so im trying to set this up https://github.com/Data3rr/Steal-Eyes
for protecting myself against rats and loggers.
i keep getting "[Errno 2] No such file or directory"
#🔒 how to set up this rat detector
ancient kite
steel helmBOT
so im trying to set this up https://github.com/Data3rr/Steal-Eyes
for protecting...
@ancient kite
Python help channel opened
mild meadow
Just don't run sketchy files? 
This is slow, it's silly, and it's not well written.
It isn't particularly surprising that this isn't working.
@plain maple
ember mulch
edgy current
yeah, this is no protection, just ignore it and dont open or run files
plain maple
<:dead:1095150075971383407>
God bless America!
mild meadow
Did you run something silly?
ancient kite
last year yes
ember mulch
you don't have to be scared it's just particularly bad code lol
fck didn't mean to resend that
ancient kite
this
i got ratted
by that
last year
now this year
im running it on dummy laptop
mild meadow
Ok, and you're worried that the malware is still present?
mild meadow
Oh wait, you're trying to run the RAT?
mild meadow
Why?
ancient kite
Why?
i want to see how to detect it
that empyrean exe is a python file that can be renamed to like "discord updater" and people would download it
then get ratted
i want to detect it
before the logging happens
i want to scan the file with steal eyes
and then expose the ratter
mild meadow
You should leave that to the people who do this professionally instead.
mild meadow
It's just bad code, the repository you linked is not how this is done.
ancient kite
what does the bad code do
mild meadow
Bad as in... not malware but poorly written.
plain maple
last year yes
Last year?
ancient kite
so what does it do at the end of the day
plain maple
🗿
ember mulch
so what does it do at the end of the day
some very naive checks
ancient kite
i wiped my os
ancient kite
some very naive checks
like what
mild meadow
so what does it do at the end of the day
Probably not a whole lot. It does some basic string searching on files. It's not a replacement for AV.
plain maple
https://github.com/addi00000/empyrean
Ah. A timeless classic.
mild meadow
Dude-- holy shit relax lol.
ancient kite
Probably not a whole lot. It does some basic string searching on files. It's not...
does it auth to a server or something like does it log my info
mild meadow
As everyone in this thread has told you, without us spelling it out in painful detail, this application will not prevent the execution of stealers on your host.
ancient kite
As everyone in this thread has told you, without us spelling it out in painful d...
ok so it doesnt check anything
its a dud
???
plain maple
PUC - Practically useless code
mild meadow
It... does some things. But not anything that's going to be useful for you.
plain maple
I just made that acronym up fwiw
mild meadow
There's a plethora of things on the internet that claim they prevent <x> but only really work once and awhile.
Instead of focusing on... whatever it is you're doing, just focus on not running sketchy crap off the internet.
(Like stealer-detectors written by malware authors.)
ancient kite
It... does some things. But not anything that's going to be useful for you.
wat r some things
mild meadow
Perhaps you should learn Python instead of using us as a service to explain code to you.
plain maple
(Like stealer-detectors written by malware authors.)
I love when skids play both sides
ancient kite
Perhaps you should learn Python instead of using us as a service to explain code...
im not trying to use u as a service, u just said it does some things and i would like to know what those things are
i would think its a normal day in the park convo
not a service
mild meadow
It looks for malicious 'strings' in files. It creates a 'risk score' based on the links in that file.
It also reads the index.js file, and tries to detect webhooks written to the index.js for Discord.
It then looks in the user's startup folder for files with webhooks in them.
ancient kite
It looks for malicious 'strings' in files. It creates a 'risk score' based on th...
thank you
for this
so if i put that against empyrean logger would it detect it
mild meadow
mild meadow
You need to learn more about what you're doing before you continue doing what you're doing.
(And to be clear, I cannot teach you.)
mild meadow
You might be the single sketchiest person I've met in Python Discord thus far.
Why are you trying to detect these? I don't understand.
Why are you playing with RAT's?
Just don't run them.
It's that easy.
ancient kite
Why are you trying to detect these? I don't understand.
as mentioned i want to expose the ratters
mild meadow
Okay well you're not going to do it with a Webhook.
ancient kite
they send me sketchy file then i check it before running
mild meadow
There's tools that do this that don't... suck.
plain maple
A good tool is typically common sense, it'll help prevent a lot of headaches.
ancient kite
A good tool is typically common sense, it'll help prevent a lot of headaches.
i know its common sense to not download shit
but like
i want to expose these ratters
mild meadow
So go learn Cybersecurity concepts and malware analysis first.
This is not the way to start.
plain maple
How did you get infected in the first place? 👀
mild meadow
ancient kite
How did you get infected in the first place? 👀
i got sent a file called discord updater
i was dumb
plain maple
i got sent a file called discord updater
And you just ran it?
mild meadow
based and malware-pilled.
plain maple
Honestly, real
plain maple
i was dumb
😔
ancient kite
https://sudorem.dev/posts/malware-analysis/
https://github.com/mandiant/flare-vm do i run this in virtualbox
mild meadow
https://github.com/mandiant/flare-vm do i run this in virtualbox
Yes, that's the idea behind FLARE. But it isn't something you just run and... win with.
It is a VM built with tools to support dynamic and static analysis of malware.
lethal sorrel
if you're interested in being able to tell what a program does, you might want to try learn about malware analysis
plain maple
It is a VM built with tools to support dynamic and static analysis of malware.
Thus meaning you will have to first learn about malware analysis fundamentals before you go head first into analyzing anything
lethal sorrel
it looks like you're trying to find pre-built tools that will give you a yes or no whether a file is a rat
yeah
mild meadow
Correct.
There are some tools that get close.
VirusTotal etc.
But they ultimately rely on dynamic analysis-- and are evaded commonly.
ancient kite
bro i have used virustotal and that shit confuses me i dont know how to read it nor what to look for
mild meadow
That's why I keep telling you to study it if you want to learn more about it 🥴
mild meadow
You're fine-- to be clear that's my blog. I work in this field; I've been doing this for a hot minute now, and I'm still learning every day. You're not going to succeed if you come in running prebuilt tools, and more importantly, it's dangerous to you as the end user.
If you want somewhere to start, look into regex and YARA.
ancient kite
alright
lethal sorrel
if you're interested in reverse engineering malware, there are a bunch of challenge sites online that have files you can practice with
but you'll need to learn how to use tools
ancient kite
i see
plain maple
You may also want to be familiar with several programming/scripting languages so you're able to read and understand what the malware is doing.
ancient kite
You may also want to be familiar with several programming/scripting languages so...
well lets say i want to stop empyrean, what languages should i learn
plain maple
well lets say i want to stop empyrean, what languages should i learn
Probably Python?
ancient kite
ok
stable abyss
what you need is a deratification machine alla
steel helmBOT
Python help channel closed