40630
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
More information about Threat Actor Group (TAG) 150:
https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations
FYI: Security research pedro2sudo (I have no idea who they are, they just randomly send me pictures of cats) has noted the discovery of malware targeting HyTale
What does this mean? I don't know. I'm not a NERD.
A few days ago malwrhunterteam discovered a new malware family (I think, I couldn't find any family overlap, vendors please confirm).
I poked it with a stick. I've named it Smokest.
It was deobfuscated by nullableVoidPtr. It's neato.
https://malwaresourcecode.com/home/my-projects/write-ups/smokest-stealer-a-new-malware-family-maybe
One of my biggest weaknesses is writing. I hate writing.
My cybersecurity peers, colleagues, friends, who have the willpower to sit down and write and explain their work (or discoveries) is truly amazing.
I'd argue the process of writing is actually more difficult than the actual reverse engineering and/or development part. Partially because it's really boring, partially because it requires you to put structure and coherency on the madness floating around in your brain.
Huge shout-out to the nerds who have written big ass blog posts (or books).
I have continued to poke MalwareBytes with a stick. I've written a little article about it.
I discuss their main executable, some of their minifilter stuff, their proprietary file format ... I haven't even scratched the surface. I am TIRED
https://malwaresourcecode.com/home/my-projects/write-ups/malwarebytes-internals-incomplete
One time we got home and found a children's bicycle lodged in the grill of the car. Did we brag about it? No
Читать полностью…
Hello,
We have hit a significant milestone. 400,000 followers.
What does this mean? I've got 400,000 little people inside of my internet. I don't know how so many tiny people got in here, but you're in there.
Thank you for the love and support. If any of you by chance happen to be extremely wealthy please consider giving me a large quantity of money so I don't have to do work.
I would love having a large quantity of money.
Mildly interesting things about this accounts followers:
- Some of you are sex workers. Is this surprising that sex workers are on the internet? No. Is it surprising sex workers are interested in malware? Kind of. I'm aware some of the sex workers following this account are very famous and it surprised me.
- Some of you are employed by the United States government. I'm well aware some of you are employed by the FBI or NSA. It is very strange receiving a $5 monthly reoccurring donation from someone employed by the NSA. I'll take your money still.
- Some of you work for governments outside the United States. It is interesting receiving emails from foreign militaries asking about particular malware samples. It is also surprising some of you email me (unironically) from your military emails.
- Some of you are criminals. Yes, I see your emails and messages. I see you're ransoming places, developing ransomware, or extorting people. I speak with criminals less now because I have a baby boy and I don't want him to grow up thinking Daddy is an internet schizo
- Some of you are regular people who do regular stuff. I see you commenting and being curious about stuff. It's surprising seeing teachers, or students, or local politicians, or geologists, or firefighters, or athletes, talking to me about malware. Once again, is it surprising normal people are on the internet? No. Is it interesting to see a random ass person curious about malware? Kind of. I enjoy it.
- Some of are unironically professional video game players. If I ever want to be carried in a video game I WILL call in a favor.
- Some of you work for cool companies. I'm always delighted to get contacted by a company like Rockstar Games, or NVIDIA, or Walmart (unironically).
- Some of you are dead. I've lost several friends, peers, and colleagues since vx-underground was created. Sometimes I look at your accounts, scroll your post history, and feel sad.
Lots of cool people doing cool stuff. I appreciate the love and support over the past 6.5 years.
Cheers,
- smelly smellington
MalwareBytes has an local database on the machine. It is a SQLite database. It contains settings for various properties such as licensing, malware identified, and known-good and known-bad lists. This is standard anti-malware stuff. The database with "ThankYouForChoosingMalwarebytes" is the less interesting database, as it mostly contains settings (this can still be abused though).
Regardless, MalwareBytes does a couple of things with this SQLite stuff
MalwareBytes establishes a kernel-mode minifilter (mbam.sys). They setup minifilter callback routines to handle events on the system for process creation, process loading, and registry modification (Image 1)
In other words, MalwareBytes is notified immediately when a process is created or an executable image is loaded. When a process is created or an executable image is loaded, MalwareBytes has special functionality to temporarily "pause" execution so it can review it.
However, this "pause" happens faster than you or I can blink. Computers are fast.
The mbam.sys creates an internal record of all processes running. When a new process is loaded it is added to this internal record. When a program is closed, it is removed from the record. It does this so it doesn't accidentally review or "pause" the same process twice.
When a program is added to this list, the kernel-mode component communicates with the user-mode component that then signals and connects to a local SQLite database. The SQLite database then does a lookup to determine if the process "paused" is known or unknown (Image 2)
However, it should be noted, Image 2 is not the important SQLite instance I am looking for. This is something else MalwareBytes uses (and communicates to with kernel-mode components). The point still stands.
If it is known, it communicates back to the kernel-mode component that is it known. If it known, and known to be malicious, MalwareBytes takes action on the program attempting to run and immediately stops execution. If it is known to be good, MalwareBytes marks it internally as "seen" and keeps it in it's internal record.
Image 3 is from the internal database they use. It's fairly large and is mostly settings. I still haven't find where the really nice, big, and important dataset they use is. It requires more poking and more sticks.
You don't have to be a genius to see this and say "Oh, it's targeting cryptocurrencies"
Читать полностью…
The thing I find most admirable about my colleagues and peers in the United Kingdom is that they too dislike and distrust the government.
I'm like, "wtf y'all don't trust mfers either?" then I ask if they want to party and almost always they agree.
Good people across the pond
Sabrina Thipdavone Rhodes, an Intelligence Analyst with the Nevada High Intensity Drug Trafficking Area (HIDTA) working with the United States Drug Enforcement Administration, plead guilty to theft of property of the United States.
Rhodes stole and converted to cash 243,199.0421 of the virtual currency Ripple (“XRP”) that had been seized by the DEA.
The value of the XRP stolen from the DEA Wallet would have been approximately $689,688.
When I shared that obfuscated Javascript payload that was targeting Grand Theft Auto V FiveM stuff, I had like 6 nerds pop out the bushes telling me how much they enjoy working with obfuscated payloads (Javascript, Lua, Powershell, etc).
WHO ARE YOU PEOPLE? WHO HURT YOU?
I was reverse engineering this Grand Theft Auto V malware that targets FiveM stuff. It was a big ol' mess of obfuscated Javascript. I hate obfuscated Javascript.
I posted I hated obfuscated Javascript.
Subsequently, a very nice person named nullableVoidPtr deobfuscated the massive code base for me when I was sleeping. Thank you. I love you.
Anyway, when I began poking it with a stick I discovered the malware connects to blum-panel(.)me. It registers there. It's the C2.
When you visit via HTTPS it notifies you of their Discord server (also references to their Discord in their code?)?
When you connect to their Discord they advertise security services for Grand Theft Auto V stuff ... ?
What the fuck.
Dawg, do you NOT run a malware campaign and advertise it on Discord like this. Are you OUT OF YOUR MIND?
It's 10pm and I'm reverse engineering Javascript malware targeting FiveM.
Why are people making malware for Grand Theft Auto V roleplay servers
Poking MalwareBytes with a stick continues. I fell down a weird rabbit hole.
MalwareBytes contains a file that is packaged with it called "malwarebytes_assistant.exe". This file is written in C#.NET, it subsequently loaded malwarebytes_assistant.dll.
As the name implies, it is indeed an assistant file. It accepts commands and does things based on the commands given to it. There's a lot of commands, but here are the interesting ones.
- AddExclusion (can't find it though)
- Deactivate
- DisableWebProtection
- StopService
- LaunchProcess
- SetRegistryValue
- CreateWFCRule
- ModifyWFCRule
- DeleteWFCRule
LaunchProcess and SetRegistryValue check the parent process of the invoker. If it is not from a process that is signed by MalwareBytes, it fails. However, everything else works. It does prompt UAC, but it says its coming from MalwareBytes.
tl;dr disable MalwareBytes, modify Windows Firewall, etc. It displays as MalwareBytes doing it.
We must continue poking it with a stick.
We've solved the mystery. Who's That Pokemon? It's CastleRAT a/k/a TAG-150!
Okay, here is the drama and scoop, or whatever. I don't know if anyone cares, but this has been a really interesting puzzle with lots of twists and turns.
Previously malwrhunterteam discovered an unusual malicious .MSI file called "TopWebComics". It dropped an obfuscated .JS file.
nullableVoidPtr deobfuscated the malicious .JS, I reverse engineered it and named it "Smokest Stealer". However, Kali3ndo went off my research notes and discovered that Smokest drops an additional malicious .PS1 file when Smokest connects to the C2.
The malicious .PS1 file drops a malicious .PY file, encoded with PyArmor. The Python script extracts a payload from a .JPEG.
After reviewing it, poking it with a stick, and having all sorts of fun, it turns out this payload was first noted by YungBinary in August, 2025. This payload is CastleRAT (and tracked as TAG-150 by RecordedFuture).
CastleRAT payload found January, 18th:
8d2e77912e2e1d9d8cafb76d4562686cfaad556ca1df1919bfba304b31193402
"Smokest Stealer" MSI:
5a1c14335d0a8b007ff2813e6ef738e8836be38257cc82fe03c02b71d71e1b01
"Smokest Stealer" JS:
29e13df9547d4e85e7ca3fc5b95eab90f56a233aabc406638bee2ded368acd3d
Thank you to my peers and colleagues for reversing this with me throughout the day and having fun with it. This was a very silly malware sample.
It should probably be noted their C2 leaks information (don't tell them that). It shows Smokest has stolen 5,850 passwords, 23,085 cookies, 0 wallets.
https://gist.github.com/vxunderground/87ce045ddfa57f05e53e65e423b51f49
Discussion on the internet today on the origins of traffic on the highway and the accordion effect it produces.
People were critical toward others who intentionally slowed down to be "nosey" about car accidents.
Let me be totally clear: I am one of those people.
I want to see the aftermath of a violent car accident. I am curious who is involved. I want to see a dead body. I 100% will slow down and take my time to inspect the scene. If possible, I will take out my phone and try to record it so I can show my friends later.
There is so much to reverse with their "SwissKnife", internal COM stuff, their internal protocol, their VPN technology, their hooking mechanisms.
I don't know if I got that dog in me to finish this. It's really interesting, but I want to do something else now.
I remember when Bitcoin first appeared.
I thought, "cryptocurrency seems like made up internet money."
Fast forward, it's the year 2026. I think, "cryptocurrency seems like made up internet money."
mY tEsLa iS sElF dRiViNg
This is ancient technology. Nothing new. My Dad's 94 Toyota had self driving capabilities.
It was called "cruise control".
All you did was flip the switch and then let Jesus take the wheel.
Sometimes we ran over pedestrians, drove on the sidewalk, sped through red lights, but God dammit it WORKED. We didn't need any "government" telling us how to cruise
Going to do a write-up on poking MalwareBytes with a stick, how it works fundamentally, some possible attack vectors against it, ... then I'll do something else.
If you have any recommendations on what I should poke with a stick please let me know.
> reverse engineer MalwareBytes
> find local sqlite db
> look inside
> password "VGhhbmtZb3VGb3JDaG9v"
> password: "c2luZ01hbHdhcmVieXRlcw"
> append
> base64
> decode
> "ThankYouForChoosingMalwarebytes"
Nerds online have identified a malware strain using "Deno", some fancy Javascript run-time thingy. I have no idea what this means. However, other malware nerds have identified this as unique.
The payload is a second stage which comes from a payload impersonating TopWebComics (???).
They're targeting WEB COMIC NERDS (or not, nobody really knows yet for sure). It was first identified by @malwrhunterteam
Cybersecurity vendor Cylerian identified a similar malware campaign using this exact malware technique in early January, 2026. This appears* to be a relatively novel malware campaign. Unfortunately, there is insufficient information to identify it more. It is difficult to ascertain for the time being if this is something truly unique or novel, or recycled stuff from a previous malware campaign.
tl;dr need to poke with stick. Not enough information. First glance looks interesting.
This payload is also interesting because it appears (at first glance) to contain mutation-like properties. When the first stage connects and downloads the second stage (in attached link is one of the mutated Javascript payloads), the code changes each time the loader connects to the URL. However, the core functionality (domains it connects to) seems* static.
tl;dr
Stage 1 - TopWebComicsv1.msi
Stage 2 - Weird URL, obfuscated Javascript payload
Stage 3 - ???
Stage 4 - Profit!!1
Stage 2 obfuscated Javascript changes each time it is downloaded, hence it's mutation characteristics.
Some researchers have identified the same weird URL it uses to delivery the Stage 2 payload as also hosting an Amadey panel. Amadey is a very common Malware-as-a-Service provider. However, it would be ... unusual ... for an obfuscated polymorphic multi-staged Javascript payload to delivery Amadey. It would be a ton of complexity and sophistication to then throw it all out of the window for some run-of-the-mill crimeware.
If you're a nerd who likes trying to reverse engineer obfuscated Javascript this is your time to shine because, as of this moment, nobody has de-obfuscated it or determined which malware campaign it is potentially associated.
Note: some of the obfuscation SUCKS. It's very clearly an information stealer. It targets cryptowallets, Discord (???), web browsers, etc.
tl;dr tl;dr crowdsourced malware reverse engineering for clout
https://gist.github.com/vxunderground/0d0c5f265d9f5248fa9dca171aec16ba
More information, courtesy of the wonderful people of CourtWatch
https://storage.courtlistener.com/recap/gov.uscourts.cacd.989465/gov.uscourts.cacd.989465.3.0.pdf
There are people out there who unironically like deobfuscating stuff like this (see attached link).
Imagine that level of schizophrenia. Imagine waking up and enjoying pain and suffering.
https://raw.githubusercontent.com/Linux123123/fivem-malware/refs/heads/main/second_stage/nulljj.js
X is offline.
Is it DDoS? Is it an oopsie doopsie? Did Elon Musk crash out? Find out next time on Dragon Ball Z
I fucking HATE this shit. I hate dealing with this type of obfuscating. Ugh.
https://raw.githubusercontent.com/Linux123123/fivem-malware/refs/heads/main/second_stage/nulljj.js
tl;dr
"C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe" --disablertp
yay no more protection
I've decided to poke MalwareBytes with a stick.
Why? I'm mildly curious how it works internally and I'm curious if I can produce malware custom tailored to evade it.
Why? Because sometimes I get weird ideas and want to do weird things for literally zero reason other than "sounds kind of cool".
I setup a VM for the first time in years to poke it with a stick. I didn't want to install an AV on my main machine. Yes, I will do malware analysis on my main machine but not install an AV.
After installing MalwareBytes, skimming some of the files, poking random things and saying "wtf does this thing do", I've learned some mildly interesting things but nothing revolutionary.
1. They use Jenkins for continuous integration. Does this mean anything? No.
2. Based off my minimal testing, I don't see any DLLs injected into binaries when they're loaded into memory. However, the binaries I tested are well known and well established. It might inject DLLs into unknown binaries.
3. MalwareBytes main binary is written in C#.NET. It loads a secondary MalwareBytes.dll which then displays everything. It does the same stuff Microsoft Copilot does. That is how MalwareBytes has a fancy UI and stuff.
4. MalwareBytes stores very little in HKEY_CURRENT_USER making tampering from user mode kind of hard. It's just basic settings and stuff.
5. MalwareBytes has a custom protocol handler of "malwarebytes://". It looks like it uses this for interprocess communication between other MalwareBytes modules and binaries
6. MalwareBytes ships with a (basically) blank DLL called "Sample.dll". I have no idea why.
7. MalwareBytes has 2 mini filters in place which (presumably) are the main thing responsible for detecting malware. This is standard. MalwareBytes Chameleon (one of the minifilters) looks like it's meant to prevent tampering with the actual important MalwareBytes minifilter.
8. MalwareBytes Chameleon looks like it's responsible for communicating with user mode and kernel mode components. It looks like this is done so user mode components don't communicate directly with the minifilter responsible for actually detecting malware
9. I have a lot more poking to do
10. There is a binary called "assistant.exe" which loads "assistant.dll" (more .NET) stuff. It may possible to abuse this as a LOLBIN (maybe, need to poke more, kind of). assistant.exe does things like issuing commands for scanning, updating, and displaying things in the MalwareBytes UI. It accepts commands as "assistant.exe --uri malwarebytes://"
11. I have no idea how their scanning works, but it's labeled internally as Hyperscan
12. There is a thing called ProtectedHashes. I have no idea what this is.
13. There are tons of SQLite libraries, but I have no idea what it's for. Presumably, it's for known-good and known-bad file hashes, maybe? But I have no idea where this is stored.
14. I like cats