This "Sponsor" Is Stealing YouTube Channels... 

FBX Screen Recorder is an innocent third party that had their website and Intellextual Property stolen. I had a chat with their CEO and wanted to relay this information with you. Wanted to clear the confusion since some people may attribute them with these crappy scammers.

"This virus has no idea it's being virtualized." Muta sounding like he's pranking the virus.

Things that give me life: 1) Life 2) Muta's laughter 3) Muta's Indian customer rep. stereotype accent

Thanks for this, I got an email from them and was nearly about to download it...

Dudes last name: is banana *seems legit to me

You know it's a scam when they state that "they are not a scam."

Aw come on, you guys don't know Ed Banana? He's good friends with the CEO of Apple, John Apple!

The one tech scammer who switched sides and saves us all from viruses (Yes the comment sections huge, I know, just ignore it unless you really wanna read it)

Whenever he says “This kinda scares me” my conscious brain starts to freak out

I love how one of the fake reviewers was called "Egg master" and the email was from someone called Edward Banana. Nice names guys.

“This email is fake on first look” *ignores the name Edward banana*

I have 5 of these guys promoting steam stealers and other things too paying 400$ to do it.

_”i know there are time zones, but go to sleep please.”_

Raid shadow legends: “We’ve got a lot in common”

Plot twist: The “scam” website he is talking about was actually his sponsor.

There is similiar company called Gloom. Doing same shit.

The scams and malwares cannot hide from the wrathful eyes of Muta and his red background.

Me: *doesnt understand half the stuff hes saying* also me: yes,continue

Hey Muta, I remember when you were just reading CreepyPasta back in the day. Good times. Its nice to see you've build something for yourself that everyone here seems to love.

1:26 shall we just note that this "Ed" sent that email from a Gmail Account (probably) called "Edward Banana" but signed Edward Morrison

Malware : I see your using a virtual machine Muda : let me teach you a little lesson in trickery

”i know there are time zones, but go to sleep please.” says as I'm currently watching this at 3:38 AM.

The email was sent from someone called Edward Banana but at the end of the email, it says Edward Morrison. Totally legit /s

This scam is also run under the name "GameGloom" and others. Beware.

Muta: I'll be back later tonight to shown you what I found Later tonight: *RED* Oh boy, this gonna be good

Muta at the end: And I've encoded this video with this malware so when you watch it, it downloads this and your channel is mine making you tonight's big loser

Woah just realized that’s not two monitors.

"Hi, my name is Ed" Muta smiling at the camera: "Hi, Ed!"

Muta: Didn't install arch for the superiority. Also Muta: Has neofetch up cause he likes having the logo on the screen. 😏

1:48 The way he said that was beautiful. It sounds so natural. I could listen to that emphasis on repeat for hours.

"it's sent to me at 2 in the morning" *european noises*

are we just going to ignore the fact that one of the sample pictures on their site is from Doom Eternal? A game that hasn't even come out yet!? It's ripped straight from the Quake Con trailer!

"Now what do I mean by probes?" He's got a bunch of 1990 Ford Probes in there.

Your channel is part of why I want to work in IT/Cybersecurity... whether that is a good or bad thing has yet to be seen.

*“Here’s a little lesson in bribery!”*

"You may be setting yourself up for a pretty bad time" Megalovania playing in the distance

*sees fake sponsorship* Muta: So you have chosen death

Hey he knows a lot about computers Everyone: He’s Indian Ok then

Thank you for sticking out for us small channels, especially those that might not be very tech-savvy and try to install it anyway!

I really enjoyed this video. You did a great job of explaining everything. As a person who has no knowledge of the innards of computers and their operating systems, you did a great job of explaining everything to where it makes sense.

I took a further look into the software ever since the tweet. Here's some additional things I found (it does more than we noticed): - It does appear that a screenshot is taken and included in the to-become archive (any.run, at least on the free plan, is not allowing access to that -- if you set up a virtual machine for that then you could capture all of it during the process or after removal of the created folder [i.e. Recuva]) - System information is supposedly included as well, but same case as the screenshot - The "installer" has obfuscated C#, so it is a bit more of a challenge to see what is specifically going on in regards to that - "Installer" makes a copy of itself to "%temp%\FolderN ame.exe" and then a registry key is created for it to be ran on system startup - "Installer" drops and executes "svhost.exe" (name used for deceiving despite it being a letter off [should be 'svchost.exe'] -- program does the dirty work of capturing data) - The dropped executable goes through not only cookies but saved logins and local storage. If cookies are captured, usually they're enough to get around 2FA completely, so change your password regardless (so that the session is invalidated -- depending on the site, you may have to manually invalidate the compromised session via settings) Browsers it checks for: - Google Chrome - Mozilla Firefox - (Mozilla) IceCat - Comodo dragon - Orbitum - Torch - Amigo - Kometa - Chromium - "Nichrome" (?) - Maxthon 5 - Sputnik - Epic Privacy Browser - Vivaldi - CocCoc - uCozMedia Uran - QIP Surf - CentBrowser - Elements Browser - TorBro - Opera (Stable) - Dropped executable also checks for the following cryptocurrency wallets: - Electrum - Electrum LTC - Electron Cash - Exodus - MultiDoge - Zcash - Dash Core - Litecoin - Anoncoin - BBQCoin - Devcoin - Digitalcoin - Florincoin - Franko - Freicoin - GoldCoin GLD - Infinitecoin - IOCoin - IXcoin - Megacoin - Mincoin - Namecoin - Primecoin - Terracoin - YACoin - Jaxx Considering reports regarding RU-vid channels being compromised and end up with cryptocurrency scam videos, the wallet part lines up well.

You inspire me because of how real you are and you make my day when it’s bad and make it better when it’s going good for once thank you

The 322 dislike is the ppl who made the software

Love these videos. My only thing, the fact that it's sendings requests like this in general isn't the nail in the coffin. Foreign hosts are often cheap. It'd be interesting to look at the packet's content themselves, and if secured using SSL, create a man-in-the-middle proxy for your VM to capture the network packets. It could be diagnostics, or even just user count trackers. A lot of my small softwares had something like that, it would basically send a packet to my random server saying "A user is using your software, they have a Windows 90 PC with 20 billion terabytes of RAM and an Intel Unicorn CPU" for general diagnostics.

You know Muta is serious when his room goes red mode

Microcenter guy: how wide of a monitor are you looking for? Muta: yes.

Came here to learn about a new case of malware spreading around but left having gotten the single best 15 minute computer science lesson of my life.

Thanks a lot! I got an email about this and I saw your video about it!

I'm commander Shepard and this is my favorite game recorder on the citadel.

I'm a relatively new subscriber, and love analysis dissection. Seeing the setup and the explanation of anti-VM malware, this was just cool. Some stuff I knew, but plenty new. Great stuff. It's weird being sincere in RU-vid comments.

They legit sent me an email and I always research my potential sponsors, and I found it so odd that there was NOTHING about this product. I had a bad feeling so I ignored the email in its entirety. And thank GOD that I did. Thank you so much for spreading the word.

Thanks for the tip and refresher course, I let both ads roll in exchange.

My first thought was *R A I D S H A D O W L E G E N D S*

We should get RU-vid to take action about this! It really seems as if they do not care about hacking channels, fake sponsors, etc... Btw muta love your videos! Was a very tiring day for me and this video was a great end for it. Hugs from a place in Spain!

Summary: research any "sponsor" companies that email you, if you don't recognize them already.

I'm taking my Computer Security classes in school right now. It's fascinating watching this with some understanding what he's talking about. Prior, it was just watching him ramble on about Computer Mombo-Jumbo!

1:00 OMFG!!!! They emailed me on my 50k channel. They wanted me to test their streaming software and pay me $500 to do it. I ignored them. JESUS!!!

Did his last name change just from Banana to Morrison. Still seems legit to me.

i have watched 5 your vids and i can safely say that u deserve my sub !! keep this mood on dud!!

Great Stuff! I'm a Computer Tech, and this is more that I tell my "Informed Clients."

I can't get enough virus investigations from you man! I flock back every time I hear if a new one. Thanks for making this aware to everyone!

Muta you almost have 1,500,000 subs... dude I remember when we were sitting at 40k. My god

0:35 : Insert Footage of Terrible Mobile Game. Me (sarcastically): LETS PLAY RAID SHADOW LEGENDS, DOWNLOAD NOW FOR FREE

I dunno shit about computers but OH MY GOD, I LOVE HOW YOU EXPLAIN EVERYTHING

The name "Nexxzy" already sounds suspicious in itself

Damn, past Muta is the only one that ever gets to geek out and have any fun. Poor future Muta. He must live in a constant state of jealousy.

Thanks for this info. You’re a lifesaver!

Algorithm sent me here, but as someone in IT with a bit of a background in security, love this video. Subbed.

>using arch linux because it''s lightweight >also uses KDE

How did you end up with all the skills you have when it comes to learning how to use linux and manipulate VMs and such? always wanted to learn all that stuff but I've never known where to start

So glad you run through crap like this very informative thank you good sir

Dude... my university professors were unable to explain this topic in such an easy to understand way.

It’s always Malaysia. Every time I’ve had issues with accounts it’s always been an ip in Malaysia. Lots of hackers there I guess

"Sorry for the LTT videography" says the guy that shoots all of his videos in a strip club

"I'm not doing this for superiority" >has neofetch open :^)

I'd actually love to see a video where you go in-depth and explain the whole set up you used. Or just all your setups in general. Something for us uber tech nerds out there.

This is a different type of investigating-styled episodes! I love it muta!🤘

When the little kids want GTA5 for free and go to google

Good job. Thank you for letting us know, keep it up.

you'd think the letter with horrible grammar would be a dead giveaway

A youtube Channel in Sweden named “Tarzan” feel for them and now the Swedish RU-vid has deleted his channel and he showed prof that it was he’s channel but they won’t bring it back. But they said they maybe can bring the videos back but not the subscribers.

Muta: Makes terrible pun based on the game he's running. Me: WOOOOOOOOOOO!

I honestly don't know why, but ur channel is becoming my favourite of all

Awesome job and analysis. Subscribed.

Linus would be proud with that ‘control’ pun.

*_the blood god has been summoned_*

I have no idea how I came to watch this nor do I understand the technicalities but Hot Damn is it entertaining!!

Oh blessed algorithm... thank you for showing me this glorious man!

Who doesnt reject Edward Banana?

This sponsor: hippty hoppty, your channel is now my property

It doesn't matter Arch is lightweight if you install plasma or gnome, great videos btw!

All I can hear out of this jumble of technical words is “probe” and “naked”.

I had an email about this sponsorship myself, but passed it down due to the shitty grammar and dodgy address. Glad I did after watching this.

Muta: **uploads a new video** **3 minutes ago** My hand: *_Smashes the screen trying to click_*

Me: trying to watch RU-vid in piece RU-vid: LETS PLAY RAID SHADOW LEGENDS DOWNLOAD NOW FOR FREE

Just call it service host... One tell I saw from the hybrid-analysis run I found (you showed the SHA256 on the VT page, I just transcribed) is the program does a zone transfer; it's basically bypassing networks zones and self-approving it's own traffic. It also terminates any MS tracing on the executable itself... and it looks like it uses taskkill.exe (called from cmd) to self-terminate, which is a call that can be intercepted and leave the program resident for better analysis. I find it SUPER interesting that the HA network analysis shows all the POST traffic to that Malaysian address is set with Accept-Language ru-RU. It's 'speaking' Russian....

Man, I’m so thirsty for your computer knowledge.

Me: Laughs at Indian hacker videos Muta: "This malicious program was brought to you by the boys in Malaysia" Me: Oh no

I found you yesterday from r/linux_gaming and I am really enjoying your content.

Bruh. i love LTT style videos. the more you do, the more ill watch