Категории

Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY

Опубликовано: 11 Апрель 2026
на канале: Jai Minton - CyberRaiju
3,172
126

Malware analysis of a fake winrm vbs script which acts as a downloader to invoke a PowerShell script designed to retrieve a malware from within a picture on a public image hosting website.

Note: Apologies for the slightly worse audio quality on this one, I've setup a noise gate now for future videos to avoid the artifacts found in this video.

** Find me at **
Twitter/X -   / cyberraiju  
Blog - https://www.jaiminton.com/
Mastodon - https://infosec.exchange/@CyberRaiju

** Tools **
Notepad++ - https://notepad-plus-plus.org/
CyberChef - https://gchq.github.io/CyberChef/
pestudio - https://www.winitor.com/download
DNSpyEx - https://github.com/dnSpyEx/dnSpy

** Sample **
https://bazaar.abuse.ch/sample/1a93c7...
https://www.virustotal.com/gui/file/1...
https://urlscan.io/responses/f7a87524...
https://urlscan.io/responses/f5718d6a...

** Timestamps **
00:00 - Intro
01:30 - Comparing winrm.vbs scripts
02:36 - Locating the malicious script entries
03:27 - Extracting downloader URL
04:34 - Behavioral analysis of downloader
05:15 - Analysis of malicious PowerShell script
06:39 - Examining 2nd stage stego loader
07:00 - Image hiding malware
08:20 - Extracting PE file from Base64
09:30 - Examining 3rd stage .NET binary using pestudio
10:15 - Examining using dnspy
11:35 - Determining surrogate host for injection
12:45 - Examining 4th and final stage malware
14:02 - Analysis of encrypted configuration
15:45 - Easy decryption of configuration
18:23 - Outro

Credits:
SFX by Pixabay

play_arrow
115
1

A RAINBOW GAME(ODD RAINBOW )

A RAINBOW GAME(ODD RAINBOW )
play_arrow
127
2

Предсказания Ванги

Предсказания Ванги
play_arrow
230,046
11 тыс

Shoulder Boulders ♡ Animation Meme

Shoulder Boulders ♡ Animation Meme
play_arrow
697
7

Простой способ очистить подвал от вредителей и болезней - дымовая шашка Бомбер

Простой способ очистить подвал от вредителей и болезней - дымовая шашка Бомбер
play_arrow
4,307
574

КРАШ💗💗

КРАШ💗💗

play_arrow
17,560
508

B♡mbshell Bl♡nde ♡ Valentines Special ♡ AMV

B♡mbshell Bl♡nde ♡ Valentines Special ♡ AMV
play_arrow
594
38

Конец BMW

Конец BMW
play_arrow
974,550
15 тыс

Scarlett Johansson Vs Interviewer

Scarlett Johansson Vs Interviewer

Похожие видео
play_arrow
MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites

MALWARE on a BLOCKCHAIN! | Malware Analysis of ClearFake hosed on hacked WordPress sites
play_arrow
MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring

MALWARE on GitHub | `Cracked Software` Reverse Engineering via Debugging, FLOSS, and API monitoring
play_arrow
MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation

MALWARE on WordPress site | LNK file MALWARE ANALYSIS and HTA Deobfuscation
play_arrow
Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python

Homebrew MacOS MALWARE! | Decrypting Cuckoo Stealer using Python
play_arrow
Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader

Backdoored WASABI WALLET | Reverse Engineering a malicious MSI and Java Archive Malware Downloader
play_arrow
Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics

Malware Analysis | AsyncRAT Injector | AES Decryption with CyberChef, and ISO File Forensics
play_arrow
MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA

MALWARE ANALYSIS | Reversing IDAT (Hijack) Loader / Injector using x32dbg, Ghidra, and IDA
play_arrow
This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)

This ANTIVIRUS runs MALWARE | Malware Analysis Lab (IDAT Loader Part 1)
play_arrow
Stealthy MSIX MALWARE | Malware Analysis (FakeBat)

Stealthy MSIX MALWARE | Malware Analysis (FakeBat)
play_arrow
UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS

UNDETECTED Discord MALWARE | Reverse Engineering Duvet Stealer, Electron Malware Used By HACKERS
play_arrow
Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY

Malware in a PICTURE! | Reverse Engineering an XWorm Loader that uses STEGANOGRAPHY
play_arrow
Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants

Create YARA rules with GHIDRA | MALWARE Analysis of Havoc Demon implants
play_arrow
.NET Malware Analysis | Reversing the Dark Tortilla Crypter

.NET Malware Analysis | Reversing the Dark Tortilla Crypter
play_arrow
SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis

SVCHOST MALWARE recruits you into a botnet | BlackNET RAT deep dive malware analysis
play_arrow
Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games

Single Player Game Hacking 101 | Becoming a BILLIONAIRE by manipulating FFVII memory and save games
play_arrow
Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE

Static and Dynamic MALWARE ANALYSIS | Agent Tesla from an AutoIT EXE
play_arrow
Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool

Bypassing a DUMB, Endpoint Detection and Response (EDR) Tool
play_arrow
SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams

SECRETS of Scheduled Tasks | How TARRASK MALWARE hides Scheduled Tasks from security teams
play_arrow
PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis

PowerShell MALWARE that STEALS my clipboard | Webhook Clipper Malware Analysis
play_arrow
FIX corrupted archives with 010 Templates

FIX corrupted archives with 010 Templates
play_arrow
Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE

Android Malware steals PRIVATE browsing history! | Reverse Engineering ANDROID MALWARE
play_arrow
Malware Analysis of .NET Information Stealers | Snake Keylogger

Malware Analysis of .NET Information Stealers | Snake Keylogger
play_arrow
This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis

This is the most popular HACKING TOOL! | Cobalt Strike Stager Malware Analysis
play_arrow
Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS

Fortnite hackers, GET HACKED? Redline Stealer MALWARE ANALYSIS