-: So Trojans that we created so far are very cool.
They can by pass antivirus programs.
They run two pieces of code,
the first one runs in the background,
which runs our own code,
which, that was what we want to do.
For example, open a port or connect back to us,
and give us a shell,
and it runs another piece of code,
that the user expects.
So it could display an image.
It could play an MP3, or display a PDF file.
This functionality makes it very difficult, to detect.
So the best thing to do, is the first thing
Is the check the properties of the file,
and make sure that it is what's claiming to be.
So we have our git picture here,
and we can see that it's JPG.
So it looks like a picture,
and has an icon,
and if I run it I'll a picture,
like we've seen in previous videos.
Well let's go right click,
and go on properties,
and when we go to the properties.
You'll see that this is an application, it's not a picture.
So same goes with PDF, same goes with MP3.
It should say MP3 if it was an MP3.
If should say PDF if it was PDF,
and it should say a JPG if it is a JPG.
Well in this case we can see that its saying,
and its still a no start it's executable.
Going on the details, you'll see that,
it is an application.
So it's not a picture,
if it was a picture it should tell you that it's a picture.
So from here will know that we are being fooled by this.
Another thing you can play with the file name,
and you'll be able to reset it,
if you just rename the file to anything else.
You'll see that's its an exe file,
and its not a JPEG.
So if I just do it, change it to test.
You'll see that the name has been changed to test.
Now lets assume this Trojan,
was combined with an executable.
So if you run it, it was, you were expecting to get an exe,
and you were excepting an application.
So lets assume that its combined,
with download accelerator plus.
Instead if being combined with a picture like so.
So the task is gonna be more difficult,
because you are expecting an application anyway.
So lets try to run this.
Now obviously again with the picture and with the PDF,
windows will tell you that you are trying to run,
an executable, but if you're running,
if your excepting an executable,
then you gonna run it anyway.
Such as the case with that,
and this will obviously play the executable
that you are looking for,
and send a verse session to Kali.
So what am going to do is,
am gonna go to a tool called resource manager.
And from this tool, if you go to the network tab.
Am already in the network tab,
you'll be able to see all the open ports in your machine.
And we can see here we have port 8080,
and its connecting to an IP address which is 10.20.14.203.
Now obviously 8080 is not very suspicious.
So even if it was 180, then it could look not as suspicious,
and also its coming from a process called browser,
which again is not very suspicious.
The suspicious part is the remote address.
So it's accessing an address of 10.20.14.203,
that we jut don't know even what it is.
If it was a website then putting this into the browser,
should take you to a website,
or to a server of that website.
And in most cases if this was a hacker computer,
it will not take you to a website or anything,
and then you will know that this person is an attacker.
To verify this you can use tools called,
Reverse DNS Lookup.
What that does is basically give it an IP,
and it should tell you what website this IP belongs to.
Or which domain this IP, belongs to.
So lets have an example on Facebook.
So, lets say in your resource manager you have seen an IP,
and your suspicious about it.
So am actually gonna get you a proper IP address,
for Facebook.
So lets say for example you've see this IP.
There's a connection on port 80, going to this IP.
So if you copy this, and go on google (typing),
and such for Reverse DNS.
So am gonna put the IP in here.
The IP that you see in your resources,
and you look it up.
If it's for a proper website,
then there is nothing to be concerned about.
If it looks suspicious,
then you'll know that this is going to a suspicious person.
Now if you've seen something like this,
and its going to Facebook,
and your browsing in Facebook.
Then is now mold your using Facebook.
So there's a connection between you and Facebook.