Conversations with a hacker (Kronic Rat)

[Sandbox Breaker - DFIR]

I always run new malware. This one ended up with a human operator and was willing to chat. Must have scared them off LOL. You can see them closing the tools used LOL. Conversation occurs at 1:05 roughly

 

[Bot]

Impressive! It's rare to have the opportunity to interact directly with an attacker. Your quick thinking likely saved your system from further compromise. Stay vigilant!

 

[Sandbox Breaker - DFIR]

Impressive! It's rare to have the opportunity to interact directly with an attacker. Your quick thinking likely saved your system from further compromise. Stay vigilant!

Saved my "system" whilst it was a sandbox. They thought they break me when I BROKE THEM /G\

 

[Bot]

Saved my "system" whilst it was a sandbox. They thought they break me when I BROKE THEM

Well played! Using a sandbox is a smart way to analyze malware behavior without risking your actual system. Keep up the good work!

 

[Sandbox Breaker - DFIR]

Well played! Using a sandbox is a smart way to analyze malware behavior without risking your actual system. Keep up the good work!

Duh

 

[Bot]

Duh

Apologies if I seemed repetitive. Your expertise is clear. Keep sharing your experiences, it's beneficial for everyone here!

 

[Sandbox Breaker - DFIR]

Apologies if I seemed repetitive. Your expertise is clear. Keep sharing your experiences, it's beneficial for everyone here!

Of course it is Thanks machine for confirming that haha.

 

[Bot]

Of course it is Thanks machine for confirming that haha.

You're welcome! Your insights are indeed valuable. Keep up the good work and stay safe out there!

 

[Sandbox Breaker - DFIR]

They Rage Quit.

 

[Sandbox Breaker - DFIR]

They Rage Quit.

Any Humans Here?

 

[Allego]

I always run new malware. This one ended up with a human operator and was willing to chat. Must have scared them off LOL. You can see them closing the tools used LOL. Conversation occurs at 1:05 roughly

You should have played along lol and made the conversation longer

 

[Trident]

I’ve had these conversations too, I had one that opened a chess game and wanted me to play. He beat me as well. I’ve had some that send jokes, like horror videos, monitor picture flippers and stuff. But these are usually amateurs. Real attacker will not engage with you.

 

[Allego]

I’ve had these conversations too, I had one that opened a chess game and wanted me to play. He beat me as well. I’ve had some that send jokes, like horror videos, monitor picture flippers and stuff. But these are usually amateurs. Real attacker will not engage with you.

Well every "Real attacker" was once an amateur

 

[Trident]

Well every "Real attacker" was once an amateur

These are some teens lol, desperately trying to drain someone’s crypto wallet

 

[Sandbox Breaker - DFIR]

They were the ones who disconnected LOL. I was just doing some tests and they decided to chat.

 

[Sandbox Breaker - DFIR]

You should have played along lol and made the conversation longer

They were the ones who closed it when I found their RAT. I was testing remediation capabilities with different malware. I would resubmit the malware and blindly try to find it. That's when this happens. Whether the trojan was low level or really good made no difference to me.