40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
Bro, I got a DM from some dude who thinks he infected his computer with malware. He shows me the URL, and imagine my face when it's that fucking super ultra mega rare fuck off ultra malware I was talking about a few days ago (RevStealer).
Hahahahahaha, he says, "should I be worried?"
Fuck yes you should be worried, dawg.
Your credentials, your cookies and sessions, your banking information, all of that shit is gone-gone, like, they are 100%, without a doubt in my soul, going to use your credentials for stuff.
You need to orbital nuke all of your credentials like, yesterday, and kill all of your sessions on all applications.
Anyway, I'm just being silly and trying to be funny, ... but in all seriousness this is a SERIOUS problem and you need to take action immediately. I'm sorry this happened to you.
This super ultra mega rare fuck off ultra malware my colleague sent me has a really fancy schmancy anti-VM feature. It is the fanciest I've seen to date. I like it.
After bonking this goop with a stick, sifting through dummy and decoy data, I figured out how they evaded my VM, RecordedFuture Triage, AnyRun, and VirusTotal.
They made a really fancy entropy thingie by collecting a bunch of data and doing fancy math.
I respect it.
https://gist.github.com/vxunderground/b8accc6e05d956889e0282e1926a6feb
I keep having noobs message me and call me a hacker and ask about computer exploitation
Dawg, I am NOT a hacker, I'm not memeing either.
I can write malware, reverse engineer malware, bonk stuff with sticks. But, if you asked me to move laterally in a network it would take me 6000 hours.
Likewise, I know nothing about web exploitation. I couldn't compromise a website if you gave me the username and password
I'm just stinky malware man, I am not cool and badass hacker man.
A colleague of mine notified me of actual super rare mega fuck off ultra malware identified in the wild.
He said the malware is sophisticated (by my standards) and has proven to be incredibly difficult to reverse engineer. He asked if I felt like trying to bonk it with a stick.
Chat, can I bonk the sophisticated Threat Actor malware with a stick? This malware is believed to originate from a well-known and very active Threat Group, which has posed a significant threat to vendors and consumers, for quite some period of time. Their new malware strain is believed to be augmented by AI, hence improving their malware development lifecycle and introducing enhanced capabilities.
I guess we'll find out later tonight, or tomorrow, when I get a chance to look at it. We'll review it and see if the hype is real, or if it's just malware goop.
I'm a big fan of Windows 11.
One of my favorite features, which really boosts productivity, is the UI crashes (explorer), and whatever UI element was highlighted is now forever stuck in-memory.
"Copy" is stuck in the middle of my screen. I won't go away.
I love it.
> get DM
> "i think i found malware"
> look inside
> fake raonfit (???) website?
> clickfix
> google
> korean fitness stuff?
> check clickfix payload
> powershell script
> downloads rustdesk
> notes present
> ai slop
> all in korean
idk wtf is going on but this is janky af
> get dm
> "i got malwared, me stuff no good"
> ok send
> sends link
> look inside
> python script
> obfuscated with pyarmor
> using trial version
> lolwtf
> bonk with stick
> spits of goop
> getthem-dot-py
> ???
> look inside
> drops stuff called "nig"
> drops xmr miner
> drops more python scripts
> obfuscated with pyarmor (again)
> bonk with stick
> spits out more goop
> over 10 files
> all the files do p much the same stuff
> ???
> use ai slop machine and tools to get original src
> look inside
> repetitive code
> notes in code
> debug print statements
> sniff sniff
> ai slop
Chat, this is yet another Threat Actor using AI to slop up some malware. The only difference is this Threat Actor used professional level tools (although trial version) and put slightly more effort into the C2 and masquerading stuff.
If you'd like to see the source code I've reconstructed (and slightly more verbose writing), see post below this one.
Hello mystery mini-people living inside of my computer. I want to speak into the void. You probably don't care, but I would like to share something with you.
Today I was hit in pee-pee so hard I thought I was going to die. I've been hit in the pee-pee area before, but this was like ... I was completely incapacitated.
I fell to the ground and began screaming like a sissy. I couldn't breath or move for like, 5 minutes probably. I couldn't breath, my stomach hurt for some reason, my pee-pee area was cramping. I don't know, bro. I've never experienced pain like this.
I got up and limped my soft squishy body to bed. I laid down in bed for over an hour and my pee-pee spot still hurt. It was pulsating, kind of swollen.
I ended up going to the hospital and ended up getting told I've got Testicular Contusion with probable soft tissue damage to my string thingies.
Will I die? No. Was it the most painful oof owie I've ever had in my pee-pee spot? Yes.
I'm pretty impressed. The past four malware goopies people sent me were partially AI slop.
Despite them being AI slop, they were still relatively effective and got the job done.
If AI is helping the noobs, imagine how much it's augmenting the actual skilled Threat Actors
this is the malware equivalent of saying check out my website and linking 127.0.0.1
Читать полностью…
As an example, if I search "malware intro", the first page is from CISCO. CISCO writes that there is seven different types of malware.
- Virus
- Worm
- Trojan Virus
- Spyware
- Adware
- Ransomware
- Fileless malware
These definitions are too vague, I think a better explanation (although a little bit trickier...)
- Infector
- Stager
- Module
- Stealer
- Spyware
- Ransomware
- Loader
- Toolkit
However, this doesn't accurately capture the nuance of web based malware or IOT and/or ICS/SCADA malware.
> be me
> sleepin good
> hear wife scream
> ???
> throws open bedroom door
> "I NEED HELP"
> ???
> get up
> run into living room
> baby boy took off diaper
> pooped on floor
> stepped on poop
> poopy foot prints all over house
Found a compromised website with ClickFix that successfully bypasses uBlock. The ClickFix payload uses LOLBINs and uses a WebDAV server. It was promising.
The C2 is dead.
YOU LIED TO ME
Hello, People Living Inside My Computer (PLIMC),
If you're someone who enjoys malware, I have good news.
If you're someone who dislikes malware, I have bad news.
I have uploaded 176,000 malwares and some malware papers. Please download it.
https://vx-underground.org/Updates
Oh, I forgot. One other thing.
I had a few people say I should focus more on news. People said using keywords like "breaking" can improve engagement and potentially bring more people to this social media account.
I appreciate the insight, feedback, and thoughtfulness. However, I am very much ... I don't know the word ... I guess I don't really give a fuck bro. Yes, people and monies and stuff is cool, but I don't want to be a slop account. I'm just going to continue doing what I'm doing.
Malware source code, samples, and papers for free, forever.
Cheers
🍞BAKING 🍞
I had a ton of people ask me about the super cool and badass malware sample my beloved colleague sent me. I also had a ton of people me to share more details on it.
Here are some FAQ:
1. What does it do?
It's an Information Stealer, but it's super fancy
2. Does it have a name?
Yes, as of like, last Tuesday (I have no idea when it was named, I'm just talking shit). It's officially called RevStealer by my peers. There is limited information it at the moment.
3. How long have you been bonking it?
I invested about 4 hours over the time span of a few days, I think. I wish I had more free time for bonkings, but I don't
4. Can you share it?
Yes, I am sharing it now. I'm pushing it to prod now. It's under /Samples/Families/RevStealer. I encourage you to bonk it too. It's really cool and fun to explore. I haven't had enough time to explore it and appreciate it, but I enjoyed it.
5. Can you share hashes?
Initial .zip:
251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d
Stage 1 (packer, stager): d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e
Stage 2 (in-memory payload):
724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc
Decoy (maybe?):
851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4
6. Who is it attributed to?
I have no idea. My colleagues have speculations, but nothing is solid yet.
Pic unrelated (or maybe it is).
> wake up
> take a shit
> get out of bed
> remember colleagues hardcore malware thingie
> download
> look inside
> confused.mp4
> regular .exe, but has .exe inside of it
> bonk with stick
> .exe inside of it is the same .exe
> .exe has itself inside of itself
> only small difference
> cant tell difference
> confusion_intensifies.mp5
> has anti-vm code
> cant get to work in emulation
> written using delphi
> delphi tform GUI thingy
> weird af de-compilation
> 16,000 functions present
> most do basic stuff, like add or subtract
> staticly links a bunch of random libraries
> LOLWTF WHO WROTE THIS
> bonk with really big stick
> eventually find some good goop
> new .exe randomly appears in-memory
> ???
> grab from memory
> c++ .exe, staticly linked
> 500 functions
> heavily obfuscated
> has anti-code tampering in place
> ???
> this in-memory .exe references 1st .exe goop
> ask colleague about goop
> "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor"
I've been bonking this malware with a stick for over an hour, I think, maybe two hours. I've been able to grab an in-memory mapped PE file which the original .exe loads into memory. However, I am unable to determine precisely where this PE file is mapped exactly because it's a Delphi TForm application, its statically linked, and is intentionally obfuscated.
This secondary .exe loaded into memory has tamper protection, patching it to force itself to give me more malware won't be easy. This binary also has anti-VM features as well, I think from calculating disk space. However, I can't tell right now either, but this is what it appears like based on the API it imports.
1. Delphi TForm application
2. Does stuff, lots of junk
3. Maps secondary PE into memory (somehow)
4. Secondary PE does recon to assess the machine
5. ???
Somewhere in the midst of this, this binary is going to make an external call, somewhere, somehow, but it's proven to be difficult due to how obfuscated this code is, coupled with the custom PE cryptor, decoy data present, ... and everything else.
Initially I was under the impression one of the obvious .EXEs I saw was the actual secondary payload, but it's not (I think?), it appears to be a decoy (I think).
I don't know who wrote this, but this is probably one of the most sophisticated malware payloads I've seen in recent time.
It has successfully evaded my VM, RecordedFuture Triage, VirusTotal VM, and AnyRun
I still don't know what this malware is trying to do.
Had a lovely conversation with a Threat Actor from South America.
It turns out, one of the malwares I bonked with a stick was written by someone who follows this social media profile. They confirmed to me in private it was primarily written using ChatGPT.
We had a cool conversation though, last week bro made about $54,000 from his various malware campaigns he spreads on Discord. He was not lying about his "income". Crimes does indeed pay.
He also has a pretty nice computer setup.
We also made small talk about how to illegally immigrate into the United States for as low as $400, problems with money-mules and credit card fraud, and his opinions on other South American countries (he doesn't like Colombia, he says they're not good people).
Overall, bro was pretty chill, despite the large scale identify theft, extortion, money laundering, tax evasion and possibly illegal immigration he does.
It also overlays other UI elements. This is amazing. Look what I see when I open Telegram
Читать полностью…
wtf is this slop
https://gist.github.com/vxunderground/3a6e2376a50acb8259609dfdc55e40dc
more verbose stuff
https://malwaresourcecode.com/home/my-projects/malware-reversing-shorts/2026-07-22-free-ai-goop-malware-source-code
I guess basically what I'm trying to say, if you have testicles, you should not bruise them (contusion). It hurts really, really bad. It will literally ruin your day.
Читать полностью…
Yesterday I was experimenting with using X articles for sharing malware bonkings. People wanted me to be slightly more verbose, primarily out of curiosity.
It was cool. However, for reasons I don't understand, the X algorithm doesn't do much for highlighting articles. I was under the impression they wanted people to write articles. When I used their article thingie my engagement was through the floor.
I don't understand how any of this works.
Regardless, with X articles it isolates the homies on Telegram (they're probably all criminals, I don't know, Telegram nerds are schizos).
Moving forward I'll probably just link to my goofy ass blog. It'll also make it easier for people to find it in the future (if they even care). I'm aiming to make them short, entertaining, and (hopefully) educational.
Thank you to the people who continue to send me free malware. It is cool and badass.
> get dm
> "is this malware?"
> look inside
> malicious libre office macro
> looks funny tho
> raw shellcode
> 2,0,1,187,192,168,45,246
> malware tries connecting to IP address
> 192.168.45.246:443
> malware delivered from a live website
these dumb fucks vibe coded a malware payload and had it connect back to a local ip address. are they actually fucking retarded???
We desperately need someone to update noob malware literature.
The shit for malware noobs looks like it was written in 1995 and by someone who doesn't know shit about malware or how it actually works.
It reads like someone describing swimming who hasn't ever been in a pool
Wait, no. The C2 domain changed and the C2 blocked my IP.
Give me your goopies.
> be me
> havent taken malware inventory in a long time
> lol how much malware do i actually have?
> usually estimate 32,000,000-ish
> look inside
Argus Collection (archived): 24,830
ATM Malware (archived): 285
Bazaar (actively collected): 733,985
Families (retired): 122,888
InTheWild (actively collected): 8,195,377
Malware Analysis (actively collected): 53,746
Malware Ingestion (retired): 7,511,822
OpenSourceMalware (archived): 40
Twitter IOC Collection (archived): 40,324
VirusShare (actively collected): 23,775,600
VirusSign (actively collected): 1,786,542
Total malwares: 42,225,439
Total archives (7z files): 128,786
Total size: 12.9TB (7z ultra compressed)
Time performed collecting malware: 2,618 days
Have you ever accidentally lost 50,000 malwares?
I downloaded 50,000 malwares and I don't know where it went.
No, I'm serious, I actually have no idea where the malware went. I'm confused and scared.
Have you seen my malware?
Administrative update:
1. I am going to begin the process of thanking people for malware submissions and/or papers and/or recommendations. They will be placed somewhere on the website. You can exaggerate yourself on LinkedIn and say you're a collaborator.
2. I have a large volume of malware papers and malwares in queue. It is 175,000 malwares, 20 or so papers. As is tradition, malware analysis will be coupled with the papers too. That is expanded every month as new material comes in.
3. I have no plans to resurrect the virus exchange for the time being, unless someone (preferably a large company) is willing to bank roll the entire thing. I can provide the malware goopies, but computers are expensive.
4. Per request from OG vx-underground nerds, in more serious posts discussing technical topics, I will drop the silly cats and instead revive the classic edgy vx-underground dark. I will introduce a balance between seriousness, and edgy Hot Topic Goth, and generate kitty cat stuff.
Thank you everyone for the love and support. I see your messages and e-mails. I am enjoying the summer with my son and family, so I am simply less inside at the moment. I will (hopefully) do more malwares soon.