4.Vincent D'Agostino — Direct/Cross

VINCENT D'AGOSTINO: So the file itself comes in a container or a compressed package. So rather than having to download hundreds of separate files, what they do is it is compressed into one file called pack#2.rar. Within that file is all the files that you see below. It is actually -- these are just some of them. This is number 1 through D in alphabetical order. So these files are contained within that file that I downloaded.

And they are organized by category. So you'll see different piece of malware that are labeled by their brand name, like Blackshades. You'll see some of these are organized by what they do, like Booters, Botnet, Brute Forcers, Chat Exploits, Anonymity, Admin Page Tools.

VINCENT D'AGOSTINO: Sure. So we're starting out on what would be the buyer's machine. It is a clean installation of Windows, and I'm running the keylogger program, which is called "Syslogger Builder."

Can you pause it for a second.

And so when you run the program, after you were to purchase the software, you download it, you execute the file, and this is the page that comes up. And this is what I would call a build a malware screen. So this screen allows you to design your piece of malware to whatever you want it to do. It is very, very customizable.

So on the top right, you can see under "Specifications," the default setting is to send the data over SMTP. What this means is that you are going to put in an email address in here on the top right, and that is where all the stolen data from the victim's machine is going to be sent to.

VINCENT D'AGOSTINO: So that is where you would enter in the email address of where -- once this software is installed on victim's machine, that's where it is going to send all of the stolen date to. So I created a fictitious account for demonstrative purposes.

You could hit play.

So that's the Gmail account I created. And what's nice about this interface, it will allow you to test the settings. So you click "test mail," it actually goes through and sends a test email to make sure that you had entered in the password correctly.

So now on the left side here, you can go through and select what you want the program to do. And so there's things like Antis is the first option, Stealers, Delete Cookies, Block anti-virus Sites, Melt, Mutex, Startup.

You can pause it for a second.

And what those allow you to do, like there is also Screen Logger. So you could tell it, for example, you want this software to, once it builds it, to be able to avoid being detected by antivirus software like, you know, Kaspersky or Norton antivirus or BitDefender. So you check that box, which makes the program build in such a way that when it gets sent to the victim's machine, their antivirus will never catch it.

You also have stealers so that will look for anytime a password is entered into a browser to log into Gmail or Yahoo!, that will specifically pull that information out for you.

Block antivirus sites, that will prevent the victim from going to an online antivirus site to clean their machine. So if they begin to suspect something's up, they can go antivirus.com. They run a scan. Only this will actually block certain sites like that from ever appearing.

And then screen loggers. Screen loggers, the program will take an actual screen capture of what your computer's doing at whatever interval you set. So that screen capture will look very much like what you are looking at on that monitor right now.

And, finally, where it says "enable error," here you can customize it so that once it's installed successfully, you can make a message pop up on the victim's machine and say anything you want. The default setting is so that it posts a message saying that the program never installed correctly, thereby giving the victim a false sense of comfort that, oh, whatever this was never actually installed. So for the purposes of this demonstration, I just added in a generic message, I believe.

You can hit play.

So the default error message says the application failed to initialize properly. And I added "please double click and try again," which would cause the person to rerun the malware again to make sure it installed properly. So that's what the message allows you to see, what it would look like. So I clicked "Test Error" and that's what pops up.

Then on the bottom right here, I am setting the interval. I set it extremely low as to alert me every minute. So every minute it is going to send me data that it's stealing. Ideally, you probably wouldn't want it that often but for the purposes of the demonstration.

So then -- pause it for a second.

So once you select the options you want, then you click on build, which is "Build Server," which is that button right there. And then it makes an executable file, a file that's runnable that now does the things that you just set it to do. So I quickly saved the file. I think I called it "badfile" initially. And now the next step is to put it in a package so that I could deliver it to a victim's machine, which you'll see in the next video.

You could hit play, please.

So there's the "bad file" that I created. That's the actual malware.

VINCENT D'AGOSTINO: Exactly. It will only do the things that I told it to do and nothing more, nothing less based on those features that I selected.

So since nobody would open bad file.exe, I named it cute dogs, because everybody would open cute dogs.exe -- at least I would. What I'm doing now is putting the file in a container much like when I originally downloaded the malware so that it will slip pass Gmail virus scans. There is a lot of different ways to do this. This is the most simple way for purposes of the demonstration. And what this does is this hides what it actually is within a container. So when it's emailed out, most of the time your email will catch simple viruses and malware. By doing it this way it will pass right through.

So now I'm sending the attachment to another created email address up here.

VINCENT D'AGOSTINO: Yes. You attach the file, and it should get through the scan because it's in a compressed format and now it's sent. So there's the sent email confirming it went out.

So now this is the victim's machine. This is another clean installation of Windows 7, 64-bit. The victim then would log on to their Yahoo!

VINCENT D'AGOSTINO: This is a completely different computer.

So there's the email that was sent by the user of the malware with the irresistible attachment, which will be opened now.

So I'm saving the file to the desk-top, and I am going to open that container.

I am putting in the password that was sent with the file. In a normal circumstance, you wouldn't have password protection on it but.

So now the file is being dragged to the desk-top and the user, the victim, will run the file, or execute the file. So it is just a double click.

And so you'll see the little busy -- you know, the computer's working. But other than that, there is no indication of what's going on.

Then it just sort of, the busy signal, the icon went away, and the user -- the victim is left wondering, you know, what the deal is.

So now the error message pops up, and that lets you know that the malware was actually install successfully. So that is the error message I created in an earlier step, which prompts the user to double click the file, which -- if you want to pause it for a second. One of the neat features about this type of keylogger is it has a melt function. So once it is installed, if you guys noticed, the file actually disappeared; it has been deleted. And that's to remove traces of itself on that machine. So in order for me to rerun it, I actually have to open the container again, extract it again, and rerun it, which I think is what I do here.

You can hit play, please.

VINCENT D'AGOSTINO: Yes.

So now the user's machine is infected. So from this point forward everything they're doing is being logged. So for the purposes of the video, I attempt to visit several different sites, entering in data, login data, to see if it's actually working. So, again, I'm attempting to log into the victim's Yahoo! account. You'll notice the password was entered in incorrectly the first time and you'll see that in a minute. Spoiler alert. So I'm into the email account.

So now I'm just going to other sites. I think eHarmony was the first site I went to. The second site I went to is Gmail.com, and then I went to Facebook.

Now I'm just doing a Bing search.

VINCENT D'AGOSTINO: It's a search engine, believe it or not, just like Google. So just generic photos.

So now what I'm going to do is I'm going to switch back over to the malware virus machine. So if things worked well, and I think they did, you're going to see those emails populating the in box with all the data that I preselected to be stolen. So there it is. So you could see initially -- if you want to pause it here -- this is from the moment it was infected, it starts telling you everything that was done. And so since I ran the program -- when you initially run the program, the first thing that comes up is the D'Agostino fake error message. It shows you that there was a Yahoo! message that was being viewed. It tells you what's in the person's -- under their start menu, what programs are installed on their program manager, so WinRAR. And they're right here. The first time I executed -- the second time I opened that file, I had to enter into a password of 1234 and it actually captured that. And it shows you some of the other functions that we are running.

You can hit play now.

So you can see on the right side that these messages were coming in about every minute. This is the first screen grabber, screen capture.

So once it was infected, the first thing it did was it took a screen capture of the desk-top as it appeared. So any icons you would have on your desk-top, now the person who infected your machine would know what folders, what files were there.

You can see here it also is showing you I went to Internet Explorer, I was on the MSN site. No logs yet for that. You could see here I went to Yahoo! login. It logged that. I visited that site.

This would grab what's in your clipboard when you do a copy and paste. I had nothing in there so there is nothing to report.

Here is the second or third screen grab, which is when I went to the Yahoo! site.

And so here -- if you want to pause it for a second -- when I went to -- I jumped from Yahoo!, which is the first entry, then I went to eHarmony, and then I entered in my credentials for eHarmony so it was victimuser2626. I hit the tab button, which actually logs the keystroke with the tab button, and then I wrote "this is my" messed up the spelling and I actually hit backspace, which records that, and "password." So I was attempting to write in "this is my password," and it captured not only "this is my password" but me backspacing when I hit the wrong button.

VINCENT D'AGOSTINO: Yes.

Hit play, please.

So here's another screen capture of the Yahoo! page after I logged in successfully.

So here's when I went to the Gmail site and typed in my username and password, which also captured right over here.

What is effective about keyloggers like this is that if the person were to change their password on their machine, no matter how many times they did it, the purchaser of the software would always know the new password because they would receive these updates continuously.

Here's the screen grab from the family photos Bing search that I did, which captured everything that was on the screen at the time.

I think that's it.