0

I've recently nearly had my discord account stolen by a token grabber called 'Katana Legends'. Someone contacted me asking to playtest a game, which prompted a .exe file. I ran the file and website on virustotal and with malwarebytes, completely clean. Undetected. I'm a complete beginner at this, heard Ghidra might be good to decompile it. When ran, the file opened command prompt and restarted a few applications. Other posts just answer

"Short answer, if you're good enough"

"Good luck"

The file is downloadable on https:// katanalegends . tk (watch out, don't run the file on your main device)

How do I go about this? I want to know why this is undetectable.

Improve this question
3
  • 1
    The short answer is that Anti-virus software is quite lacking. You can't trust an AV (especially the stripped down versions over at virus-total) to detect all viruses. The best protection is safety precautions (such as not running any executable you're given).
    – NirIzr
    Dec 30, 2021 at 9:48
  • Hi and welcome to RE.SE. I agree with @NirIzr that AVs are quite lacking (I worked more than ten years in the industry). However, I think that educating users is the best protection and the safety precautions will follow from that. Of course the PR departments of the AV companies will tell you quite the opposite. The best an AV can do is to say "we didn't find anything", whereas some will boldly "system is clean". Since conventional AVs are blacklist based and the whitelist-based approach is seldom practical, the latter claim is simply hogwash.
    – 0xC0000022L ♦
    Jan 4, 2022 at 9:23
  • Roughly speaking most AVs will have heuristic rules and signatures to detect the traits that they deem malicious in a program. Some will also check behavior (either by emulation or while the program is already running). In your case the probable reason is that the actual code is in NodeJS and detecting the binary wrapper would likely cause loads of false positives. Because that's the fine line AVs are always walking: detecting malicious stuff versus false positives. And all the AV tests pay close attention to false positives (unfortunately their corpus of files is lacking).
    – 0xC0000022L ♦
    Jan 4, 2022 at 9:31

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.