40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
I tried to do a write-up on X and share some de-obfuscated malware source code
I kept getting notifications on X saying something like, "sorry—something has gone wrong, don't fret", blah blah blah.
If I removed the malcode it worked
I THOUGHT THIS WAS AMERICA
Chat, I don't want to jump to conclusions, but I have a sneaking suspicion this malware stager was vibe coded. Historically, malware hasn't left extremely descriptive comments in their stagers.
Читать полностью…
oh sorry
if youre a threat intel nerd, or anti malware nerd, who is designated to track potential state sponsored activity in south america
final payload: 5a979c309aff96456ba4482653fc213997387956c24e376645e4e0cfaa6b878a
obfuscated js payload (fragmented utf16le):
87eac5fa290387bd90d71424f8a65f2b2c7436a415f6e7f033915ef8e833ef86
file sent to colombia ppl i guess idk:
193b98595f44935e79413aeb474cd8d75e8d5ba63caf0d52470cadbeb8139c03
theyre all on VT now
this is the guy calling you the N word on discord
Читать полностью…
Okay, I'm going to bed now.
Goodnight people on X
Goodnight people on Telegram
Goodnight FBI
Goodnight NSA
Goodnight CIA
Goodnight Israel spyware
Goodnight ads tracking me
Goodnight AI scrapers
Mwah kisses
xoxo
original payload:
https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8
My deepest condolences to my colleagues in Venezuela and those impacted by the recent earthquakes.
I wish I had more to offer other than words. I hope you're all doing well and I hope you're all safe.
I've almost reverse engineered the SmartLoader obfuscated code all the way down to a working source code
You can't hide behind Prometheus you little bitch
439,000 people on X and 50,000 on Telegram, almost 500,000, whatever. Close enough.
Читать полностью…
inb4 "nah its just because of that oddly specific song he released, its just a meme"
Читать полностью…
If she goes on to say in the next couple of posts Barack Obama was created in a CIA test tube and Donald Trump is being controlled from nanobots then this lady might be onto something, I don't know
Читать полностью…
Chat, someone sent me a message. It has a very silly payload.
I cannot figure out this Lua code. I hate obfuscated Lua. Look at this fucking piece of shit (warning: is a piece of shit).
https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8
Literally shaking, screaming, crying, throwing up right now. I thought I found a silly malware loader, but the person who wrote this bamboozled themselves.
Their obfuscation toolkit failed somewhere, and Windows WScript can't parse the VBS correctly, resulting in it imploding into itself.
It could have given me more free malware, instead this goof ball didn't test his malware (testing is for nerds, I can't blame them).
I think they may have copied the obfuscation definition thingies at the top too many times, but I don't feel like unironically debugging their obfuscated malicious VBS code to make it work, that is ridiculous.
Anyway, look at this piece of shit:
https://gist.github.com/vxunderground/dc225d9180d8da7285e911372f99c527
Oh, Discord and Epic games ran some promotion where Epic games gave you Discord Nitro if you were new to Epic Games. This code automated the process. Spammers used it to harvest Discord Nitro codes and then sell them online.
Читать полностью…
> get more dms
> more free malware
> yay
> "smelly someone says this cheat src code is malware"
> download
> look inside
> visual studio prebuild event builds vbs script
> vbs script decrypts .ps1 script
> downloads RAT
> contains link to a YT video
https://www.youtube.com/watch?v=akoxddx6lgc
> get dm
> "government ppl in Colombia getting weird file"
> lolwtf
> send link
> look inside
> phishing page (looks good tho tbh)
> image 1
> i dont speak spanish, idk wtf it says
> look inside .html
> .zip hidden inside it as base64
> lol ok
> bonk with stick
> "Oficio 2231" zip file
> idk what that means still
> look inside
> .zip has .js inside of it
> look inside
> big ass fuck off obfuscated bs trying to trick u
> image 2
> utf16 bullshit
> utf16 makes another file
> ???
> extract from tiny little fragments of js
> look inside
> .dll .net file
> wtf lol
> look inside
> heavily obfuscated .net malware
> image 3
> tiny .js fragments contain powershell script
> ???
tl;dr
.html does something that triggers .js which extracts .zip. the .js from .html executes the .js inside the .zip which reads the .ps script from the .js. the .ps then executes a c# .dll which is named taskscheduler (its malware)
why would someone send government officials in Colombia this file wtf lol
Oh, I forgot
Goodnight Chinese espionage campaigns residing in United States critical infrastructure believed to be aggregating and collecting intelligence on United States citizens
Mwah
> get dm
> "hey smelly, i work for (kind of important place)"
> "vendor sent us weird file, its sus af"
> "what do u think?"
> download file
> look inside
> ultra mega fuck off malware
> pe position independent .code is set to RWX
> multiple extra sections
> extracts .bss segment
> .bss has .exe inside it
> .exe ASPack 2 compressed
> emulate
> has anti-vm features
> pulls .bat from c2 to self-delete
> still bonking
my brother in christ, if your company ran this .exe from this vendor, you better call someone ASAP because your company is COOKED. also, this vendor is either a criminal enterprise or compromised. gl big dawg. happy monday
> be SmartLoader
> big ass fuck off malware campaign
> tracked by dozens of anti malware companies
> heavily obfuscated lua
> bamboozles everyone
> me jimmies rustled
> team up with roblox cheater nerd
> reverse engineer it back to src
> (almost done)
https://gist.github.com/vxunderground/aaa6a88823afc83b4f8a73366694966d
I'm sorry, SmartLoader malware campaign, I shouldn't have called you a little bitch. That is very rude of me.
I am just passionate and have spent some time working on it, so my emotions are high.
I love you.
Chat, we are cooking.
Previously on Dragon Ball Z, someone DM'd me a spoopy GitHub they found. They asked if it was malware. It was malware.
The GitHub contained HEAVILY obfuscated Lua. The malware payload is using Prometheus Obfuscator.
Upon review, it was determined this malware is SmartLoader. SmartLoader is a malware campaign heavily associated with Rhadamanthys Stealer and StealC Stealer.
SmartLoader is relatively new and is being tracked by AhnLabs, TrendMicro, Hexastrike, McAfee, and the GitHub security team. It first emerged around March, 2024.
SmartLoader is pretty sophisticated. It is multi-staged, uses Polygon Smart Contracts for C2 information retrieval, and despite being Lua, it is also makes usage of NTDLL makes low-level WINAPI function invocations. One interesting attribute also is it programmatically inflates or deflates its file size for pseudo-polymorphism. This is extremely cool.
I mention this, and the whole cookin' thing, because after I made a post complaining about the obfuscated Lua, a very, very, very gifted person in Lua obfuscation and de-obfuscation contacted me and successfully deobfuscated it. I don't know if they want credit or not, because they're so cool and badass, but they're extremely famous in the Roblox hacking scene.
Anyway, the de-obfuscation is so precise it borders on having the actual source code to SmartLoader. I am very happy. I will share it when I am not dealing with my baby.
"HoW CaN yOu bE aN eXpErT iF yoU rAn maLwaRe oN YouR PC???"
It's very shrimple.
1. I'm comfortable admitting my mistakes publicly in front of hundreds of thousands of people. If I make a mistake, small or catastrophic, I will admit it. I feel comfortable with my skill set. I open myself to criticism from everyone. No, obviously it does not feel good being called "retarded", "jackass", "skid", "moron", etc by people, but it is what it is. If I do not open myself to criticism I will not improve. My success and failure also demonstrates what to do and what not to do. But seriously, sometimes I read some of these comments and I'm like, "dayum, theyre cookin me fr"
2. I am desensitized to malware. I am around it nonstop (writing, collecting, reversing) so I do things in a way I would not advise someone else to do. I feel comfortable doing really dangerous things with malware because I am familiar with how they work. Additionally, in the spirit of full-disclosure, sometimes I don't like dealing with VMs because I feel like they slow me down.
video: when i make a mistake in front of 500,000 people and get called a retard by a bunch of ppl
> be United States government
> 1985
> have a bunch of people they want arrested
> idea.jpeg
> make fake company
> Flagship International Sports Television
> send invites to a bunch of people
> tickets to Washington Redskins FOR FREE!!!
> name it Operation Flagship
> mail tickets
> now_we_wait.mp4
> over 100 people show up for free tickets
> arrest them
> ez gg get rekt nerd
> pause
> fast forward
> 2026
> Drake doing concert tour thingy
> free tickets for women named "Janice"
> only in specific cities at specific times
> when Janice arrives must show government id
> Janice must be their legal first name
Probably not a United States government operation trying to identify and locate a fugitive or person they label an enemy of the United States. It is probably Drake just being silly and meme-y and wanting to ONLY INVITE women named Janice in New York, Los Angeles, Miami, Toronto, or Houston because of that oddly specific "Janice STFU" song he released previously this year.
Holy shit, the homeless guy outside the gas station literally said the same thing to me last week
Читать полностью…
> "hey smelly check out nmssaveeditor(.)com"
> no mans save editor?
> AI generated website?
> "downloaded file is password protected"
> "password is goatfungus"
> lolwtf
> download file
> .zip protected with goatfungus
> extract with the power of goatfungus
> .msi installer file
> look inside
> random generated file names
> look inside silly names
> random ass goopie file (encrypted file)
> obfuscated .vbs file
> big ass fuck off .exe
> mystery java file
> big ass fuck off javascript file
> ???
> deobfuscate vbs file
> runs big ass fuck off .exe
> bonk .exe
> no idea wtf this thing is
> node.js, but weird, weird stuff, bonk with big stick
> not normal node.js .exe
> brain confused
> emulate
> emulate fails, .exe has anti-vm stuff
> wtf is this shit? all for no mans sky?
> get big stick and manually carve out weird .js
> super obfuscated goop
> WTF AM I LOOKING AT
> yara rule match
> GACHI LOADER AND KIDKADI LOADER
> double check
> perfect match
> original research from eversinc33 and JaromirHorejsi
> ihbnibYYhwenfw!!2345glerp schmmermies
> RHAD STEALER
> NEXE
This thing is a bitch. You're both heroes for bonking this with a stick and saving me a lot of time and energy.
pic unrelated
I love when I meet nerds with who are deep in the trenches in esoteric concepts in esoteric things
I met a guy who has dedicated the past couple years of his life to Batch file obfuscation and deobfuscation
He has completely lost his mind. I like it. I respect it.
Someone sent me a file and it's confusing my little brain. It was a .exe and I disassembled it back to approx. source.
This code programmatically makes Epic games accounts and uses it to get Discord nitro somehow? I don't understand.
https://gist.github.com/vxunderground/4616b6249dc47a87647b746882652687
WHO WROTE THIS GHOST LAUNCHER THINGIE
I know you're somewhere on this Telegram, or the COM, or something. There is no way you're not hanging around here somewhere. I demand to know what AI agent was used and why you decided to targets gamers