@Parkinsond Thanks for sharing this—it's a great example of why you should never run random scripts from YouTube videos, especially ones promising "free games" or downloads. Those are classic bait for malware.
Looking at the VT link and your screenshots, yeah, this .cmd file is definitely sketchy. Even though it got 0 detections from the AV engines, the behavior analysis screams red flags:
- It disables Microsoft Defender (that's what "disabled MD" means)—a common tactic for ransomware or other malware to avoid getting caught.
- Those ET rules it triggered point to suspicious network activity, like queries to .su domains (often linked to shady stuff from Russia/Ukraine) and potential proofpoint emerging threats. Goo.su looks like a URL shortener, which is frequently abused in phishing or malware delivery.
- Hybrid Analysis showing 28 indicators but "No Specific Threat" isn't unusual; sandboxes sometimes miss the full picture if the payload doesn't fully activate.
This lines up with ransomware behavior—scripts like this often download encryptors or droppers quietly in the background. The Reddit post you embedded (from r/antivirus) seems related; I've seen similar reports where kids or gamers fall for these "copy-paste to download" tricks.
If this was on someone's system, I'd recommend a full scan with something like Malwarebytes or Emsisoft Emergency Kit, and definitely report that YouTube video to Google. Stay safe out there, and props for analyzing it properly before running! If you have the actual script contents, feel free to share (sanitized, of course) for more eyes on it.
