40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
oh, and the files arent on VT, for my colleagues who care about weird annoying goop
initial loader:
0a12cdc7d66a5a26a52b1a8baec6816fd25d847bd26c9ffe145ef6e59fbc1a7f
.msi
99fe40b0831f75d17e16db291d15f03e48c324754f3e999f4bea69b4006b85a7
initial autoit script
0fec75b0aec43e8661130a4c271a09681e773ee93423a8d12d5f9705531443a0
secondary autoit file
8e57bbbdbccb3bf13069e02f0209a69fca2b6c3cc7d224cb94a1f342f23968b6
compressed delphi loader
4c8fdac932ee465bbcbb292c1570350284e46bd258fd961ea9c3bf69ccd65ee1
delphi loader
1b2c3e80347b35fb5811619f3aeae75f05dd4e635ffef7620141be7ed3041eb3
file6 (weird delphi thingie)
38c1d2f4888852b23c540ffdff38be2ab24cb14c4bed86ae762f532377772319
> be me
> get email
> "smelly, is this malware?"
> "someone sent this to our offices at work"
> "its trying to infect people at offices"
> ok cool
> get file
> download
> look inside
> 23,000 line vbs file
> lol ok
> xor encoded each individual character
> mildly annoying
> bonk bonk
> downloads file from enviamais-dot-store
> downloads "destenticador".py
> lol ok
> download
> look inside
> obfuscated python
> not very good obfuscation
> downloads .zip file
> "N3d5XpZbsd5juio".zip
> extracts .zip
> .zip contains .msi file
> lol ok
> download .zip, get .msi
> look inside
> all files inside installer stripped
> f1, f2, f3, f4, f5, f6
> lol ok
> check installer actions
> f6 is "winsqre".exe
> actually renamed autoit loader
> lol ok
> f6 (autoit) reads f4 (autoit scripts)
> look at f4
> obfuscated autoit
> takes a bunch of gunk to make another file
> chunk1, chunk2, etc
> add them together
> another autoit file
> ??? ok bro how far as we gonna go?
> look inside at new file
> autoit file scans machine for stuff
> looks stuff
> "FIBANK - Iniciar a sessão"
> "InternetBankingCAIXA"
> "GerenciadorCaixaGerenciadorFinanceiroCaixa"
> idk what this means
> if finds thingies, references other files inside msi
> ??? were looking back to the .msi installer ???
> autoit script loads f1
> RtlDecompressFragment
> o ok its a compressed .exe
> decompress file
> look inside
> DELPHI FILE
> look inside
> delphi does stuff
> delphi decrypts ANOTHER FILE and runs it
> ANOTHER DELPHI FILE
dude, what in the fuck is this shit?
.vbs -> .zip -> .msi (files 1 - 6)
.msi_file6 -> msi_file4
.msi_file4 -> autoitscript
autoitscript -> .exe
.exe -> msi_file5
Them: "Great meeting you at DEFCON! Thanks for the stuff!"
Then: *Sends picture of people and stuff*
Me:
- I'm not there
- I don't know who you are
- I didn't give you anything
- I don't know what you got
- I don't know the people in the photo
Me: "No problem, bro" (I don't know what's going on)
"What if we used AI to turn source code into a binary?"
Читать полностью…
Hi
More malware has been uploaded to VXUG. It's like, 150,000 malwares, or something. I also uploaded more malware analysis papers.
Show it to your parents, they'll be proud of you.
Chat, I'm unironically a big fan of AI now
I don't vibe code, or whatever, but it's ability to generate me slop Python scripts for reverse engineering, or it's ability to help me troubleshoot Linux gunk, is absolutely incredible.
I'll say, "Hey ChatGPT, I've got this goop that is doing X, Y, Z. Can you make me a Python script that handles it?".
My Python is trash, but ChatGPT is like, "I got you, big dawg", and gives me the thingie I need in just a few seconds, saving me tons of time browsing StackOverflow or screaming at my IDE about syntax issues.
Thank you, OpenAI, for giving me ultra mega slop Python maker 9000. It is incredibly helpful to me.
Oh, and I've never had OpenAI give me any warnings and stuff about potential violations or whatever. Anthropic complained all the time. I'm not verified by OpenAI as a cybersecurity professional, ... I just ask for slop Python and it produces magic. I don't know how it works, but it's cool and badass
Hahahahaha. What? You can't afford a ticket to Slermie Doop??? Sounds like you're POOR. Sorry, kid. We're HACKERS. We fucking HATE poor people.
Next thing you're going to do is say you can't afford the $2,000 Schmeemee certificate, proving you're a real hacker.
o ok, thank god they removed it, i was afraid the knedliky police were gonna come to my house and beat me to death with knedliky
close one
I like writing malware because, instead of making useful and productive software, you spend an absurd amount of time writing a really over complicated and convoluted way to create a file.
A simple line or two of code becomes like 50 lines.
It's fun, I don't know why
> get dm
> "smelly, is this goop?" (malware)
> "i found it on x"
> links GitHub
> download
> look inside
> .net goop
> didnt strip metadata
> internally refers to itself as FunkyStar
> internally does "ProcessAlpha", "ProcessBeta", etc
Not only is this shit slop malware, the author of this malware is larping to themselves as like, some sort of military operation. My brother in Christ, I'm happy you're feeling peppy about your slop malware, but you ARE NOT writing state-sponsored malware.
Hello,
So uh, a long time ago I said I was giving away tickets to DEFCON for free. A lot of people have DM'd me about it.
I can't go into too much detail about. I don't want to diss anyone, or throw shade at anyone, because I myself don't even know what the fuck happened. But, we had the money for tickets to DEFCON. We had sponsorship money. We had all the goop ready to go.
However, for reasons I don't understand, certain people, or peoples, or individuals, or whatever, were unable to effectively communicate with us and we weren't able to do the stuff we needed to do to give away free tickets.
We ended up refunding the money to the sponsors who gave us money for DEFCON tickets. I don't know, bro.
We'll try again next year, I guess
> post photo of girl nails
> IS SHE HOT?
> ARE THEY TRANS?
why cant you people be normal for at least one post
Shoutout to @recogard and @eugenepage_ for the malware campaign. Your campaign has been undetected for a month, that's pretty good
Читать полностью…
This image is double-silly because it features the FUCKING PIECE OF SHIT COPY-MENU WINDOWS 11 WONT KILL.
IM NOT GOING TO RESTART MY COMPUTER. FUCK YOU MICROSOFT
Better hold those farts in buddy, the government is after you. That gas station burrito you purchased? The gas station clerk? He's in the CIA. It's Operation Ass Blast
Читать полностью…
these nerds put in a significant amount of effort to make this as multi-staged and as convoluted as possible. this is 100% AI generated. they left the notes in place. however, based on everything i'm seeing, i think this person probably has a decent understanding of malware and understands how annoying this is
tl;dr not super sophisticated malware, but really fucking annoying
> be me
> get email
> "smelly, is this malware?"
> look inside
> 23,000 line VBS file
Lots of stuff happening with vx-underground at DEFCON
It's all very confusing though because I don't go to conferences, and many of the vx-underground things occurring I was not informed of, or made aware of, or I literally don't even know what it is
So it's just kind of weird when I'm chilling and I'm notified like, VXUNDERGROUND THING HAPPENING AT DEFCON and I just stare at my screen like ?????
Then people message me if I'm at DEFCON and I'm like "nah" and then they're like "omg thank you so much for the goop" and they send me a picture of something I've never seen before, or a picture of someone I've never met in my entire life
I don't care, I just do malware stuff and collect pictures of cats, but it's all very confusing and it hurts my little brain because I don't go outside but apparently I (or my crappy project) is doing many things that I myself didn't know existed
Anyway, yeah I have no idea what's going on, I'm not there, I'm sniffing around the internet looking for goop
I am filled with disappointment.
Last time on Dragon Ball Z, I announced my boredom with malware development, hence I decided to pivot to malware defense. I began by taking apart YARA to understand how it works, and making my own little silly YARA scanner. Whatever.
I then began reviewing the malware people discovered in the wild. I have reviewed hundreds of malwares, and many also non-malwares.
Unfortunately, I am at the point where I am no longer finding original goop. It is the same malware campaigns, different person sending it, different compromised webhosts, or slightly tweaked SHA256 hashes.
I now feel the existential dread my blue team colleagues feel. It is the same gunk everyday. The gunk is persistent. The gunk is infinite and vast. The gunk is like an ocean of gunk.
Someone is DDoSing vx-underground.
This is terrible news. I was going to work on the website, but now all I can do is spend time with my family and enjoy a beautiful summer day
Terrible, this is just plain terrible
Welp, do your thing big dawg, hit me up when you're done
It makes me very happy receiving DMs of malware and people asking "is this goop?".
There is a real-world chance that we can fundamentally corrupt people to begin referring to malware as "goop", and making our entire industry look like a fucking joke
That's so badass omg
Oh yeah? You're a "hacker"? Prove it.
Show me your $600 entry ticket for Slermie Doop 16 and massive collection of cybersecurity vendor merchandise you either received for free or purchased.
You're not a real hacker until you're a walking billboard for tech companies
> get dm
> "someone defaced health institute for czech republic"
> look at website
> indeed they did
> they leave a telegram handle
> dm them
> say hello
> "haha check this out bro"
> adds "smelly" to website
> lists "smelly" as a "crew member"
chat, we are cooked
What I find so impressive though is that this malware has been active on GitHub FOR A YEAR.
Dawg, they're banning security researchers and this malware has been present FOR A YEAR
https://github.com/Alisterscaics185/Crypto-Checker-Seed-Phrases
I really don't want to throw shade at anyone, but it's super confusing, because we had a giant pile of cash from sponsors. We said, "Hello, we would like to use this giant pile of cash". They pretty much said, "Okay, cool, one moment" ... then kind of radio silence.
I assume DEFCON likes money, so I don't know what happened.
Some guy named Dulgex just made this for me and I'm so happy omg this is awesome thank you so much bro
Читать полностью…
Some lady at DEFCON will be sporting vx-underground UWU nails.
What does this mean? I don't know, but I thought it was cool and badass. I wanted to share it.
> be me
> get message from TorGuard owner
> "i found goop" (malware)
> wtf let me see goop (malware)
> sends link
> look inside
> "width-table v0.1.0"
> malicious rust crate
> imported into "Polymarket-5min-bot"
> by "crazygirl437" on GitHub
> code walks directory and uploads files to website
> "checkenv(.)cloud"
> lol its for a rust crate that sets a table width
> image 1
> neat
> hmmmm
> beep boop search
> find X posts
> malware campaign on X
> verified accounts sending link to people
> "crazygirl437/hyper-grid"
> image 2
> more verified accounts posting stuff
> lots of impressions and likes
> image 3
Chat, we've got a full-blown Threat Actor malware campaign right here on Xitter and it is active as we speak (image 4).
Although, it is primarily social engineering work. It is spam, pushed by verified X accounts, that delivers an open-source-malware information stealer.
tl;dr free goop for everyone
Luther Squarepants,
I don't possess the wrist-bands, h3l3n 0f t0r does. I will ask her if she is willing to mail you CIA monitoring technology to your home
This was a very strange DM, but I respect it
If you're at DEFCON this year, there will be vx-underground wrist bands distributed for free.
Yes, this is an ADVERTISEMENT.
Oh, and by the way, these wrist bands were created by the CIA, FBI, NSA and, IRS. They contain a tracking beacon that activates when you fart