today. We've got the Cucamalon which is one that I have failed at miserably so far. I got these lemon cucumber seeds from a local company that I'm excited to try out and I also have these yellow apple cucumbers which were sent to me through a seed exchange last year that I'm anxious to try out. So I was a little anxious to get this film done today because I haven't been feeling well. Just started actually today. Both my husband and I tested positive for COVID using one of those at home rapid tests and the result was positive for us both so we're decided to you know just stay in isolation here for the next four or five days. So far I don't feel too bad but I am can start to feel a head cold coming on here and I hope that I don't do too much sniffling during this video and if so I will try to edit it out as much as I can. So let's get started planting some cucumbers. So first of all I just want to talk about the cucumber in general. I think that cucumbers from the garden are one of the one of my favorites to grow. I rank cucumbers right up there with tomatoes and potatoes fresh from the garden. You just can't beat them and I don't think you can actually get a cucumber from the store or even a greenhouse that tastes as good as one fresh out of the garden. So I have gone back and forth between direct sowing and starting cucumbers indoors. A lot of the cucumbers that I grow can be direct sown into the soil once it's warm enough. I find that they germinate and sprout quite quickly and take off. I've tried starting some indoors two or three weeks before planting out and had some failures with transplanting them. So my plan this year is to go with the direct sowing for my straight aids, my pickling type, the English type cucumbers. I usually have three or four of those basic cucumbers that I will be direct sowing. So for the purpose of this video I wanted to show you how to start cucumbers indoors. I'm going to be using these particular seeds because they do recommend a cucumber melon to be started indoors. Cucummelons require a quite warm environment to get going according to the instructions here. You will find if you do some research on cucumbers, they have a lot of different names such as the mouse melon, the Mexican gherkin, I've seen Mexican watermelon and they do kind of resemble a tiny little watermelon if you can see that there. They say that they have a kind of a cucumber lime flavor which sounds good. I think these would be really great just to snack on or to have in salads as well as the lemon cucumber which obviously must have a lemon flavor. This one again was an interesting type cucumber that I've never tasted myself. And as I said, I got this yellow apple from a seed exchange from a gardening friend in Ontario. I'll put up a picture of what a yellow apple cucumber looks like. It seems quite similar to the lemon. So my plan is to plant these up in these large, I would say these are like a five inch type container. I want to get just one plant sprouted and growing in each of these containers. Keep it in here as long as I can and then transplant them into containers that will go outside. It's my understanding the cucumber melon is a very viney type cucumber that will need some trellising. As I mentioned, we love eating fresh cucumbers from the garden and having them in our salads and sandwiches. But when it comes to pickling cucumbers, that is just not something that I enjoy doing. I'm obviously not very good at it. I have tried it. I think right now there are two or three jars sitting in the back of my fridge of pickles that I've made last year that nobody has eaten. So I don't really care to pickle. Not a big pickle eater, so to speak. We enjoy the odd jar of pickles made by the Bix Company, which I think do a way better job than me. So not to offend all those pickle makers out there. I'm sure there's a lot of people that make wonderful pickles, but I do not. And we'll probably give up on trying to improve my pickling skills, at least for now anyway. So you always want to make sure that the soil that you are starting your seeds in is well saturated and moistened. It's not bad, but I should have maybe wet it down a little bit before I put it in these containers. So another method you can do is just to place it in some kind of a container here and add a couple inches of water. Just let these containers sit for 20 minutes or so to soak up as much water as they can. And then once we plant the seeds we can also do a good spray over the surface of the soil as well. So because we enjoy our fresh cucumbers so much, growing cucumbers indoor in the wintertime has also been something that I've been working really hard to perfect. I'm going to show you what I have growing here in my grow tent. So it pretty much took me all winter to finally have success with growing cucumbers indoors. It's important to find varieties that are self-pollinating or only have the female flowers so that they don't need to be pollinated. So once I caught on to that trick I got a few different varieties going here. The plants are starting to die off but I just wanted to show you that. I do have a couple more cucumbers coming here which is exciting. So I still believe that the ones out of the garden grown in dirt are the best tasting but at least now we can enjoy some fresh cucumbers off the vine all year round. So my goal is to just have one plant going in each of these containers. So I'm going to do my three seed method just to ensure germination. So we'll start off with the cucumbers. As you can see they're very tiny. They'll almost look like a sesame seed to me.  And I'm going to plant them all fairly close to the center of this container. And once I have germination and they get a little bigger past that two leaf stage I will remove two of them and just keep the strongest of the three. So I just realized as I flipped this around that I have not marked what I've planted which is something that I have done a few times. You get planting and talking and switching around your pots and realize that you didn't mark what you just put into the dirt which can be a real pain. I was planting my peppers a couple weeks ago and making a film of it. I had four different varieties that I was going to be trying this year. Put them into the containers and put them under the lights and realize that I had not identified what each one was anywhere on the container. So all of them have sprouted. They're growing great. They all look exactly the same. And I don't think I'm going to know what kind of peppers they are until they start producing fruit in the middle of the summer. So the peppers is going to be a surprise this year. And of course cucumbers are so easy to collect seeds from in the fall. So if you have a really good variety that you like and they are preferably an heirloom as opposed to a hybrid type seed, you know, they're easy to collect and save. So that's pretty much it as far as the planting part of this goes. There's nothing too technical about planting your cucumber seeds. I'm going to give each of these a good spritzing on the top. And I've been using vermiculite on the tops of all my seedlings this year just to help keep the moisture in. It helps prevent damping off which is that kind of that green mossy, moldy stuff that you sometimes see on the top of your seedling soil. It also helps prevent fungus gnats from laying eggs in the soil. And of course if you bottom water that also helps with that damping off and fungus net issue on the top of your soil. So now I'm going to show you how I'm going to set these up under the grow lights. Give you a quick tour of what's going on down here and how things are doing. These are all my petunias and snapdragons that are filling up these cells quite quickly. All my tomatoes that you seen a video on last week are sprouting which is very exciting. Over here are more petunias, pansies, onions. Onions are going to need a haircut here pretty soon. The colysis that I transplanted showed you in a previous video are all doing great. More pansies. Here are my mystery peppers. So you can see they all look pretty much the same. So we'll see how those turn out. So something I didn't mention at the beginning of the video is that we are at about seven weeks before our last frost date here on the Saskatchewan Carries. I usually go by May long weekend here which is the 23rd of May as kind of the big planting weekend. So counting back from that weekend we're at about seven weeks. So for cucumbers they recommend if you start them indoors do it six to eight weeks prior to your last frost date. So we are pretty much right on par here. So I'm going to be using this DIY grow box that I built a couple years ago. I have a video that I can leave you the link below. It's very easy. It's just made out of a Rubbermaid tub lined with tinfoil. Got a grow light in the lid here. And I'm also using a seedling heat mat which is something you don't have to use but if you are one who does a lot of seed starting indoors I highly recommend investing in one. They don't cost a whole lot and they're great for some of these seedlings that like that extra heat when they are sprouting. So I have this set to be on 24 seven and I have this grow light plugged in on my timer bar that is set to be on for 16 hours off for eight. So it'll be nice and close to these plants for now. So I expect to see germination here with these cucumbers within seven to 14 days. So if you enjoyed watching my video I would appreciate it if you hit that like button. Leave me a comment and don't forget to subscribe so you don't miss out on the next video coming to the channel. Thanks for watching.


So it's upon us. It is upon us. Week four of the 2017 NFL season is here. We are on to week four. We are on to week four and in week four evens play the Pittsburgh Steelers. The Steelers play the Baltimore Ravens and this is a game the best rivalry in the NFL and it's not even close. Now YouTube team keep it clean. What's going on is engraving here with another video and in this video we are getting ready to talk about what is the best rivalry in football. What is always the best game in football and the game in football that never deserves to be off of prime time. This should always be a prime time game. It should always be a night game. It should always be a game where the world gets to watch because it's the best game ever man. It's the best game ever. Now really quick let me introduce myself. Me I'm engraving this. This is my YouTube channel engraving and I'm a Ravens fan and even though I'm a Ravens fan we talk about Ravens on here all the time but we also talk about all 32 NFL football teams. So if you are Ravens fan make sure you subscribe. If you are Steelers fan make sure you subscribe and make sure y'all leave a like on the video. It's like 15 16 people in here but only 10 likes. We got to fix that man.  So that should be a nice sight to see but an even better sight to see will be if we can beat the Pittsburgh Steelers. Now like I said just about those Pittsburgh Steelers my how the mighty have fallen but so did those Ravens. Both teams went into last week 2-0. The Ravens have beat the Bengals and the Browns. The Steelers have beat the Browns and who did they beat. The Browns I'm always it's not clicking it's not clicking it's not clicking. Who else did the Steelers beat. It's not coming to my mind right now. I know one of y'all gonna put in the comment section sooner or later. The Vikings. Oh yeah the Vikings. Okay there we go. Appreciate y'all. Thank you. All right. But then both teams went in the last week 2-0. Ravens flew over to London to Jacksonville's real home stadium. Got blown out. Steelers played the Chicago Bears and got beat in the overtime. Now a lot of people gonna be like man. Those dudes got blown out. 44 to 7. Blacko 2 for what 28 yards something like that. The worst game of his career. And he's had some other duds too. Trust me he's had some other duds but that was probably the worst one ever. People are like hey the Ravens Steelers it took the Bears overtime to beat those guys. They took them into overtime. They couldn't even beat them in four quarters. That's fine but guess what. Let me tell you something. And I said it before I said it again. Both of those losses they mean the exact same thing. They mean the exact same thing. They're both losses. And that's it. Again like I always say whether you lose by 37 or whether you lose by 6. A loss is exactly what it is. It's a loss. A loss is a loss. And that's it. So really quick. While I'm pulling up to this red light. Let me see what my boy Trio said. He said I'm not hating but usually somebody starts to comment with I'm not hating but not to say it's hating but it's usually something that they think that you're really not gonna like to hear. But I don't mind. Give me one sec. We're pulling up right now. I really want to read this. Shout out to my boy Trio. All right. So Trio said I'm not hating but the Ravens be some very trash team so far. So I can't say much that the Ravens are good. The Steelers are okay because they beat the Vikings and then lost to the Bears. So I can't say. Exactly. Ain't no hating that comment at all. He didn't even have to put that no hate button. It comes to and I know a lot of Ravens fans. They might be scared right now. They made a lot of them jumped off the cliff.  We're done for the year after one game after one game after one game. A lot of them have been like that. And that's fine.  If you have games where you get whooped like that then it's gonna happen. It's gonna happen. Oh CJ and kid you must not have been around here long enough to be saying that. You must not have been on this channel for too long. But Ravens will be fine. Steelers will be fine.  Now going into this game on offense which team has the better offense it has been Steelers and it's been Steelers for a long time. Off offense is not something that Ravens really pride themselves on. Off offense is not something that they really known for. There's only been a couple years. Definitely 2014 the whole Gary Kubi Egg thing. They really have a good run game but recently it hasn't been so good. Now so offense wise the edge would have to go to the Steelers definitely. Well not even the edge just everything would have to go to Steelers offense wise. Now defense wise that would have to go even with the game last week. Even with the game last week. And hopefully it was just a flukey game. But I mean losing by 34 points. I don't think I mean losing by 37 points. I don't think that's real flukey. But hopefully the defense was just off. They were just off. Hopefully they were just off. So I'll get a defensive edge to Baltimore. And of course I know people gotta be in the comment section like in Raven. They just gave up 44 points to the Jaguars. How can you give a defensive edge to the Ravens? Just chill man. Just relax. Because that was one game. It's one game. You don't get hung up over one game. And again this is stuff that I've said already in past streams and I'll say it again. And I even said this after we beat the Bengals. I've even said this after we beat the Browns. I said this is just one game. It's just one game. It's one game. So we can't get all high and mighty over beating the Bengals. Can't get all high and mighty over beating any team. Because you gotta get to the next game. You see what happened. They got to the next game against the Jaguars and got the streak. So this game is gonna come down where it comes down to in every Raven Steelers game. Number one, Rollersburg. Rollersburg. Can you attack Rollersburg? Can you hit them? Can you get pressure on being Rollersburg? They too. They gotta get pressure on Big Ben. They have to. Y'all make sure y'all leave a like on the video too. But they gotta get pressure on Big Ben. That's a must. If you don't get pressure on Big Ben, you're done. Because one of the things that Ben Rollersburg does, I hate saying his name. It sounds so weird right now when I'm saying it. I don't know Rollersburg. Whatever. But if you don't get pressure on Big Ben, he does something that I love to see from quarterbacks except from him when he plays Baltimore.  If you don't get pressure on Big Ben, he will hold the ball forever. And it'll be just like when you play with your friends, when you play street football with your friends and somebody's playing quarterback and they'll hold the ball forever. They'll be like, Oh, go that way. Go that way. You need to go this way. And they'll wait until somebody comes open. They'll wait until they see that big play opportunity. They'll wait and wait and wait. And once he sees it, bombs away. And Ben Rollersburg, he'll put it on the money, too. He'll put it on the money. It's so frustrating when he does it, but he doesn't so well, man. He doesn't so well. It's like, Oh, gosh. Because that and he'll sometimes he'll even be facing pressure. He'll be facing pressure and he'll run out of the pocket, scramble a little bit, go a little bit to the left, go a little bit to the right. And when you see that, when you see your finger point out and see that arm stretch back, that's it. Bombs away. So they got to get pressure on Ravens got to get pressure on Big Ben. And with Steelers, they got to be able to avoid pressure from Baltimore's their front seven defensive line line backers, everybody blitz. You know, they're gonna send the corners and everything to ask what Steelers would need to do in order to counter the Ravens pass rush. Something else that Steelers will have to do, which they don't usually do well against Baltimore, especially recently would be too. Well, I mean, they did pretty good in that in that game on December 25th last year. But they would have to run the ball. They would have to run the ball effectively. If they can run the ball effectively on Baltimore, that's going to change everything. They will change everything and Baltimore can't stop to run. That's going to change everything. And Baltimore usually does pretty good against the running versus Pittsburgh. They usually have to they usually do pretty good against the running against Pittsburgh. They usually do pretty well at holding holding down LaVionville. So that's usually not a problem. But hey, any given Sunday, so you never know, man. You never know. Another thing that would have to happen. They got a Steelers for Steelers to get an edge, they will have to get their playmakers involved early. Their playmakers being Tony O Brown, more Tavius Bryant, who's back doesn't even seem like he missed a step. Eli Rogers, of course, LaVionville, Big Ben, and the title with Jesse James, that's his name.  Baltimore, the quarterback's going to be on point, cornerbacks and safeties. You know, there's going to be them plays. We can't get to Big Ben every single play. I mean, I hope that we could, but it's just it's it's it's impossible. You're not going to be able to get them on every single play. You're not going to be able to get pressure on them every single play. So cornerbacks and safeties, they got to play sound solid football and sound solid coverage. You've got to stick with you playing me. You got to stick with your man.  You're going to need it. Another thing, too, that would actually be even more important than staying on point in your zone or when you're playing your man, because you can be, you can be the greatest man coverage corner in the world. You can be the best zone lineback in the world, best safety in the world, whatever. But if Ben Rothesberger throws a perfect pass and it and the receiver tight end running back, whoever catches it catches it, you got to tackle. You have to tackle. If there's bad tackling, then that means a five yard play could turn into a 10 or 15 yard play. They got to be able to tackle. They got to tackle. They got to be able to tackle. If you don't tackle, that just makes the plays that much longer. So and that will flackle. Flackle. Let's talk about flack. They got to give them protection. And the receivers, you got to do something. You got to help each other out. A lot of it, a lot of our offensive success is on flackle, but it's not all on flackle, man. It's not all on flackle. Offensive line got a block up front. And receivers tight ends run, get open and catch the ball. Get open and catch the ball. Stop giving up on plays. Mike Wallace, you got to stop it, man. These dudes, they got to play better. Why is my weird name outside, man? Why is this dude always outside, man? Jeez, so annoying. But it's going to take, it's going to take everything. Now, we're not done breaking this down. We still got some more breaking down to do. But right now I got to go. I got to get ready. So this is only part one. This is only part one. We're going to do another breakdown of the game. And we're going to go from there. Appreciate y'all. Thank you. Everybody make sure you leave a like on the video if you haven't done so already. And let me know what you want to talk about in part two. I already got some things on my mind that I plan on talking about in part two. And we're really going to break it down. We're going to break it down to where I'll be able to focus on y'all. So I won't be on the way home from work or anything like that. Or maybe I might be. But for part two I really want to focus. What is that? What's this guy? I got some weird annoying neighbors. Anyway, appreciate y'all. I'm out.


Hello everybody and welcome back. We're doing it again. We're doing another YouTube In this video, I want to do something a little bit of fun a little bit of funky The last couple videos the malware analysis video people seem to really enjoy and really like And the recent giveaway video for Fawaz's try hack me room People seem to really like that I kind of went in cold going in blind not exactly knowing what was going on and for having me Suffer and figure it out all along the way So what we're doing in this video is a good synthesis of the two like that like a little butterfly thing So let's get to it. I'll hop over to my computer screen here and we'll get to the fun stuff So here I am in my good old terminal boy And I'm gonna LS in the current directory that I'm in which is called notepad.js because I have this peculiar file here Notepad.js. So this is a little artifact, right? This is a little something something that we found and I want to take a gander of what this thing is Obviously file is going to tell me like hey, this is plain text. It's ASCII It has some long lines in there and it was originally found on a windows host, right? Hence js It is not in fact javascript, but it is jscript one of those Sweet little scripting languages that will inherently run natively on windows So it's a little spooky little spooky wookie, but let's take a gander at what this thing is So I'll fire up my sublime text editor here and I've got this notepad.js file And you can see that there's some fun stuff going on. So, uh, let's I'm not I'm not actually save this right I'm gonna save this as original notepad.js just so I can kind of maintain that backup And I'll save another copy of it as a de obfuscated because obviously while I'm looking at this thing I'm gonna need to make some sense of it. So let's do it And again, I don't exactly know where this is going to go I started this process and then I was like, you know what this might make a stellar video So, uh, let's get cranking and uh figure out what we might be doing here We are running jscript code and we have some variables defined That are nonsense like jdf ff jf And it seems to create a string with gf as kind of a variable maybe indicated in powershell syntax with, uh, random zeros and ones and plus signs So I'm not exactly positive what this might be doing I don't know if it's adding these numbers together for some reason um But some of them I see end in like a plus plus or a plus on their own So that wouldn't actually be adding anything but that goes on for a long while like check out my scroll bar here down at the bottom We're cruising for quite some time. So that it might be something, uh, nido benito Let's uh, oh, there's a pipe there also at the end on that that last one here So maybe that's going to do something wonky Let's call that gf Let's call that that gf variable because that's apparently all that we know so far and this gf variable If it were in fact powershell, what i'm going to do is i'm actually going to fire up a Virtual box because I've got a windows vm that I kind of want to poke around and and see if I can get anything Nice with this, uh, let's explore that powershell. Actually, I could probably do it on powershell on my linux host Actually, do I have that? Well that will that just kind of behave? Oh, well a little powershell down here Can you do it? Can you do it? Can you do it for me? Thank you. Let's uh, make that profile blue So I know that I'm in a different shell there and okay, let's uh slap in that gf code Copy and paste that Poop it in right there and yeah, it's like I don't know what to do with these plus signs, dude I feel you on that one, man so gf variable although it seemingly ends Like that is inside of A parentheses like array or tuple thing. So I'm pretty sure If that ends but it ends here, maybe that's maybe the second one. There's tl fkl msdf How would you pronounce that talk from most of That's got to be a gf continued continued There we go. Okay, so let's save those and uh, looks like we do things with them With these functions here. So let's start to figure out what those actually are. Oh, that's actually being passed into this ebb gawk fell So Let's see what our good friend ebb gawk fell does Where's he referenced? Okay scrolling down. There's not a lot to this. This is actually just 75 lines of code. So we might have some fun with this here, but let's see what we do Uh ebb gawk fell That function splits on plus signs And joins them together With ones Okay, so I think if this is just essentially javascript code I mean, obviously it's j script, but it has the same engine structure as Javascript then doing the streaming string manipulation stuff Like this should be something that I could just do in node Like node j s to be able to kind of test this server side in locally. So let's try that if I put my power shell away Can I do a little node j s in here? All right. I'm in a prompt so I can console.log Hello world. Oh, actually, let's you know what? Let's get something better. There we go. Okay, cool. All right, it works Let's take this giant line and let's call that gf slap that in Okay Now I've got my gf There he is And let's get this function Split on We'll call this like split No, I want to search for that and replace it, please. So split plus How about that? Let's actually take that function and also slap that in here. So now I have my good friend split plus And we would need to pass in some strings So the plus signs are going to end up being essentially replaced with once That kind of clues me in that It's probably going to be binary code Yeah Yeah, it is. Okay. So, um, then we also need to do that on our little Gf continued here. So Slap that in Now let's do a little split plus and they were adding on split plus gf continued Plus plus Gf continued and now we have this whole thing Okay, so let's awkwardly try and copy this entire string and let's save this as just another randomness. Uh, let's just call this Gf variable Dot x Yeah, that's fine Okay, um, I'm I know there's a pipe there at the end But I'm going to ignore that for now right at this very moment I kind of want to see if this is in fact binary So, you know what? Let's let's open a little web browser and go to the most leet website that there is asky2hex.com And let's see if this binary actually comes out to be anything. It's probably going to be like A binary file. Okay asky2hex.com. What's going on? What's how you doing? Where are you at? Who are you? Who? Where are you? Uh, rapid tables could do it. ASCII table could do it. Let's go to that rapid tables That's not gonna do it for me How is there not an ASCII2hex.com? I see it like in different representations of ASCII the word to and then Oh, I gotta split these on like that. Oh, oh, look at that. Look at that That looks like PowerShell code to do funky stuff All right, let's save that as a gf PowerShell .ps1 Yeah, and we will need to obfuscate that later Let me table that for now, uh, because we haven't exactly finished making sense of our good old notepad j s but we do know that This eventually becomes PowerShell code. I don't know what these other functions are doing though So, uh, let's figure that out Um, we basically figured out these things. We basically figured out those Now let's see what else we got. I don't exactly know where to go with this truth be told. Um Script full name Script full name replacing the script phone. Is that going to take the path? I feel like that's going to get the path Because script full name is going to be the absolute path and then you're replacing the script name with nothing So I think it's just getting the path of this Path Let me replace that. I'm pretty sure w script out full name Will be the absolute path of this program or this running script and then we're removing the script file name with nothing I just repeated myself to make sure I got that point across. I'm pretty sure That's the path Or folder for This script How about that? So it checks if the folder for this script is equal to this thing, which we know is set to Something's username app data roaming So let's change that to App Or current user App data roaming i'm going to be using long verbose variable names here So I can actually understand what this is doing Um And if this is actually able to retrieve the username, it's probably going to be like w script shell or something I have a feeling uh and script full name. This is just going to be okay Full script path Okay, so this checks if the folder for this script is The current user app data roaming then it will Do nothing So it's probably already where it wants to be otherwise it goes ahead and cmd slash copy um copies This currently running script to current user app data roaming and it overwrites it Okay, so let's say copy command for that copy command to move Script to app data roaming Dunzo, okay, so then that is also still included here in this uh else statement And that Is seemingly going to run a command seemingly run that function. Uh, so let's call that run command Makes sense. Okay. That's clearing some of it up now Okay, so we are going to run command on all of this stuff But I don't know what these functions are yet So var vm gazunith Get object. This is probably w script Oh, oh no Oh no Well this function right here that kind of makes sense already l gamut That is just going to end up reversing the string So we can call that reverse string and Our new gel foe That bad boy is going to take this and just concatenate those together Doing some good antivirus evasion doing some obfuscation ladies and gentlemen, so Let's slap all that together And our little node interpreter And let's just make that that And since that literally just returns this we can just kind of replace all occurrences of that With this Make our lives easier here. Oh god I just straight up removed it Piss that in do it. Okie dokie. So we don't need that function anymore and Get object and reverse string is just going to end up doing how many times do we use reverse string? a few but If that's just going to end up being reversed in this get object command, I'm pretty sure that's just going to end up being w script dot shell So let's take that string and reverse it I'm just do this in python because I don't know the syntax for it in node off the top of my head And this must be like a new Cs cls id like the class id things and windows I am not too sharp on that But we should have our windows vm crank in here So let's see If I can do that exact same thing Can I uh invoke a class by like buy a power shell or something to do that? To like simulate this exact same functionality in w script that I don't know I'm going to assume that this is w script dot shell because it has this run function So let me do that. I'm just going to call this w script shell And then it runs that command I don't know why it saves this as a variable because it doesn't seem to do anything Um, and then we have a registry persistence thing reg add with a cmd slash c hq current user software microsoft windows current version run Adding the value lul Lul lol hackers gonna lul Um, it makes it as a string and adds in our current user app data roaming with our script name. Okay, so Eventually this notepad.js file does want to be in current user app data roaming under its name So I will call this function persist in registry And this must be uh reg add command For persistence good enough Okie dokie Split plus is good Let's figure out what our jkkw functions doing Actually, I want to know what this thing is Do we end up calling this is that different from that is a different cls id If that's the right terminology, I might be saying that wrong Let's start from the top. Let's take a step back. Let's kind of remind ourselves where we came from, you know We do a get object What class has dot username? in w script Gosh Oh, I so wish I oh Cortana. What are you stinking doing? Uh, let's find out w script get username How to get username with vbs Dot network Is that it? Uh, is there a windows like cls id lookup thing? cls id keys uh I guess we could look in like the registry for those classes, but Is it an app id? Is there a list of these? Okay, so cls id's look like a guid And these do not look like guids do they? No maybe Uh, how about an app id? What the heck's an app id? Sorry for that epilepsy guys windows app id list Identifies the app id guid that corresponds to the names executable um Community malforensics that sounds kind of cool. That sounds like what I want Application id is those don't seem to be I think it is a cls id But how do I get a? Explorer shell explorer network. What would all these be like in? a w script class or like in A object How's the windows doing? I don't care Please leave me alone in cortana Please get out of my house. Oh god.  You can do it. You can do it. Oh, you did it. Okay New text file something something Something something dot j s Yep, do it. All right. Let's uh edit this. I'm waiting for windows defender to be like virus I create a single j script file. It's just like no Um Can I message box that out in j script? I don't know I genuinely don't know let me make this bigger so you guys with eyes can see it because Oh control plus and notepad stinking works Are you kidding me? I always thought I had to go into like format to like You know change the whole thing Like change the whole font. All right. Let's double click on that. Yep. Open it with the windows base script post, please Die Three one object expected Oh, duh. I I just want that Please does message box do it? No Uh Wscript.shell echo is a thing if this is in fact wscript.shell. I'm pretty sure Hello Once again, let's go for even better Now we're talking boys And needs a freaking semicolon. I guess it's j script, right? Come on Does that need Parentheses gosh, I wish I were so much better at this object is not to excuse me Okay, you know what let's let's move on I think Let's just keep cruising This guy's gonna do something funky. This is gonna get Seemingly power shell power In reverse right p o w e r at power shell. This is literally just generating the string for power shell And it's reversing it. So this can totally be replaced with just the string power shell Imagine that Let's replace all those Let's totally nerf that function since we don't need it anymore and let's see where else it's running power show Oh, wow It runs power show right at the very top with our gf variable that we knew was power shell code Okay, it's all coming together ladies and gentlemen This is slowly becoming actually understandable, which is nice, uh, but we don't know about this thing yet I don't know what path that is ultimately. It's just the same one. I don't I don't know what like cls id or whatever the thing is it's getting it's getting the object that allows us to get the username But that's literally it. So I don't think we need to We don't need to waste our time On that ladies and gentlemen, let's get back to the good old power shell code I think now that we've made a good understanding of this Let's just call this the w script network as that is seemingly the only thing that, uh This is going to end up being This so we can kill that entire function yet again And now that reverse string is going to give us that new whatever that Csl id is can I just look for that? Oh, I need to kind of reverse it.  It's not even here whatsoever. Okay Uh, I don't like these advertisements. We still can't believe You didn't see this here folks This wasn't in a john hammond video booking confirmation booking that thing new shipment dot vbs and some hybrid analysis malware Detected to siri kata alert Created guarded memory stuff. Yeah, I mean, this isn't the exact same thing that I'm looking at though, right? It's a visual basic script file Wait, is that the same hash that I had Is that the same hash? It's vbs though. It's totally not It's totally completely different Let me go back to my, uh Let's get back to my terminal here Let me just do a shot 256 some hash on our original notepad js No, it's just d9 at the very start and that was dfbe That does some weird stuff though. You can tell by the way that it is Look at that process tree. That's insane Gotta love it man Gotta love some good malware Oh, Joe sandbox got some good stuff and they're using a New object. I need to stop. I know I need to stop We're going down rabbit holes that we really don't need to be because we kind of know where this goes next so Where else do we use reverse string? Just there What is this function? Did we never clear that? Oh, no, it's power shell. It's more power shell. We didn't finish um Let's take this and let's reverse it So back in our python. I'm gonna slap that in and What did I do that wrong? iex This is the original string Reverse it Am I do I have that syntax wrong? I just did this What is happening? Please sub reversed Right Oh, oh, there's separate strings. I'm a Dumbo So this this all needs to be put together first.  I'm sorry. I was totally misreading that This is why you need like syntax highlighting everybody. That's why you got to open up a little b python Now we're cool. Okay. There we go Let's say a can equal that thing all added together and now I have that original string and then I can Reverse that and now it's actually stinking readable Incredible all right So jkw Can be totally replaced with Gosh dang it. I lost the string that And let's make sure that that is uh Actually regular expression accepted Do it Oh, that's a mess. Oh god. Why did I do that? Does that have a It has a new line in it for some reason so we don't need to reverse string anymore But we know that that was piped in like the gf the gf variable was piped into this right so That's just gonna end up executing that power shell code So we got vb script network. Let's reverse this thing too just for our just for our good safekeeping Finish up this script. So we kind of know everything that this thing does and it's not not a mystery We can get rid of our reverse script function And this is basically the obfuscated. So let's call this like ran command Our string plus doesn't need to exist anymore a reverse string is only being defined Now it's no longer being called Run command persistent registry string plus and everything and then there's a little persistent Okay, I think at this point we can call this done We are 30 minutes into the video and we have finished up with this j script code We have known and figured out that this gf variable is doing some peculiar stuff in binary And you can actually see that in this power shell code because it ends up taking Every line every portion of this That's that percent sign is a for loop alias and power shell and for every single binary byte here It gets a string value from it and converts it from binary. So it's 2 in 32 with base 2 Right being said there So it knows it's binary and it joins together as a string And then it runs iex and has a little neat obfuscation and that you can throw back to Literally stink in anywhere in power show code and power show will still do it So it invoke expression iex being the alias for invoke expression on all of that binary Wow Why did we do this guys? So let's get that power show code going. All right, you know, let's start to let's start to de obfuscate this thing de obfuscated power shell also known as gf So let's do a ping so we Ping until we have internet connection Is that right We only send one ping every time. Let's try that in a A genuine power shell. I could probably do that on windows again, but you know what? I'm sorry. I could probably do that in my linux power shell again. I'm pretty sure that command will be understood and ran Let's uh Let's make this bigger. I think I think 36 is big enough. How about you? How about you? What do you think? Let's slap that in Okay, yeah ping is gonna run quiet. So What was that command? I was probably doing some sketchy stuff. So if I'm using wimic to os get Random port on an internal ip address something xsl. No one knows what john was up to that day What else we got Then we get this t56 fg variable And we get a enum protocall type to that thing. What is that? Let's find out what that is slap that in What is our t56 fg tls 12? Oh, we're doing some tls stuff everybody Let's uh put that guy back And let's say tls 12 How about that? So we got a The security protocol and we're doing maybe some encryption stuff. We're gonna end up doing some system management automation amsi you Is this an amsi bypass? Oh, it is Oh my gosh, it is is that It sets the value To null and true Holy cow Yo that that I hope that's an amsi bypass amsi bypass Let's uh Bring these back to normalcy I should probably have just done a fine and replace for this rather than do it by hand, but uh, you know Get field amsi and it failed non Oh non public static So it's getting Those fields That it's going to be replaced with pub as we saw And then it adds in static set value null to true Uh, and then it goes to do some web client stuff. So I don't exactly think there's anything more to that Is that literally all it takes? Let me try Let's do a sanity check. Let's just run amsi utils in our windows vm to see if amsi is running currently Which it is Dope dip and dots. That's kind of what it should be doing. So now let's slap in that amsi bypass here And no it didn't like that it weirded me out because that's not like I don't think that's all that you need to do for an amsi bypass. I feel like that's a little small I don't know. Uh, maybe it does something else Because it doesn't store that in anything. It literally doesn't Sorry, I'm flailing my windows around with alt tab. Let's uh, let's go back Service point manager. It sets the security protocol to tls 12 And then we get a tty. So Let's uh slap those together So we can read that just fine And that needs to be brought into iex In which case that just makes tty be a web client object. Yeah Uh tty is a web client object.  That's kind of a cool trick. I've never actually seen that set up That way you don't have the full like new object net dot web client dot download string It just kind of calls it it's gonna at least a little bit separated and that way you could do more obfuscation on this That's kind of neat I'm sorry Look at that url everybody I'm sorry all right, so Holy cow. You don't you don't see that anywhere else. I've been here ladies and gentlemen. This is where it's really at. All right sketchy url Sketchy url. We're gonna download string from attack.jpg. Let's see if that bad boy's still a thing. You know what I'm on linux, you know I'm a ballsy guy Does that literally still exist? Yo, yo hit me with it Give it to me. I want it. Let's curl it down Okay, okay, here we go. Let's output that to a good ol attack.jpg Oh What you see there boys Aske tax. Yeah, what do you think? What do you think? Loading image shush shush sublime tax. No, no, no, no, no. Let's make that. Let's make that real Aske And it's probably it's is that passed to iex honestly Oh, it's gonna. Yeah, it's gonna end up passing it to iex after it filters it out so We'll call that thing Raw payload and how about that? Because that's going to end up taking the contents from this splitting it on percent signs and then for every single object there It's going to consider it to be hex and then Join them all together.   So Um Let's call that final payload Yeah, yeah And then it invokes it. So we're up to stage three ladies and gentlemen. Let's check out attack dot jpeg Dot text and Okie dokie This is just like a url encoded thing because it's hex and with the percent signs. So You know what? Let's uh, let's let's make a little mess here. Let's call uh, uh Reverse or let's call it like stage three Stage three dot python.  I don't exactly care. Honestly. Well, let's do a little context manager because I'm on the internet and people are gonna yell at me So with open that thing as handle. Let's do handle dot read Actually, let's save that and I don't want it to be bites guys, you know I decided I thought really long and hard about it and I thought it's just not worth it Who cares about encoding and stuff? So we get all that we do the contents. We do contents dot split by parentheses and let's get a little p print So we can see that displayed Nice, let's do uh from peep in imp and peep hint. That's exactly how you say it And let's run that stage three dot python. Excuse me Syntax error. What are you going on about? I forgot a parentheses. That's exactly why you were totally right. I was wrong. Um, okay Now we got all that stuff There's a lot dude. It's pretty big All right, let's uh, let's strip that uh, because it might be some other noise and nonsense in there and let's uh start To convert those to hex. So let's do int of Wait a second. Yeah four x in that let's do int of x base 16 and Now we got the actual hex numbers um, and let's say What do you want to call that? I mean those are bites. Aren't they not? Let's just convert it convert to character convert to character, please it's gonna it's gonna give me Python code. It's gonna give me power shell code. I'm sorry So character all those now, let's join that all together and let's do a little print on that guy Sorry, sorry, I'm frantically moving my windows around and now we've got this Does it ever end? Let's uh, tee that out to a good old stage four dot ps1 And let's see what we got here Oh, so this is a good trick This is going to end up being iex because it's just taking the character erase from it and it sets alias of that thing to iex so Yeah powers. Let's get back to power shell and just show you that like look It's iex Invoke expression ladies and gentlemen. Let's call it what it is Call a speed a speed or whatever the cool kids say these days So sal that thing can just let it because sal is set alias Command let's set alias trying to be spooky again guys Sorry flailing around uh set alias to iex just set iex to what it is guys don't don't beat around the bush here with me You know what you're up against. I'm just kidding. I don't have any idea what I'm doing. Um This is beautiful Take a look at this system dot app add add add add add add our astras astra Yeah, do a little app domain passing it to iex All right, let's nerf that thing real quick Uh app domain We can remove that little replace syntax here because it's stupid in a waste of time so That's going to give us app domain. We'll call that that I will use the dollar sign here just think oh no no that's going to clobber that variable and that's going to be bad so So this though can be current domain And I know that this is going to end up building us out to have the capability of Reflection and I see literally yet another payload in here. I'm pretty sure in this hex And that's going to be disgusting. So let's see what we got um This has some white space in it for no reason And String of this can equal all that does that ever get replaced with anything? Yeah replaces at signs with zeros Let's do that ladies and gentlemen. I'm just going to Steal that code and like once again slapping in python I I did copy and paste that I swear I did I literally hit control control control shift c control shift v That's how you can help being paced Are you just not letting me do it? I right click paste it. Okay. It's too big 20,000 201,000 characters selected. Oh, I see now. I understand the dilemma That might be actually something difficult for you to do Because there's a lot of data in there. So I would tell sublime text to do it But that might be a horrendous idea Does this only do the exact same thing? It does Uh, so let's try that after we replace All the other things invoke null null with replace at sign at sign with Vo so it's just going to end up running invoke And you can see the iex there so Let's remove that replace And nerf this thing to get to invoke So we do a kernen vain invoke iex This is going to end up being a Let's just say that's going to get a Like module. I don't care whatever it's called Load so it loads it reflectively I might be wrong in that Explanation but we do replace all that And this thing is going to end up being This original string modified and pulled into bytes Basically, I'm assuming just converted out of hex It looks like right I'll zoom out here Because this function is going to Take the parameter split it And remove all of these Periods and parentheses, but those aren't in there whatsoever. Are they not? Let's take this big long thing Let's uh Copy and paste and do another sublime text window and let's try and do that find and replace and literally break everything Let's do it at signs Oh, dear god Sublime text is already chugging along and let's replace them with zeros Control alt enter to find and replace alt And let's see if sublime text crashes Let's monster break he's chugging along Gotta help us That was a real bad idea Why did I do that? I knew I knew like all along and you guys were telling me like john don't do it Don't don't put that evil on sublime text Shit, I never even saved like the original stage four So did I? I never even like made a copy of uh Stage four dot ps1 Because it's original. Oh Oh, did it do it? Oh my gosh All right, here we go Um Let's call it like payload four dot text. Let's call it dot hex Nice work sublime text. We gave you time to recover. We gave you the time of your life And you really came through I really appreciate that man. What else we got here Waves dot that thing Is this doing some like process injection? Is this gonna like So we're obviously gonna end up loading some c sharp binary or dot net assembly thing that we could probably expand and look at Um, but waves is probably going to end up being like the namespace of the class And that weird thing and this function will likely end up doing something But it's taking notepad dot exe and loading More code in which has to be this thing. So I wonder if that That's got to be something new. That's got to be like some process injection. I think I think you know, I think Mmm Let's mess with this Um Function though, but there let me get back to payload four because there literally is no Stuff in this There there there is no parentheses period period in that I don't think there is but That's what we end up doing with this seemingly will end oak and become c sharp Uh, so let's take that And let's write another power shell script. Actually, let me pause the video. Oh god. What's happening? I didn't mean to copy paste it. Please don't do it terminal.  I checked some notifications on my phone All right, we're back at it Let's see what we got left. Where are we at? I remember I'm trying to remember We have payload four dot hex. So let's make a, uh, um, recover payload four dot x Oh, no, I want that to have a python extension because it's going to be a python script Um, so we can copy basically the same thing we did from here except we're going to end up using binaski And we will in fact read it as a binary or bytes. So that way we could get payload four dot hex and then We have the contents. So let's do a print binaski dot unhex lefi of The contents which should be bytes already.  Excellent. Um, so let's save that as stage five Bro, bro, we're going we're going for a wild ride here. And let's just open like a stage five dot exe Write that in bytes as handle Or as H because we already use handle. So let's do it h dot write stage five write Properly spelled right. Ha imagine that English English words python three recover There we go. Now I have a stage Five dot exe that is a dll. You know, we were we were close guys. We were close. Let's call that stage five dot Dot dll Okie dokie, uh, let's let's maybe modify that script to have the same thing Um, so before we dive into that, let me uh, clean these up. So let's convert to hex Um Let's put this function away because we kind of know what it's doing already. This will be um Can I call that stage five like c sharp bytes? Oh god sublime text Come back to me c sharp bytes Um, and then we load that in Loaded library And that will probably end up executing Or imported load library, I guess, uh, I'm not I'm not using the right like terminology and lingo to describe all this But now that we've imported that library that c sharp dll that we can understand and explore with il spy or dn spy Waves is something that is seemingly now brought into our context.  Um, let's run il spy in here and Do I want to close that virtual machine? I'm sketched out that it's still kind of like eating up memory and stuff and this video This video's gotten pretty fun. You know, I think Yeah, let's do it. Let's let's open up that il spy real quick See how we do okay and forgive my forgive my malware present in here Uh, what did I call this notepad? js yeah, yeah, yeah stage 5.dll What do we got assembly title music? Can I zoom in on this please? Can I I want to edit this so you people can actually see it? Seriously, how do I Options yes display Uh font size bigger than that, please All right now You can see it. I hope Let's see what we got here stage 5 dll Using runtime compiler services and interrupt services. So we're probably going to be doing some memory stuff Uh assembly title is music, uh, which I think repeatedly said but that's kind of funny If especially if waves is what's kind of doing. Oh my goodness. Look at this All right references. Is there anything to read in here melons What is this Obviously a system. Oh god, please don't please don't actually pour all that out right now It pulls in some kernel 32 stuff. Can I get anything out of melons? No We've got any resources in here. What is this? Does it draw icons? Is it gonna like actually pretend to look like What is it? What are in these man? Are these pictures are these images? I'm gonna run foremost on this just to be wacky Uh, sorry Spastic terminal as usual. Let me uh, let me do a little foremost on my good good friend stage 5 Let's see if we got anything in there. No, just a dll We could do like a bin walk like a hard bin walk, uh, but I don't know Let's see what we got. Okay. Okay. There's a lot of randomness in this.  I see that I've seen that before my gosh This is all obfuscated Anyway, let's get let's look into waves because honestly that this function is the one that we know It gets executed and ran so Which is the one? But let's totally for the moment ignore all that other noise But i'm sure there's plenty of stuff to dive into in there. We end up running waves dot t4 h jug Which is that And we run our good y7 8 h j Which is that uh 5 5 So It takes a string Which we know is notepad.exe And it decompresses As a gzip The bytes that are passed in So this decompressed G strip gzip. Sorry Is gonna end up doing more stuff That's very messy Little switch cases here Other randomness, um Let's uh Let's try and just take that binary data. Let's try and take that hex data and decompress it as a gzip And then understand what that toto function is going to end up doing because i'm sure it's going to do something spooky It might do some uh process injection because this new payload Is what we are running with that function and we haven't Decoded that yet So let's set sublime text on another wild goose chase To replace all of these at signs With null bytes Here you go everybody I don't know why iLspy keeps giving me tool tips. That's very annoying. Stop it iLspy Okay Go sublime text Now you can leave your comments everybody you can tell me like john just you said john Just use arch just use vim just uh completely rewrite the kernel Yeah, I could but why Waves inject dot hex I suppose is what we will call that and Let's Convert that out of hex they do convert it out of hex. Do they not? They do They do so that's going to end up being a gzip stream as we know now Um Let's should we python it up again or should we do something like cybershaft?   I don't know if you can see it Uh, we get the little notification. Hey this program cannot be ran in DOS mode Got another binary ladies and gentlemen. All right. Let's save this thing download dot dat um What is this is this stage six or something right now? Let's call it a dll Yes, save it Let's move our downloads Download stage Six dll over here and let's see if it is in fact a dll. Nope. It's not we were wrong. God man over two guys Let's call this an exe um Oh And that Is not a dot net assembly So I would not be able to do My good ol il spy or dns spy Cheats I'm gonna have to actually reverse it with giidra or aija or hopper and oh goodness. I don't want to Let's see what you do with strings Now we're starting to get into the stuff that i'm not good at rich buy rich buy That was a weird one. I see rich buy at the very very top here. Is this going to end up being like a crypto miner or something? That would be nice like if we came all this way and it was like nah, I'm just a crypto miner Is there any like indication of monero? Is there any indication of coin hive? All these strings are useless man Where are we going? Oh Now we see stuff Network down message size is just going to end up being like c2 File exists file too large Those are like genuine Messages though argument out of domain Too many files open in system. Those aren't normal. I don't think core exit process Sunday Monday Tuesday Wednesday Thursday Friday Saturday Why does malware always include the dates? I'm sure it's in like some library that gets pulled in but it's always just so funny to me and see that in strings Um, where's the good stuff guys? Oh Is this going to be like a c thing? Is this going to see it be a c plus plus thing? cmd.exe Doing some event viewer Keystrokes is this doing like a keyboard logging? I don't know what's happening right now Key 3.db logins.json the firefox stored logins not oh Is a little info stealer trying to grab browser information cash stuff license code tech improperly spelled license I know like you guys might think i'm dumb For just looking at strings, but seriously you can get a lot of like glistening Remcos started by watchdog. What is that? What is that? What is remcos? Remcos rat Remcos rat. Is that what i'm dealing with right now? Is this it? Do we find it? Remote control and surveillance software Updated yesterday 17th of 2021 february I said those out of order What? What is this? Is this like the latest version because that would be kind of cool in a horrific way You know me like that'd be kind of slick In a horrible nightmarish way I appreciate This malware going outright and telling me What it's called though You know, I really am thankful for you just saying oh remcos. We got restarted Some registry locations remcos fee. Oh my gosh Breaking security net we see you is that like a safe site? Is that like a is that like a good good thing? Or is that just straight up shady? I don't I genuinely don't know I genuinely don't know so We specialize in advanced ethical hacking Guys, this is too cool What? That's remcos there Vioto keelager Poseidon mailer Holy cow Why have I never heard of this before? This is insane They have so much stuff Oh, of course a small free video game. Why not? Is it all open source? Are you for real? Oh, no, no, no, no, okay Let me let me let me keep looking to remcos because we're the remcos professional download remcos free limited functionality Read the instruction manual. I kind of want to do that control your personal computer from a remote location or Not your personal computer Or someone else's personal computer or server Or data center Runs on any windows Encrypts the connections This is unreal guys I'm glad we got here like within the hour Remote control the screen remote chat Control center, this is Maybe I'm hyping this up a little too much, you know Maybe maybe I maybe my inner youtuber is just getting a little too excited about things that aren't all that exciting but Look at this My inner youtuber shut up john John what the what the heck are you talking about shut up? You're not a youtuber There is seemingly nothing else all that interesting in here the copyright though Dinkumware. I'm pretty sure I've seen that around. I think it's just part of a module, isn't that? Dinkumware Yeah, these are the c libraries to be able to do Peculiar stuff And not even that I think I'm pretty sure these have a genuine purpose Dinkumware. Yeah. Oh, no, there's just a premier supplier of actual c in c++ libraries so You know There's that padding padding padding padding padding What is there anything else peculiar and interesting in this? Or have we just kind of found the smoking gun to be like nope, that's remote control That's Remcos Remcos I like oh, that's got to be what the buy is for like hey Go buy the actual program rather than using this crack software that you found on the spooky wookie dark web Remcos is another rat Four units got some stuff on it back in 2017 Here they are using it with a macro dock I like that it's called remi dot exe and the screenshot And they obfuscated a little bit too. Oh, it's packed with impress Or maybe the older version was I didn't see like a upx string. I actually haven't heard of impress before though So I will have to add that to my mental repertoire Obfuscation of the matter practically ended after the two pack At that point we just stopped obfuscating We thought it was good enough According to their website breaking security. This version was just released last month relative to that article Wow What a wild ride guys Now that we've Now that we kind of diagnosed this as Remcos We We went a long way to get here Look at these the usage though Like hey, we got all these machines that you were monitoring the event logs for you You can start. Oh, you could start all the other programs if you want. Oh, no, no other other software I'm sorry. Okay. I thought it would be like just drop the key logger in place More and more applications like Remcos are being released publicly luring new perpetrators with their easy usage. Yeah that's like Some iocs here Oh, we've got some iocs from this video That that funky url we saw earlier What else do we see in here? I uh go away. Thanks trend. Micro's got some good stuff. This is in december of 2019 Germany based security firm breaking secure Germany based firm sick breaking security. I don't know if I could You know Uh coronavirus bam That was in 2019 though Wait, what the heck this email is from April 3rd 2020 and this article is released 2019 Can you see the future trend micro? I know you guys were good, but I didn't know you were that good Startup persistence, of course bypasses av Maintains persistence Injects into a legitimate windows process like notepad.exe as we saw Information theft stealing all potential of those firefox cache and windows cache as it's at the backdoor commands spooky Holy cow. I want to learn more about remcos 3.1 3.1.0. This is the one that came out like yesterday though Optimized improved be faster Fix agent crash Copy ip address Wow Did it say the version did it say when we were running strings in there? Did it say The version remcos remcos Remcos v. Oh, it cuts it out Remcos v something it's got to be filled in by the actual No You know what let's do a little hopper guys. You know what we might as well. We're already this far into it Um, did I actually open hopper or did I just open my virtual machine again hopper, please? Uh, I'm sorry. I'm okay Um, we want to go to notepad j s With our stage 6.exe. I think is where we are We'll go to our entry point here Um, and let's try and understand this sub That thing that thing that thing I want to find the strings Where you ended up saying remcos version rem cos version You can see even more Policy system enable lua. Oh, oh, that's just trying to add in like the rdp stuff I want To see this version number Where do you put me? Remcode version 3.10 pro. Oh my gosh Literally released yesterday That is insane I can't even I don't even want to like edit this video because I want to get this out like right away Show people some of this cool stuff Wow That was a wild ride everybody. I think that's as far as I want to go. Um I I think we've diagnosed that okay. This is a Remote control remote access trojan through layers and layers of payloads and obfuscation I hope you had fun on that safari ride through Javascript or j script through power shell through c sharp through an executable that isn't going to end up being a dotnet assembly And doing some of that detective work to go find this thing out on the internet I think that truth be told and I'll be honest. I didn't I this was not staged beforehand I saw this j script and I'm like this would make a really good video so I just dove in and recording and I literally haven't seen this before and this honestly has been really cool I don't know what else to say or do in this video But I hope that this was a lot of fun And I hope that this even takes it further than what we did in that last malware analysis video I know a lot of people love those or they'll love that video and hopefully we can do a lot more But we did some cool stuff in this and I think that was a blast. I think that was fun If you guys haven't Done all the youtube algorithm things and you enjoyed this video. Please please please Leave a comment, you know, say whatever you'd like. Hopefully something nice. Um Maybe like the video. I'd be super appreciative of that if you could subscribe and I've been doing my homework I've been learning a little bit about kind of the whole youtube subscription thing youtube algorithm thing and uh hitting the bell Actually means that hey, you're gonna get the notifications for real not just be totally absorbed and lost in the abyss of the youtube Machine and that will you'll actually be able to get notified when I when I post new videos So if you like this stuff and you want to keep coming back, I would really really appreciate that And this has been a ton of fun everybody. So thank you. Thank you. Thank you. Thank you for coming to hang out Um, I'll see you in the next video. Hopefully we can do more stuff like this But uh, I love you Take care. I'll see you in the next video. No video outro because I'm just gonna straight up upload this Love you. Goodbye


All right, so unlike Torsten, I wasn't hacking slides until five minutes ago, but the reason for that is not that I was so much more ready with my slides. It was rather that it's a little to talk about that the slide deck was so small. So this is me, so I'm doing Libre Office on Ubuntu, but I'm also working a bit on Libre Office itself, and one of my most insane ideas was BiBisect. Some years ago, who here knows what bisecting is? Torsten talked about that. Okay, who knows what bi-bisecting is? Okay, roughly half of the audience, which is great, so I can waste some time explaining bisecting. So imagine Libre Office 520 is working great for you, and your document is rendering fine and everything is beautiful, and then Libre Office 521 suddenly your text is read, although it shouldn't. So imagine this is Libre Office 50, and this over there, the other end, is Libre Office 50, this is 520, and this is 521. So 128 commits in between, and if you ask the developers who of you guys broke it, what's the answer? Right, everyone is saying not me, and in this case, that's true, because I did break it, and of course I don't know that, but I did so, and this is the commit where I broke it, somewhere here, but I'm not aware of that. So you're sitting here, you're not knowing where the stuff broke, so what can you do? You know it's broken here, it's okay there.  Which color is it? It's broken, right, so I know that the 64 commits broke it. I go here, red or black, is it broken or not? Not, it's working, okay, so I've got 32 commits to my left, and go into the middle, now it's 16 commits to my right, is it working or not? It's not working, okay, it's there. Okay, now actually I can just look at the 16 commits and probably, then it was me, so speaking of breaking things. So this is roughly how bisection works, except that for LibreOffice it's a bit different because usually with each step you have to compile the whole product, which is a pain with the product, the size of LibreOffice, so we created all these binaries and put them into a Git repository so you can do it on the binaries. But that leads to pretty big downloads. So if someone wants to find out if something breaks, he has to download a few gigabytes of a repository just to find that out, so it would be great to make that lighter, and I looked into that but I have to tell you, no idea what I'm talking about, I did mostly application development and I don't know that much about more development closer to the system, but one of the basics is that in Unix everything is a file and there's one path and at that location you will find a specific thing. That was true in Unix for a long time, but actually that is not that true anymore for quite a few reasons. There are some containers and solutions that make actually different trees be available in the same thing, and you can use that, for example, to create a specific view on the file system. So you already saw this thing, like Snappy, for example, and other solutions, it would be great to really be able to switch between these versions without having some intermediate half state and it would also be great to be able to roll back. Now most of this stuff is done by Snappy or also by Flatpak and solutions like that, but we really want to have this solution for having many, many, many different installations and not having to install them all at the same time, which is a bit of a different problem. But if you look at Git, how it is set up, it's actually a content addressable file system and that means that once you have a specific file and you have a different commit that also has this file with the same content, it actually stores not two files but it's just the same stuff. So it does the duplication in a way, which is great for reducing the amount of data you need. And it stores all this stuff in very simple objects which are blocks, which is just the content, trees, which is a directory essentially and commits, which is pointing to a tree which contains the state of the file system. So like I said, in 2011 I did BiberSec and started off with this and OS3 was something similar, I know, but that was the starting point for LibreOffice and I could put 755 images of LibreOffice into just one repository of 12 gig, which was a good starting point because that means 16 Macs for just one installation. But you still had to download the whole thing to really get started with this. Actually, that's not current data, that's half a year old, so just keep over that. So I wondered if we can solve this problem with of course there's an XKCD for it because there's an XKCD for everything and this XKCD essentially says why don't we download stuff on the fly when we need it? And the summary is below, I felt pretty clever until I realized that I reinvented webpages but actually these days there's not much different between a web page and desktop application because this happened by now. So an average web page these days is bigger than whole desktop applications were back in the day. So our networks got this good and this fast and have so much bandwidth that we don't need to think in the same terms that we did back in the days when a desktop application was just one thing. So my idea was actually to have a Git repository somewhere and if you wanna buy bisect on this Git repository or you wanna use content from that, you create a fuse mount, so a dynamically generated mount and whenever you actually wanna look at that file in that moment you download the file actually from the Git repository. So that was my idea and I did that proof of concept with an ugly Python script in 2013 and well, it was slow because it was Python and the Python script used forked shell commands and these forked shell commands then downloaded stuff so that is obviously not quick but I could have a by bisect repository somewhere and start LibreOffice out of this repository remotely essentially so it was downloading on the fly on first start, it was slow but it worked and what I could see for example is that starting of LibreOffice for the first time just to get to the start center, the whole installation in a by bisect repository is roughly 250 mechs but to the start center only 75 mechs of that are actually read. So if you just wanna test one specific case like you do with bisecting, you don't need 250 mechs of data, you just need these 75 mechs. So that is quite a lot already, quite a different difference. So yeah, this was just a proof of concept and I did processes isolation back then just as a hack. I looked up with which process ID was looking for a file and then giving this process the LibreOffice that was there and then you could switch the file system and actually have a different LibreOffice there and start a second one. I thought that was a great idea until I realized that the dynamic linker gets very confused if a file at the same location suddenly has different contents for different processes but this kind of stuff is much better solved by solutions like namespaces, Docker, Snappy, Flatpak, whatever. So that was just experimentation but the basic concept to have this to dynamically download stuff on the fly worked because I could start LibreOffice from it which is probably one of the most complex binaries you can start on something like that. But yeah, it was hackish with Python git commands and it navigated the paths remotely so it whenever you navigate through the directories it always had to check back the remote location and yeah, it was not really something you could use in production or even for bivisection. So this year I tried it a bit better with using an actual proper language for something like that which was Rust and used Libgit and again Fuse and had good tests on that and essentially got the same thing with if you things changed. For example, as I said, Libgit has not only the blocks as objects but also the trees which are the directories so I also download the trees and with that I can locally navigate the file system so the performance is better and other than that it does mostly the same if you open a file it checks if the file is there if the file is not there it goes to the Git repository downloads the Git repository, creates an uncompressed version in the local file system and then just maps every file access to the local file and all of that transparently so you never see any download there. So you're opening the file the first time obviously is low but because you downloaded it in the back but it's not that slow these days anymore if you have a good connection. As I said, I tried the first one to start LibreOffice, I didn't try it on this one yet but the hard part is again the last thing because you have the local file cache and the fuse mount and it works against a local Git repository which of course is not what you want you want the Git repository remote so you need again another fuse mount or something to get this remote so you have this Frankenstein combination of two fuse mount on top of each other but I don't think it will hurt the performance much because most of the accesses will be directly to the first thing but then you can use HTTP or SSH to mount this second thing. There are a few challenges there for example statting the file system is a bit tricky for most of the time it's a read-only file system so I just created fake stat like access bits and stuff like that but for example the size of a file in Git is not stored in the tree node so to find out how big a file is you actually have to download it right now so you need some modification there to actually have local tree-ish objects that also have the file size of the tree node in them so that not statting a file makes you download it on the fly. The second thing is if you wanna have insecure protocols like so you just wanna for example have this on HTTP then it would be great to have a Git tag which creates a signature and then have all the objects in between signed and with hashes of the contents so that once you have checked the signage of the tag you're sure that everything else is not somewhere in the middle or something and then once you have all that you can think about garbage collection like you have two checkouts and you're running one and the other one you're keeping it around at some point you just wanna delete that because no one is using it anymore or quotas or how big your local cache will be and all that fun but that's for later so this is roughly the state where this is in I would have loved to say that I could start or that I did start LibreOffice remotely already on the new implementation but I didn't get around to do that but I hope I can do this soon and then you could actually do a bye-bye sect against the remote repository without having to download 10 or 20 gigs but just like for the first step you download 75 max for the second step you maybe download another 30 max and once the next time you will again have likely these two first steps because I mean the starting point of a bisect is mostly always the same so you can dynamically or on the fly download the repository as you need it and not have to download it in one step so again I have no clue what I'm talking about here mostly so originally I wanted to get others to actually do the work for me that didn't work outside to do it myself now. Luckily this stuff is solved for application deployment with solutions like Ubuntu Snappy but for us the specific requirements are a bit different so I'm still hoping that I can finish this at some point All right, questions, none. Oh yeah.  How do you want to use get shallow for that? Well if you just want to have one specific version if you do get shallow that at least is smaller and I don't know well enough I just look for the manual maybe you get shallow. What you could do is do something like again have the git repository on an SSH FS mount or something like that and then get shallow into that and have the local copy different but the disadvantage of that would be when you do the first checkout you do full checkout so you get the whole that whole all files from that although you only need like a third of those. So yeah, it's another solution one might attempt but yeah, other questions. Not a question, a request, we have enough time could you do a quick demo? No, but actually I can show you the repository link. Thank you. So this stuff also has unlike the first attempt has quite a few tests so you can see what it should do and if it doesn't you see that it doesn't. Kloff? Did you also consider just going the waste disk space route and just the creator version on the server that has the different versions in separate directories and just switch to the directory on your local mount? So you mean like having the complete thing on the server and then yeah, no I haven't considered that but it's another option to go forward but given how the compression of Git is with 60 max per checkout instead of 250 max that's quite a difference that you would lose there. So I have a question. Armin? What about if you marriage Kloff's idea with checking out a one version at the server and mounting that locally? Sorry? You could check out one specific version on the server to attempt directory and mount that locally? Yes, but then you would need one temp. Yeah, you could do that as a service. One temp per user, yeah. Yeah, yeah, but that requires the user to be able to trigger changes and stuff on the server which is admin stuff that I didn't want to get involved. My idea here was to have the admin side like just that file system and be done with it. But I see there are lots of great ideas here so go ahead implement them. This is just a hobby of mine so as you can see from the time frames that are involved. So thank you.


Identification is an important property of a statistical model. Once we go beyond simple techniques like linear regression analysis, identification becomes a concern. What is identification? The term identification is used in two different contexts in the research methods literature. There is the mathematical identification sometimes a bit incorrectly referred to as statistical identification which basically refers to whether it is possible to arrive into unique estimates for the model parameters given our data. So here are two examples of non-identified models. So let's say that y here equals beta 0 plus beta 1 x1 plus beta 2 x1 plus u. We can calculate that the sum of beta 1 and beta 2 must equal the covariance between x and y divided by the variance of x. But we cannot really know which one of those beta 1 or beta 2 is larger or whether one of them perhaps is 0 or one is negative, one is positive. That is impossible to determine using this model. Another example is if we say that y, the variance of y, is a product of two sources of variance theta 1 and theta 2 that we don't observe, we cannot know which one of those theta 1 or theta 2 is actually the sort of variation or isn't both because they are unobserved. In other words, we have the variance of y that is observed. We observe one variance and we try to estimate two variances based on one variance. That just simply cannot be done. So that's the mathematical identification. Another context where the term identification appears in the literature is less common, it's the causal identification and causal identification can be understood to refer whether our research design provides sufficient evidence or valid evidence for a causal claim. So this is something different. This is not a mathematical problem. It is a research design problem. Some operational definitions of causal identification say that there are requirements for causal identification such that for each endogenous variable you have a sufficient number of exogenous variables that are guaranteed to be valid instruments for these endogenous variables. I'm not going to talk about causal identification in this video. I will focus on the concept of mathematical identification because it is fundamental to our estimating models. Causal identification is a fundamental issue to research design which precedes any attempts of analyzing our data. How is identification reported in the literature? So this is one way. Statistical estimation and identification are two different things. That's important to understand. Statistical estimation is about calculating the parameter values or estimating them from sample data. Identification concerns whether it is even possible to arrive into unique estimates regardless of our sample size. So if you have a model that is not identified then collecting more data will not solve the problem. Typically in statistical identification if you collect more and more data then the consistency of the estimator starts to kick in and you get less and less estimation problems. Identification is something that persists. So if we have variance of why that is the only variance that we observe and we try to estimate two sources theta one and theta two no matter how much data we collect we cannot do that. Here is client's take. So client explains that identification refers to whether it's even theoretically possible to calculate the unique value for the parameters in the model and if not then the model is not identified. Identification is related to decrease of freedom and if decrease of freedom is negative that means that we don't have enough information for estimating model. For example if we observe one variance variance of why and we want to estimate two variances variance of theta one and theta two we are trying to estimate two things from one unit of information and decrease of freedom would be minus one we can do that. So every time decrease of freedom the difference between the information that you have and the number of parameters that you want to estimate every time when it's negative then there is no hope of estimate in the model. So this is a good rule of thumb to remember when decrease of freedom is negative the results that you may get from statistical software are completely untrustworthy. Then we have the case of decrease of freedom as zero and this is called just identified assuming that the model is identified. I'll talk about that assumption in a moment. So here we have the equal number of parameters and equal number of things that we observe for example if we have x and we have y then we can estimate one relationship between x and y because we have one covariance but if we try to estimate a a bidirectional relationship that can be done we don't have enough data. So just identified means that our model should fit the data perfectly because there is no excess information. An important case and that applies to most models is over identification. In over identified models we have more information from the data that is required for estimation and over identified models can be tested. For example if we have regression model with decrease of freedom of zero that will always have an r square of exactly one and the model is just identified. We cannot test whether r square is zero in the population or not because we don't have decrease of freedom from doing that. If the decrease of freedom in regression is positive then we can run an F test for testing whether the r square is zero or not in the population. Many applications of covariance structure models or simultaneous equations models or structural equation models rely on this over identification and using this excess information for model testing. Now why is it there is a requirement that if the model is identified? It is possible that we have a model that has for example two parts. We have an effect of x on m and from m to y and it's possible that the first effect is over identified and the second effect is under identified and it's possible that one part of the model if we take that part only and we calculate the decrease of freedom has a negative decrease of freedom another part has positive decrease of freedom and those can add up to zero or a positive number. So just the fact that decrease of freedom is positive does not guarantee identification. If decrease of freedom is negative then that guarantees that we cannot estimate. If the decrease of freedom is positive and we have established that the model is identified then some parts of the model but perhaps not all parts can be tested.