40629
The largest collection of malware source, samples, and papers on the internet. Password: infected https://vx-underground.org/
Hi
I've uploaded another 150,000 malwares to the internet. I haven't pushed the update file yet, but the malware is there for you to download and enjoy.
If you need anything please contact me secretary (homeless guy at the gas station)
Cheers,
Pic unrelated
Department of Homeland Security been REALLLLLLL quiet ever since they took down that anime streaming website.
What are you hiding?
Okay, maybe I'm a little annoyed, I'm sorry. Please excuse my language. I'm hungry and tired.
Читать полностью…
> check twitter
> account locked
> ???
> DMCA takedown request
> ???
> click see post
> rockstar games compromise post
> shows GTA 6 testing footage
> 8:51 AM · Sep 19, 2022
you fucking assholes hit me with a DMCA takedown request on a video from 2022? seriously?
fr tho bro, if youre going to commit crime, launder money, whatever, dont show ur face on discord calls or flex bro, cmon man
Читать полностью…
I know I probably shouldn't tell someone who committed a felony to relax, but let's be real here, bro. FBI agents are paid like shit and they're dealing with serious problems, Schlunko McSchmeeSchmee isn't even on their radar. They probably don't even feel like doing the paperwork, some agent probably saw it, said "heh", and went back to some case where someone is laundering $10,000,000 of Bitcoin
How much money was stolen? What? Like $700? The FBI doesn't even look at you until you've done somewhere between $100,000 - $1,000,000. It costs them $200/hr for the attorneys alone, not to mention the man hours to talk to Steam, do the court paperwork, subpoena people, determine which field office is going to handle.
I don't know bro, whatever
Also, apparently Meccha Chameleon people follow me on Telegram.
Hello MecchaChameleon malware people living inside my computer,
I think overall your strategy of using a malicious custom map thingie was cool and probably yielded moderate success. I don't think your intention was being like, 100,000 infected machines, but I suspect you got enough infected machines to be happy. People wrote you were using PureRAT, whether or not that is true, I don't know, YARA rules for flagging can be iffy.
But, when I was reverse engineering your C# payload (which I think you attempted to obfuscate?) I saw the weird dependency you used for remote access to machines. I can't remember what it was now, I deleted your goopies off my machine, but I saw it as an embedded resource next to PAYLOAD_ULTRA_MEGA_FUCK_OFF.zip which you decrypted and loaded as a raw assembly. Maybe that raw assembly you loaded was PureRAT? Or was it the stager? I don't know.
Obviously we've been this a million times before with other video games (malicious mods), but seeing it in something obscure was a nice surprise. Your advertisement, or demo, or whatever, you showed was not an RCE. An RCE would require ... remote code execution. This is really fancy payload smuggling.
Anyway, it's obvious your staging was vibe coded. It was pretty easy to reverse engineer. I think you had the right idea on how to go about things, but between the segments being in order (1 - 66), the obvious embedded payload in the 2nd stager, and the really loud BATCH files, it wasn't going to go very far.
Thanks for the goopies though, it was chill.
Cheers,
(pic unrelated)
The reason many of you are seeing me discuss malware reverse engineering lately is because I've temporarily shifted my focus to malware defense, rather offense.
A majority of my life, and goop with malware, has been malware development. I love writing malware. However, the past couple of months-ish I felt kind of bored with malware development. I was just kind of burned out.
From the recommendations of the people living inside my computer, I decided to shift to malware defense. If anyone remembers, I spent awhile studying the internals of YARA and built my own YARA scanner thingie.
Anyway, it's been a lot of fun bonking malware with a stick. It's given me better perspective on what does, and what does not, work offensively.
Thank you everyone for giving me malware you find in the wild. It is better to bonk random malware, versus malware already bonked, because there is no "cheat sheet" of someone else's research or notes. I'm going in completely blind and it's fun.
> get dm
> "hey smelly look at this"
> sends link
> look inside
> torrent website
> The Odyssey 2160pHD (2026) ENGSubs EZTV
> look closer
> "The Odyssey 2160pHD (2026) ENGSubs EZTV.exe"
> 147 seeds
bro knows ball, this is a 2002 limewire classic
Bro, I got a DM from some dude who thinks he infected his computer with malware. He shows me the URL, and imagine my face when it's that fucking super ultra mega rare fuck off ultra malware I was talking about a few days ago (RevStealer).
Hahahahahaha, he says, "should I be worried?"
Fuck yes you should be worried, dawg.
Your credentials, your cookies and sessions, your banking information, all of that shit is gone-gone, like, they are 100%, without a doubt in my soul, going to use your credentials for stuff.
You need to orbital nuke all of your credentials like, yesterday, and kill all of your sessions on all applications.
Anyway, I'm just being silly and trying to be funny, ... but in all seriousness this is a SERIOUS problem and you need to take action immediately. I'm sorry this happened to you.
This super ultra mega rare fuck off ultra malware my colleague sent me has a really fancy schmancy anti-VM feature. It is the fanciest I've seen to date. I like it.
After bonking this goop with a stick, sifting through dummy and decoy data, I figured out how they evaded my VM, RecordedFuture Triage, AnyRun, and VirusTotal.
They made a really fancy entropy thingie by collecting a bunch of data and doing fancy math.
I respect it.
https://gist.github.com/vxunderground/b8accc6e05d956889e0282e1926a6feb
I keep having noobs message me and call me a hacker and ask about computer exploitation
Dawg, I am NOT a hacker, I'm not memeing either.
I can write malware, reverse engineer malware, bonk stuff with sticks. But, if you asked me to move laterally in a network it would take me 6000 hours.
Likewise, I know nothing about web exploitation. I couldn't compromise a website if you gave me the username and password
I'm just stinky malware man, I am not cool and badass hacker man.
A colleague of mine notified me of actual super rare mega fuck off ultra malware identified in the wild.
He said the malware is sophisticated (by my standards) and has proven to be incredibly difficult to reverse engineer. He asked if I felt like trying to bonk it with a stick.
Chat, can I bonk the sophisticated Threat Actor malware with a stick? This malware is believed to originate from a well-known and very active Threat Group, which has posed a significant threat to vendors and consumers, for quite some period of time. Their new malware strain is believed to be augmented by AI, hence improving their malware development lifecycle and introducing enhanced capabilities.
I guess we'll find out later tonight, or tomorrow, when I get a chance to look at it. We'll review it and see if the hype is real, or if it's just malware goop.
I'm a big fan of Windows 11.
One of my favorite features, which really boosts productivity, is the UI crashes (explorer), and whatever UI element was highlighted is now forever stuck in-memory.
"Copy" is stuck in the middle of my screen. I won't go away.
I love it.
I saw some meme on social media talking about the first SAW film and September 11th.
I thought it was a meme, but it's dead ass real. At the 57:20 mark one of the actors pulls out a cell phone prop that displays September 10th, 2001
tl;dr big day tomorrow in the SAW universe
> download weird .exe
> accidentally run it
> disappears in the void
Marek, you goofy son of a bitch, with your goofy ass man-bun and bullshit risk compliance job, it isn't AI generated footage you lying little bitch.
If you're going to file a DMCA takedown request, you should write it's because RockStar games was compromised by an autistic teenager in the UK who social engineered HelpDesk support from an Amazon FireStick in a hotel room
I obviously can't file a counter claim, I'm a stinky nerd and you're representing a multi-billion dollar company, but I want you to know that you're a pussy and nobody at your job respects you
Have a nice day
My wife and I frequently yell "HELP!" when we need help with the baby.
He is 17 months and he is crazy.
The good news is that he has suddenly began screaming "HELP" in public with zero context.
It's fun holding a baby and he screams "HELP!" around a bunch of strangers.
Could they be anymore vague? Do you have any idea how many images are posted online? What is this post even supposed to mean?
Читать полностью…
> check social media
> internation cyber news digest posts
> doxes some kid
> nice broccoli haircut tho
> nerd allegedly part of meccha chamelon thingie
> worker or smthn, idfk
> shows discord cam thingie
> records his face
> idk why
> flexes $50,000
> idk why
Dawg, I don't want to sound like a hater, but you need to CHILL OUT.
Your goopies just got attention because it was video game goop. This isn't like, CL0P ransomware group extorting the United States government for $50,000,000 because of a 0day exploit they had.
You're NOT FBI most wanted, bro. They're worried about big malware campaigns. The internet has crypto-drainers bringing in $100,000/month, CSAM all over TOR, large-scale botnets wreaking havoc on home users, businesses, and critical infrastructure, and they're also dealing with state-sponsored Threat Groups which are enemies of the United States.
You popping 50 people from Schlunko McSchmeeSchmee on Steam isn't going to make Kash Patel call the President of the United States and say you're El Chapo 2.0. This only got attention because it was on Steam
Gosh dang, bro. Relax. Half these fucking people on social media talking about it unironically spend a majority of their day scrolling TikTok and arguing in the comment section on YouTube videos. It's not that deep, bro.
Everyone on X was yapping about this Meccha Chameleon malware thingie. Internet nerds have been doing some internet detective research trying to find out who did it (I have no idea why, it was a relatively small malware campaign, there is much more dangerous malware than this).
Anyway, I bonked it with a stick.
> everyone yappin about this
> look inside
> goofy ahh batch file
> http downloads from ip address
> http? not https? what year is it?
> steamb.bat
> more ghetto batch files
> not obfuscated
> ok thanks i guess idk
> more http downloads
> makes fake microsoft security center folder
> ???
> downloads auto hot key script
> notes present
> AI GENERATED TRASH
> aes256 encrypted data blob
> fragmented
> all parts are labeled (part 1 - part 66)
> aes256 iv and key labeled
> ??? WHO IS THIS FOOLING BRO
> image 1
> make goopy python script
> add p1 - p66 together
> decrypt with documented aes256 keys
> lmfao wtf
> makes .exe
> look at .exe
> .NET c# goop
> first line of code
> EXTRACT PAYLOAD FROM RESOURCE SECTION
> ???
> encrypted, but encryption goopies still there
> image 2
> extract goopies
> another .exe
> slight attempt and obfuscation
> lol crypto stealer (image 3)
> other goop that looks like for RAT
SHA256: dc9a2f090f8d7ba31e1195573bbb5b1f0891f3b3722d8ad4c159f2519b1cb5b0
> free time today
> what was bro doing with a torrent movie .exe
> download
> 1gb .exe
> lmfao binary inflation
> bonk bonk
> remove junk
> deflate binary
> 500kb
> bonk bonk
> no imports
> crt stripped
> position independent
> checks language
> kills self if in belarus or russia
> runs 2000 random functions in random order
> trying to stall to evade VMs
> decrypts .exe from inside itself
> runs mystery .exe in memory
> .exe steals goop off machine
> bonk bonk
> yara flags as lumma stealer
overall this wasnt the greatest goop ive ever seen, but i was a big fan of free_movie.exe. its a certified limewire 2002 classic.
inflated binary:
e25ae92b95809ee42f61810a0253ead29b3a6aa8adf91f785c80c9bec5f38bd8
stripped binary:
732d7a945163a3f31eae25028562bd5d9a352c31eb90c777042bceeeb1c6b3ec
in-memory payload (partially reconstructed):
3e561eecde0071766626d80d6ce3cf1626fb2dbed0ef437948f622c283a0e91e
c2:
overcjo(.)cyou
betavmt(.)cyou
hiatuft(.)cyou
auditva(.)cyou
In all seriousness seriousness, you should do this anyway whenever you accidentally malware your computer. This isn't exclusive to this malware.
Unless you don't care some stinky nerd somewhere has all your credentials, if you don't care then whatever, do your thing
🍞BAKING 🍞
I had a ton of people ask me about the super cool and badass malware sample my beloved colleague sent me. I also had a ton of people me to share more details on it.
Here are some FAQ:
1. What does it do?
It's an Information Stealer, but it's super fancy
2. Does it have a name?
Yes, as of like, last Tuesday (I have no idea when it was named, I'm just talking shit). It's officially called RevStealer by my peers. There is limited information it at the moment.
3. How long have you been bonking it?
I invested about 4 hours over the time span of a few days, I think. I wish I had more free time for bonkings, but I don't
4. Can you share it?
Yes, I am sharing it now. I'm pushing it to prod now. It's under /Samples/Families/RevStealer. I encourage you to bonk it too. It's really cool and fun to explore. I haven't had enough time to explore it and appreciate it, but I enjoyed it.
5. Can you share hashes?
Initial .zip:
251aa2b0831d88a6f796bb6ca01d0242c11476b2fc6a5baa3f9c64a9134cd61d
Stage 1 (packer, stager): d23b9609b06ab23243543ee0d8ff0d4c1966530576fa37bb2ecde97309ebbc9e
Stage 2 (in-memory payload):
724b400afcec2064a3477abd9a117103abfb51f7f7c8acd9c429fcdabd656ffc
Decoy (maybe?):
851383fb22dcb1d16367839178271eef6504199b8ca60405e1698879696e49d4
6. Who is it attributed to?
I have no idea. My colleagues have speculations, but nothing is solid yet.
Pic unrelated (or maybe it is).
> wake up
> take a shit
> get out of bed
> remember colleagues hardcore malware thingie
> download
> look inside
> confused.mp4
> regular .exe, but has .exe inside of it
> bonk with stick
> .exe inside of it is the same .exe
> .exe has itself inside of itself
> only small difference
> cant tell difference
> confusion_intensifies.mp5
> has anti-vm code
> cant get to work in emulation
> written using delphi
> delphi tform GUI thingy
> weird af de-compilation
> 16,000 functions present
> most do basic stuff, like add or subtract
> staticly links a bunch of random libraries
> LOLWTF WHO WROTE THIS
> bonk with really big stick
> eventually find some good goop
> new .exe randomly appears in-memory
> ???
> grab from memory
> c++ .exe, staticly linked
> 500 functions
> heavily obfuscated
> has anti-code tampering in place
> ???
> this in-memory .exe references 1st .exe goop
> ask colleague about goop
> "We discovered this Threat Actor likely created their own custom .exe encryptor and decryptor"
I've been bonking this malware with a stick for over an hour, I think, maybe two hours. I've been able to grab an in-memory mapped PE file which the original .exe loads into memory. However, I am unable to determine precisely where this PE file is mapped exactly because it's a Delphi TForm application, its statically linked, and is intentionally obfuscated.
This secondary .exe loaded into memory has tamper protection, patching it to force itself to give me more malware won't be easy. This binary also has anti-VM features as well, I think from calculating disk space. However, I can't tell right now either, but this is what it appears like based on the API it imports.
1. Delphi TForm application
2. Does stuff, lots of junk
3. Maps secondary PE into memory (somehow)
4. Secondary PE does recon to assess the machine
5. ???
Somewhere in the midst of this, this binary is going to make an external call, somewhere, somehow, but it's proven to be difficult due to how obfuscated this code is, coupled with the custom PE cryptor, decoy data present, ... and everything else.
Initially I was under the impression one of the obvious .EXEs I saw was the actual secondary payload, but it's not (I think?), it appears to be a decoy (I think).
I don't know who wrote this, but this is probably one of the most sophisticated malware payloads I've seen in recent time.
It has successfully evaded my VM, RecordedFuture Triage, VirusTotal VM, and AnyRun
I still don't know what this malware is trying to do.
Had a lovely conversation with a Threat Actor from South America.
It turns out, one of the malwares I bonked with a stick was written by someone who follows this social media profile. They confirmed to me in private it was primarily written using ChatGPT.
We had a cool conversation though, last week bro made about $54,000 from his various malware campaigns he spreads on Discord. He was not lying about his "income". Crimes does indeed pay.
He also has a pretty nice computer setup.
We also made small talk about how to illegally immigrate into the United States for as low as $400, problems with money-mules and credit card fraud, and his opinions on other South American countries (he doesn't like Colombia, he says they're not good people).
Overall, bro was pretty chill, despite the large scale identify theft, extortion, money laundering, tax evasion and possibly illegal immigration he does.
It also overlays other UI elements. This is amazing. Look what I see when I open Telegram
Читать полностью…
wtf is this slop
https://gist.github.com/vxunderground/3a6e2376a50acb8259609dfdc55e40dc