40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
> get another email
> "hello, my name is ___, some hacker got into my email, idk how. im really sorry about the n word stuff"
> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "I lost the goop... but I found a weird file on my computer"
> sends file
> malware log file
> ???
> examine log
> lots of debug information
> lmfao wtf
> see discord web hooks, hardcoded steam api key
> ???
> no identifiers really on VT
> beep boop search internet
> find the same steam api key in threat zone
> see a SHA256 hash
> look up on VT
> first seen june, 2026
> hmmm
> download file (hehe asked a friend)
> look inside file
> electron js malware
> heavily obfuscated
> skim file for anything that stands out
> references VirusTotal VM BlackList on GitHub
> lol ok
> clear text c2
> url inside referencing their Telegram
> ???
> go to their Telegram
> everything visible
> cite their Discord
> ???
> showing all their aliases
> showing draining crypto wallets
> showing stealing roblox items
> stealing counter strike items
> shows stealing emails, social media, credit cards
> shows when they started
wtf are you actually doing bro? youve documented EVERYTHING and handed it over in plain text. are you out of your mind???
> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "I purchased some car diagnostic software for my car. I bought it from a local shop near me. The software it came with was immediately flagged as malware"
> lol wtf?
> skeptical
> give the files plz
> he gives me files
> look inside
> ITS GOOP
> ????
> why did local car place give malware???
> look inside
> old malware, from a dead 2024 malware campaign
> malware masqueraded as car diagnostic software
> malware servers are long gone and dead
What the actual fuck?
ShinyHunters extortion group compromised the Florida Department of Motor Vehicles and as proof of their compromise they leaked Jeffrey Epstein's Drivers License and records
Читать полностью…
Today I decided to check in on the President of the United States and see what he's doing on social media on Truth Social
I opened the website and this is the first ad I see. Arguably one of the greatest ads of all time, could be hall of fame, I don't know
I looked at this goop masquerading as the Israel government. I don't know anything about Israeli stuff, so maybe someone can provide context on what these Threat Actors are trying to achieve.
> israel[.]gov[.]2026[.]vercel[.]app
> domain still live, don't shoot yourself in the foot
> all in hebrew
> fake cloudflare icon
> downloads .vbs file when visiting site
> govilreshet26.vbs
> a074eba155b982fdb821e8a641f6a061505d46d6cc65de031202a4ce29d486fa
> first noted 19 hours ago
> heavily obfuscated
> requests to runas admin
> checks for virtual machines (anti-reverse engineering)
> checks for every AV on the planet earth
> downloads screenconnect (remote desktop software)
> downloads from 130.12.115.24
> IP is small hosting provider in Canada
> clean IP
> clears everything in event viewer
> clears all windows defender logs
> downloads bs file from USA IRS (???)
I don't understand what this is targeting, what it's trying to achieve, or what reshet26 means in this context.
After seeing radioactivered yap online about radioactive goop so much, I've decided I am going to begin purchasing radioactive goop.
I know nothing about nuclear goop, or radiation goop, but it is interesting.
Now my home will be filled with malware and radioactive material
I got some interesting goop (malware).
To make a long story short, it is goop that is targeting the Israeli government "network 26"? (I legitimately have no idea what that means)
The domain is in Hebrew, it automates clickfix, and delivers a payload which is in Hebrew
It's so weird when I openly discuss my Benzodiazepine dependency and people say I'm "brave" for discussing it openly and admitting it
Bro, it's not embarrassing and it's nothing to be ashamed of.
Read the comments on the posts, EVERYONE knows SOMEONE who is addicted to something, or was addicted to something.
As much as I hate to say this, I'd argue drug addiction is probably the most common disease in the United States, possibly the planet, and for some reason people act like it's taboo or something.
Out of the thousands of comments I've received (or DMs or emails), I've only seen like ... three? Nasty comments or remarks. The rest are positive, people sharing their experiences, or people sharing their experience with loved ones who suffered from addiction.
It happens, man. It's all good. Focus on goop and silly cat pictures.
Trying to taper off Benzodiazepine update:
It fucking sucks. It sucks ass so much. I read so many comments from fellow benzo addicts who told me it sucked ass.
I breezed threw the first 75% like nothing. I thought, "well, it's different for everyone, maybe literally everyone on the planet is wrong and mine won't be bad". It turns out, everyone on the planet was right and I was wrong (unsurprisingly).
This last quarter is hell on earth. I'm doing it with an addiction specialist, so I'm not going to die, I don't have any psychological symptoms, but the mental anguish my CNS is going through is unbelievable (anxiety, irritability, confusion, insomnia).
Dude, if you're a younger person and someone offers you Xanax, or Klonopin, or Valium, whatever, don't fuck with it bro. If your doctor offers it, don't stay on it for more than 30 days. Don't fuck around with this shit bro, I'm being so dead ass serious.
At my current pace, I don't think I'll be clean from Benzos until sometime in 2027 bro. It's the absolute worst. Benzos are so fucking bad bro.
If you're addicted or dependent on Benzos like I was, you can do it dawg, you can push through and get off the drugs (which I'm currently doing), but you need to lock the fuck in and prepare for some extreme irritability, anxiety, insomnia, and mild memory fuzziness and confusion.
Anyway, that's my lore update. I know many of you people living inside my computer ask for updates, I am unironically some people's test dummy because they're afraid to try quitting. Don't be afraid. You can do it.
Ok, talk to you later, love you, xoxo
I kind of want to try making some really ghetto 60 second clips explaining goop analysis.
Pretty much like, what I write online with ">" stuff but with silly pictures of cats, basic animations, explosions, just really short and simple.
This is really exciting malware actually.
tl;dr they're updating their goop as I poke the goop with a stick
They're also using ETH Smart Contracts got C2 resolution, except this malware campaign is LIVE. They updated their goop ETH C2 stuff .... 1 hour ago as of this writing.
The IP address it resolves to was detected as being malicious ... today. This girlie is alive-alive. These malware developers are cooking and spearphishing nerds trying to get interviews at Nike and stuff
They're currently masquerading as Babel on NPM.
This is an active campaign SocketSecurity described as DEV#POPPER
New malware IP as of ... literally this exact writing, these nerds are working as I'm typing:
193.247.144.38
> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "I got invited to a job interview, to make a long story short the project they asked me to work on I think was malware... interested in looking?"
> look inside
> its malware
FAKE JOB INTERVIEW GOOP?!
tl;dr strange, strange, strange goop targeting trucking companies in the United States, too much to type so used silly pictures
> be me
> get dm
> "smelly i found goop"
> wtf i love goop (malware)
> "I'm a SOC analyst for a large trucking carrier. Several of our carriers have been sent some malware. We asked a third party cybersecurity company to review the malware, they said they'll need time to download it and run code directly to memory"
> ???
> downloads masqueraded vbs
> vbs supposed to tell truckers their schedule
> supposed to say what theyre hauling and stuff
> wtf lol
> look inside
too much to write actually, just look at funny pictures
Masqueraded file:
Stage 0 (Masquerading domain):
carrierpackready(.)com
Stage 1 VBS:
d26be4bef5afbebc9a831ee00bdf0fd2f5e57e86eb8e89a0b57c9534352f3cdf
Stage 2 JS:
72a5f71233cbe244048e335aad829570f5aba2b72a8e346544ae9fd327c321ea
Contract:
0xfb9B234CdcE6dd9E0Eb4895b5682eBebE0b3D277
0xCc4BCd51e0eA7E254b0F30044538F6Cb86a4E61b
Contract Creator:
0xBA8B70D5B15cFbFD628F71560aAb996356c0fa84
Drop-dead-resolved C2:
do(.)opinionvip(.)club
amc-us(.)mprevive(.)com
play(.)app-open(.)click
api-wls(.)ngrok(.)app
main-tunnel(.)ngrok(.)io
tl;dr malware developers pissed off some big ass corpo and now big ass corpo is bonking them back, but because i discussed their goop before big ass corpo bonked them back they think the weird cat guy some how magically is capable of bonking them back
I DIDNT DO FUCKING SHIT
> get dm on telegram
> forget to reply
> check vxug email today
> 3,200+ emails
> all different emails
> all compromised emails
> all calling me the n word
> asking to reply on telegram
Chat, I'm no doctor, but I think this person wants me to reply
> ask ChatGPT what it knows about me
> lists stuff
> "You demonstrate a passive interest in Windows vulnerability research, although you've never found an exploit of your own"
Ok I said tell me what you know not hurt my feelings damn bitch
This information was first seen on social media via DarkWebInformer.
Full credit to them for seeing the post and sharing the photograph on social media.
Are you nerves dying from diabetes? Have you tried wrapping your feet in lettuce? The doctors won't tell you the secret lettuce technique, but it's 100% real and true
Читать полностью…
Had to change some wording, some people thought this was malware written by the Israel government.
This malware is masquerading as an Israel government domain to try to convince people to execute a goop (malware) payload.
Then I saw I could purchase other weird goop like Mercury, Cesium, and Europium, I said "wtf I want weird sounding stuff in my house".
I'm already on a bunch of lists (probably) for the malware goop, what's the problem with being on a list for weird chemical goop?
The split second I made this post I got DMs being like, "ERRR SCHMEEELY, WHAT IF ITS JEWISH PROPAGANDFFA?"
You'd be surprised I found goop swinging on Israel? Really? If anything, I'm surprised I don't see more of it.
I'm already seeing people being like "SHEEEMEEELI, LEAVE THIS GOOP ALONE"
Oh, so NOW we don't like goop? I LIKE ALL GOOP.
Good news for malware enthusiasts, another 200,000+ malwares have been uploaded to VXUG.
Good news for people who like silly pictures of cats, I've attached one to this post
Couldn't brain good when writing this, said bro 9000 times
Читать полностью…
I'm not really interested in content creation, but I've never done it before and it seems kind of fun to try something new
Читать полностью…
DEV#POPPER, big fan of how you encode the URL and say "helloipbot!!" in your ETH goop, I think it's clever, I like it. Not even memeing, it made me giggle
Читать полностью…
to clarify, the interview appeared to be for Nike, they sent a project over which looked like it would be to work on a Nike front-end solution e-commerce thingie, but the solution thingie loaded malware
Читать полностью…
I have no idea why someone would want to try to compromise trucking companies that do logistics, delivering food and stuff, super weird
Читать полностью…
Someone is DDoSing vx-underground.
I am unsure why someone would want to take the malware library offline.
Unfortunately, because the website is offline, I can no longer work. All I can do now is eat this delicious ham and cheese sandwich and watch anime.
> Last time on Dragon Ball Z
> be me
> get DM
> "smelly i found goop"
> wtf i love goop (malware)
> download
> look inside
> malware masquerading as Pokemon Map Loader
> bonk bonk
> installer -> nodejs goop -> java goop
> java obfuscated with qProtect 2.0
> annoying
> uses ethereum something-something for C2 stuff
> make some posts
> say campaign is dead (c2 from eth stuff is dead)
> annoying
> get DM
> "Hey Smelly, I'm REDACTED with REDACTED. That malware campaign you're describing is REDACTED. You're free to post as you please, but I would appreciate if you didn't mention REDACTED because REDACTED"
> ok nbd, idc, i wont mention some stuff
> go on about business
> forget
> get DM
> "Hey Smelly, REDACTED from REDACTED again, recently we REDACTED. I need to advise you that the Threat Group REDACTED believes you're the one REDACTED because you were discussing their malware on X"