this malware hides in a WALLPAPER
Source: YouTube · John Hammond · published Jul 2, 2025 · 31:26
This video analyzes a malware sample distributed through Discord CDN that ultimately delivers an AsyncRAT payload 0:00-0:47.
Key Takeaways:
• The malware was disguised in a password-protected zip file with a JavaScript file containing obfuscated code 1:11-4:47
• The JavaScript acts as a stager, downloading additional payloads from a pastebin URL 8:19-10:16
• A PowerShell script extracts malware from a JPEG image on archive.org using steganography techniques 13:35-20:07
• The final payload is AsyncRAT, a remote access trojan connecting to offkd24.work.ggd on port 4 27:33-29:53
The malware analysis showcases a multi-stage infection chain with clever steganography hiding malicious code in pixel data of a seemingly benign wallpaper image 22:17-22:25.
Sources:
- 0:00-0:47 Introduction to the malware from Discord CDN
- 1:11-4:47 Analysis of the initial JavaScript file with obfuscated code
- 8:19-10:16 Deobfuscation reveals pastebin URL with second payload
- 13:35-20:07 PowerShell script extracting malware from JPEG
- 22:17-22:25 Steganography technique hiding payload in pixel data
- 27:33-29:53 Identification of AsyncRAT final payload
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I received this email titled malwarejs and exe from romsf fun.com redirect via discord CDN. It says, "Hello, I was recently downloading ROMs for games I already own on the Xbox 360 for use on a modded console. During the process, I encountered a driveby download served via the Discord CDN or cloud delivery network. The file attempted to download was reading very literally here, less one an Mia Khalif, and all that." zip. They provided the original Discord CDN download link as well as a saved copy on MediaFire with a password protected archive. The Discord CDN no longer serves the payload, but we can still work with it from the MediaFire link they provided. In this video, we'll take a look how this malware sample is made and what it does. So, I am inside of my Windows 11 virtual machine and…