New Cloudflare-Google Captcha Virus.ass

{\blur10\fad(200,200)\pos(1972,2107)}翻译/压制/字幕制作：HAF半个水果

{\blur10\fad(200,200)\pos(1961.334,1816)}使用AI工具翻译，如有不准确的地方请在弹幕或评论区指正，谢谢！\N
！！真的有人看不到这行字！！

{\blur10\fad(200,200)\pos(1933.334,224)}翻译质量权威评价：原来25年就有小拉即用机翻糊弄人了

{\blur10}大家好

{\blur10}Alright

{\blur10}在这个视频中 我想向大家展示我偶然发现的一种新型恶意软件

{\blur10}In this video I want to show you the new type of malware that I've stumbled upon.

{\blur10}其实它并不算特别新

{\blur10}It's actually not super new

{\blur10}已经存在好几个月了

{\blur10}it's been out there for months

{\blur10}但它仍然在互联网上四处传播 之所以引起我的注意 是因为它看起来相当逼真

{\blur10}but it's still scattered around the internet and it

{\blur10}caught my eye because it seems kind of plausible

{\blur10}如果你没有使用DNS广告拦截器或任何广告拦截扩展

{\blur10}And if you aren't using a DNS adblocker or really any adblock extension

{\blur10}你应该使用uBlock

{\blur10}you should be using uBlock

{\blur10}显然 Chrome通过Manifest版本3禁用了它

{\blur10}obviously

{\blur10}不过你还在坚持使用广告拦截器

{\blur10}And you should still be using an adblocker

{\blur10}对吧？

{\blur10}right?

{\blur10}如果你不使用广告拦截器

{\blur10}Well

{\blur10}你可能会遇到这种情况

{\blur10}you might encounter this.

{\fs109\blur10}如你所见 我现在正在运行一个恶意软件 后台正在下载一个二次元塔防（Tower Defense）游戏

{\blur10}So

{\blur10}and there are anime TDs downloading in the background.

{\blur10}我是从某个该死的广告中得到的 我其实不确定它是不是恶意软件

{\blur10}I got this from some freaking ad and I'm not actually sure whether it's a malware or not.

{\blur10}我能下载吗？

{\blur10}I can download?

{\blur10\pos(3084,1872)}*游戏名：胜利女神：新的希望*

{\blur10}看看这个

{\blur10}Oh my god

{\blur10}我能下这个二次元游戏？

{\blur10}I can get anime TDs on my computer?

{\blur10}9MB

{\blur10}9 megabytes.

{\blur10}我能相信这个吗？

{\blur10}Do I trust this?

{\blur10}但我们迟早会在下载时发现

{\blur10}But we're gonna find sooner or later when it downloads.

{\blur10}管它怎样呢

{\blur10}So yeah

{\blur10}反垃圾邮件

{\blur10}Anti-spam.

{\blur10}正在检查与网站连接的安全性

{\blur10}Checking the security of connection to the site.

{\blur10}网站需要检查你连接的安全性

{\blur10}The site needs to check the security of your connection.

{\blur10}但与此同时

{\blur10}But at the same time

{\fs109\blur10}你无法真正知道 因为现在大多数网站都在使用Cloudflare 而Cloudflare通常在网站加载时

{\blur10}you can't really know because most websites right now are using Cloudflare

{\blur10}and Cloudflare usually enforces a bug check

{\blur10}一开始就强制执行错误检查

{\blur10}at the very start when the site is being loaded.

{\blur10}这显然是在试图模仿那种状态

{\blur10}And this is clearly trying to mock that state.

{\blur10}首先 我不认为谷歌会这样做

{\blur10}Well

{\blur10}唯一会进行这种错误检查的服务商是Cloudflare 这算是在模仿它

{\blur10}The only provider that does this kind of a bug check is Cloudflare

{\blur10}and it's kind of mocking that.

{\blur10}你得点击复选框才能完成验证

{\blur10}And the idea is you have to click on the checkbox to fill it in.

{\blur10}那我们点击会发生什么？

{\blur10}So what happens when we click?

{\blur10}砰！

{\blur10}BAM!

{\blur10}你就会被重定向到恶意网站

{\blur10}You get redirected to the malicious website.

{\blur10}精彩

{\blur10}Amazing.

{\blur10}让我们看看这个网站的开发者控制台

{\blur10}So let's check out the developer console for this website.

{\blur10}就会发现它其实是假的

{\blur10}And see that it's actually bogus.

{\blur10}不是真正的验证系统

{\blur10}It's not a real recapture.

{\blur10}实际上 每次你点击页面主体时

{\blur10}And in fact

{\blur10}无论点击页面任何位置

{\blur10}anywhere on the body

{\blur10}你都会被传送到这个“宝地”

{\blur10}you get resurrected to this gem here.

{\blur10}Limner's Little Shop.

{\blur10}实际上

{\blur10}And as a matter of fact

{\blur10}我们可以复制这段代码 尝试在重定向之外运行

{\blur10}we can copy that and try running it outside the redirect.

{\blur10}看吧

{\blur10}And here we go.

{\blur10}会话已过期

{\blur10}Session expired.

{\blur10}但当我们点击这里

{\blur10}But when we click here

{\blur10}哦对 还是会显示会话过期

{\blur10}oh

{\blur10}没错 它显然被硬编码成会把你重定向到那个恶意小网站

{\blur10}Yeah

{\blur10}我可以用自己的网站复现这个效果

{\blur10}I can make this happen with my site.

{\blur10}它能把我重定向到个人网站

{\blur10}It can redirect me to my personal website.

{\blur10}哦耶

{\blur10}Oh

{\blur10}我可真是个黑客

{\blur10}I'm such a hacker.

{\blur10}其实还有另一种伪造网站版本 它伪装成Cloudflare

{\blur10}Anyway

{\blur10}and it's impersonating Cloudflare.

{\blur10}记得Discord上有粉丝发过截图 是个虚假的Cloudflare机器人验证

{\blur10}I remember a fan on Discord sent me a screenshot

{\blur10}of a fake Cloudflare bot check and it was suggesting you download a

{\blur10}页面要求你下载文件才能通过验证

{\blur10}file in order to pass the bot check.

{\blur10}那可比眼前这个有意思多了

{\blur10}And that is definitely heaps more interesting than this guy right here.

{\blur10}找到那个才是我最终目标

{\blur10}And that's my ultimate goal to find that.

{\blur10}这类恶意软件最特别之处在于存活期极短

{\blur10}What's really exceptional about this type of malware is how short-lived it is.

{\blur10}就像我刚录完这个网站 转眼间就再也打不开了

{\blur10}As in

{\blur10}and I can no longer get into it.

{\blur10}我再也无法重现那个虚假的验证码了

{\blur10}I can no longer generate that fake reCAPTCHA again.

{\blur10}即便我再次运行那个网站

{\blur10}And say

{\blur10}直接显示“会话已过期”

{\blur10}it just says session expired.

{\blur10}它再也不让我进去了

{\blur10}It doesn't allow me in anymore.

{\blur10}所以 我这次纯粹是运气爆棚 而且没给任何可乘之机

{\blur10}So

{\blur10}我立刻就开始录屏

{\blur10}I started recording right off the bat and

{\blur10}不过这一切都值得 因为接下来两三个小时 我都要寻找这样的“宝藏”网站

{\blur10}well

{\blur10}I'll be searching for like the next two or three hours for another gem like that.

{\blur10}那就待会儿见

{\blur10}So I'll see you then.

{\blur10}跳过广告？

{\blur10}Skip ad?

{\blur10\pos(3396,1876)}*网易瞩目*

{\blur10}发生什么事了？

{\blur10}What is going on?

{\blur10}又是一个游戏

{\blur10}It's another game.

{\blur10}我给我的电脑申请了一个恶意软件

{\blur10}I have requested a malware for my computer.

{\blur10}不过不是这种恶意软件

{\blur10}Well

{\blur10}界面上叠着一堆弹窗...

{\blur10}There are a bunch of overlays that are...

{\blur10}(⊙o⊙) 又来一个

{\blur10}Oh

{\blur10}好的

{\blur10}All right.

{\blur10}所以现在又冒出来一个

{\blur10}So we've got another one just now.

{\blur10}而且这看起来也不太可信

{\blur10}And it's not really that plausible

{\blur10}但我觉得 我们方向是对的

{\blur10}but I mean

{\blur10}你知道的

{\blur10}you know.

{\blur10}请验证您是人类

{\blur10}Please verify that you are a human.

{\blur10}请按照以下步骤完成验证

{\blur10}Follow the steps for verification.

{\blur10}点击此处进行验证

{\blur10}Click here to verify.

{\blur10}好的

{\blur10}Okay.

{\blur10}所以我们又遇到一个更有趣的

{\blur10}So we've got an even more interesting one.

{\blur10}所以按下Windows键加R键

{\blur10}So press the Windows button plus R

{\blur10}按下Ctrl+V组合键 然后按回车键

{\blur10}press control V and press enter.

{\fs105\blur10}所以这里的陷阱在于 他们把一个恶意链接复制到了我的剪贴板 现在又诱导我通过运行窗口执行它

{\blur10}So the idea here is they copied a malicious link into my clipboard

{\blur10}and now they're asking to run it through my run box.

{\blur10}这肯定是个PowerShell脚本 要么就是MSHTA恶意程序

{\blur10}It's gonna be a PowerShell script or MSHTA.

{\blur10}有意思

{\blur10}That's interesting.

{\blur10}为什么是MSHTA呢？

{\blur10}So why is it MSHTA?

{\fs89\blur10\pos(2380,1892)}*MSHTA，全称Microsoft HTML Application Host，是微软Windows系统中的一个可执行程序，\N
用于执行HTML应用程序（HTA）文件。\N
可以被用于绕过某些应用程序控制解决方案，因为它在IE的安全上下文之外运行*

{\blur10}算了 直接运行吧

{\blur10}Oh

{\blur10}其实无所谓了

{\blur10}It doesn't really matter.

{\blur10}它肯定会下载些恶意软件

{\blur10}It's gonna download some malware.

{\blur10}肯定会干点什么

{\blur10}It's gonna do something.

{\blur10}肯定没好事

{\blur10}It's gonna do something bad.

{\blur10}CPU占用51%

{\blur10}51% CPU.

{\blur10}看来运行得很欢实啊

{\blur10}It must be doing great.

{\blur10}看 它启动了CMD

{\blur10}Oh

{\blur10}它启动了命令提示符

{\blur10}It started the command prompt.

{\blur10}来看看详情 选择列

{\blur10}Let's check out the details and select columns.

{\blur10}检查下命令行

{\blur10}Check out the command line

{\blur10}看能不能找到

{\blur10}if I can find it.

{\blur10}好了

{\blur10}All right.

{\blur10}在哪儿呢

{\blur10}Where is it?

{\blur10}命令行

{\blur10}Command line.

{\blur10}对

{\blur10}Yes.

{\blur10}我想...快点

{\blur10}And I want to... come on

{\blur10}给我...

{\blur10}give me...

{\blur10}CMD C 对吧？

{\blur10}CMDC

{\blur10}文件是什么？

{\blur10}What's the file?

{\blur10}文件是什么？

{\blur10}What's the file?

{\blur10}找到了

{\blur10}There it is.

{\blur10}找到了

{\blur10}There it is.

{\blur10}我得快速进入临时文件夹查看这个批处理脚本

{\blur10}So I need to quickly enter the temporary folder and check out this batch script.

{\blur10}可能被混淆了

{\blur10}It's probably obfuscated

{\blur10}不过无所谓

{\blur10}but it doesn't really matter.

{\blur10}确实混淆了

{\blur10}Oh

{\blur10}不错

{\blur10}Cool.

{\blur10}就这些了

{\blur10}That's all we get.

{\blur10}完全看不懂

{\blur10}It's unreadable.

{\blur10}但它正在运行

{\blur10}But it's running.

{\blur10}正在我电脑上运行恶意程序

{\blur10}It's running some bad stuff on my computer.

{\blur10}具体是什么我不清楚

{\blur10}I do not know exactly what it is

{\blur10}但肯定非常危险

{\blur10}but it's something really bad.

{\blur10}不是挖矿程序

{\blur10}It's not a miner.

{\blur10}绝不可能是挖矿程序（ner~~~~）

{\blur10}There's no way it's a miner.

{\blur10}PowerShell

{\blur10}PowerShell.

{\blur10}这里调用PowerShell要干什么？

{\blur10}What is PowerShell here for?

{\blur10}哦 哦 它还在从GitHub下载东西

{\blur10}Oh

{\blur10}等等

{\blur10}Okay

{\blur10}属性？

{\blur10}Properties?

{\blur10}不对

{\blur10}No

{\blur10}怎么复制这该死的命令行

{\blur10}How do I copy the freaking command line?

{\blur10}有了有了

{\blur10}Yes

{\blur10}我就是要找这个

{\blur10}That's what I've been looking for.

{\blur10}现在终止进程 我们自己下载

{\blur10}Let's kill this now and download this ourselves.

{\blur10}我本来就想这么做

{\blur10}That's what I was trying to do.

{\blur10}好 我先结束MSHTA进程 然后...打开记事本

{\blur10}Okay

{\blur10}找到这里的命令行

{\blur10}Find the command line here.

{\blur10}有意思

{\blur10}Interesting.

{\blur10}这是自动生成的吗？

{\blur10}Is this auto-generated?

{\blur10}等等 什么？

{\blur10}Wait

{\blur10}哦 等等

{\blur10}Oh

{\blur10}会不会是这个导致下载失败？

{\blur10}Could this be the reason why it's not downloading?

{\blur10}不 这是个私有仓库

{\blur10}No

{\blur10}你看不到内容

{\blur10}You can't see what it is

{\blur10}但确实托管在GitHub上

{\blur10}but it's hosted on GitHub.

{\blur10}选择GitHub托管的原因

{\blur10}And the reason it's hosted on GitHub is

{\blur10}我猜是为了绕过杀毒软件

{\blur10}I think

{\blur10}既然是从GitHub下载

{\blur10}but it's downloading from GitHub

{\blur10}那问题出在哪？

{\blur10}so what's the problem?

{\blur10}抱歉画面晃来晃去

{\blur10}I'm sorry for throwing the screen around

{\blur10}它正在下载zip压缩包

{\blur10}but it's downloading the zip file

{\blur10}重命名为随机UUID

{\blur10}calls it a random UUID

{\blur10}然后解压到另一个随机UUID

{\blur10}and then extracts it into another random UUID.

{\blur10}这两个UUID相同吗？

{\blur10}Are those the same?

{\blur10}是的 完全一致

{\blur10}Yes

{\blur10}然后就会删除文件

{\blur10}And then deletes it.

{\blur10}估计还会执行程序

{\blur10}I think it runs it as well.

{\blur10}我们来看看压缩包内容

{\blur10}Let's check out what's inside.

{\blur10}DLL文件

{\blur10}DLL.

{\blur10}其实看不出什么门道

{\blur10}Yeah

{\blur10}但可以使用detected it easy检测一下

{\blur10}but I've got detected it easy.

{\blur10}如果是C#或.NET写的

{\blur10}If it's C Sharp

{\blur10}或许还有办法处理

{\blur10}we can probably do something about it.

{\blur10}哦 原来在压缩包里

{\blur10}Oh

{\blur10}抱歉

{\blur10}I'm sorry.

{\blur10}是我犯蠢了

{\blur10}I'm stupid.

{\blur10}马上解压看看

{\blur10}Let me extract it real quick.

{\blur10}这情况可不妙

{\blur10}Oh

{\blur10}相当不妙啊

{\blur10}This does not look good at all.

{\blur10}该不会还做了混淆处理？

{\blur10}Oh

{\blur10}我要运行试试

{\blur10}I'm gonna run this.

{\blur10}豁出去了

{\blur10}I don't care.

{\blur10}直接运行吧

{\blur10}Let's run it anyway.

{\blur10}反正就是要感染这台电脑

{\blur10}We're here to infect this computer.

{\blur10}它做了什么？

{\blur10}What did it do?

{\blur10}不如安装个追踪器看看

{\blur10}I mean

{\blur10}至少能监控部分行为

{\blur10}At least somewhat.

{\blur10}程序崩溃了

{\blur10}It crashed.

{\blur10}为什么崩溃？

{\blur10}Why did it crash?

{\blur10}因为是虚拟机环境？

{\blur10}Could it be because it's a VM?

{\blur10}别担心

{\blur10}Worry not.

{\blur10}我们用的是强化版虚拟机

{\blur10}We have a hardened VM.

{\blur10}再试一次

{\blur10}Let's try it.

{\blur10}还没运行

{\blur10}Not running yet.

{\blur10}好的

{\blur10}All right.

{\blur10}现在运行了

{\blur10}Running now.

{\blur10}控制流完全不同了

{\blur10}Oh

{\blur10}这次差异太大了

{\blur10}Oh

{\blur10}有意思

{\blur10}Interesting.

{\blur10}它做了什么？

{\blur10}What has it done?

{\blur10}这是当前用户的值吗？

{\blur10}Is that a value for the current user?

{\blur10}不清楚它的行为

{\blur10}I don't know what it has done.

{\blur10}简单说 他们给你一段shellcode 让你在本地机器上执行

{\blur10}Okay

{\blur10}一旦你运行这个

{\blur10}And once you run this

{\blur10}一旦执行这段shellcode

{\blur10}once you run the shellcode

{\blur10}基本上就完蛋了

{\blur10}it's pretty much over.

{\blur10}一旦运行这个 你就真的中招了

{\blur10}Once you run this

{\blur10}所以大家千万要当心

{\blur10}So be careful out there.

{\blur10}这是个非常简单的落地页

{\blur10}It's a very simple landing page.

{\blur10}不知道能不能让Cloudflare的页面显示出来

{\blur10}I wonder if I can get a Cloudflare one to show up.

{\blur10}总而言之 我又花了一个小时 还是没找到仿冒Cloudflare的假验证码

{\blur10}All in all

{\blur10}此外 过了那个阶段后 我再没遇到过任何假验证码

{\blur10}Moreover

{\blur10}这种情况相当罕见 但已经存在一段时间了

{\blur10}It is pretty rare

{\blur10}我认为它如此特别的原因 在于其攻击性极强 本质上就是强迫用户执行shellcode

{\blur10}The reason I think it's so special is because it's super aggressive

{\blur10}and it basically makes the user run the shellcode

{\blur10}感染他们自己的电脑

{\blur10}infecting their own computer.

{\blur10}它可能在某天彻底消失

{\blur10}And it might go extinct at some point

{\blur10}尤其是如果它模仿验证码的效果不佳的话

{\blur10}especially if it doesn't mimic the CAPTCHA well.

{\fs109\blur10}不管怎样 这些落地页大多都是凭感觉编写的 而且所有GitHub上的投放器都是自动化的

{\blur10}Either way

{\blur10}and all the GitHub droppers are automated.

{\blur10}这做法相当偷懒 但毕竟我们生活在生成式AI的时代

{\blur10}It's pretty lazy

{\blur10}越是看似合理，越是危险

{\blur10}The more plausible it is

{\blur10}我想找到Cloudflare那个案例 因为整个页面看起来相当逼真

{\blur10}I wanted to find the Cloudflare one because it all looked pretty genuine

{\blur10}但我只有一张截图

{\blur10}but I only have a screenshot.

{\blur10}原理都是一样的

{\blur10}The idea is the same.

{\blur10}所以大家务必保持警惕

{\blur10}So stay safe out there

{\blur10}别在电脑上随便执行shellcode

{\blur10}don't run shellcode on your computer

{\blur10}我们下期视频再见

{\blur10}and I'll see you in the next video.

{\blur10\fad(200,200)\pos(1953.333,496)}原标题：New Cloudflare-Google Captcha Virus 原作者：Enderman\N
原视频上传日期：2025年7月30日

{\blur90\fad(200,200)\fscx185\fscy188\pos(1885.333,840)}在 Youtube 上关注

{\blur10\fad(200,200)\pos(1909.333,1220)}翻译/压制/字幕制作：HAF半个水果\N
翻译质量权威评价：原来25年就有小拉即用机翻糊弄人了

{\blur10\fad(200,200)\pos(1945.333,1316)}如果你喜欢这个视频，请多多支持和评论哒~ o((>ω< ))o\N
字幕制作不易，喜欢的话支持一下我吧！