vxunderground/malwaresourcecode

★ 18,245AssemblyAudience · researcherComplexity · 1/5QuietLicenseSetup · easy

Mindmap

mindmap
  root((repo))
    What it does
      Malware source code
      Organized by platform
      Educational resource
    Platforms covered
      Windows variants
      Linux systems
      macOS and Android
    Malware types
      Botnets and worms
      Ransomware and rootkits
      Stealers and trojans
    Use cases
      Threat analysis
      Defense research
      Detection development
    Tech stack
      Assembly language
      Python and PHP
      JavaScript and Java

mindmap root((repo)) What it does Malware source code Organized by platform Educational resource Platforms covered Windows variants Linux systems macOS and Android Malware types Botnets and worms Ransomware and rootkits Stealers and trojans Use cases Threat analysis Defense research Detection development Tech stack Assembly language Python and PHP JavaScript and Java

Things people build with this

USE CASE 1

Analyze malware behavior and code patterns to improve antivirus and intrusion detection systems.

USE CASE 2

Study how ransomware, botnets, and rootkits are constructed to better defend against them.

USE CASE 3

Train security teams on real-world malware samples and attack techniques for incident response.

USE CASE 4

Develop signatures and detection rules by examining actual malicious code across multiple platforms.

Tech stack

AssemblyPythonPHPPerlRubyJavaJavaScriptC

Getting it running

Difficulty · easy Time to first run · 5min

Research and educational use only; vx-underground and contributors disclaim liability for any misuse of the code.

In plain English

MalwareSourceCode is a collection of malicious software source code gathered and organized by the vx-underground security research group. It is intended for malware research and education, understanding how malware is built helps defenders detect and counter it. The repository spans a wide range of platforms and programming languages, including Windows, Linux, macOS, Android, legacy Windows versions, PHP, Python, Perl, Ruby, Java, JavaScript, and assembly language. The collection is organized by platform and category. Windows malware entries include botnets, ransomware, rootkits, crypters (tools that hide malware from detection), stealers, exploit kits, and internet worms. Linux entries cover backdoors, botnets, rootkits, and trojans, including Mirai-family code. There are also phishing page templates, point-of-sale malware, and in-browser JavaScript attacks. Some archived files may be password-protected with the word "infected" to prevent accidental execution. The repository comes with a liability disclaimer: vx-underground and contributors accept no responsibility for how the code is used. Access to this material is intended strictly for defensive research purposes.

Copy-paste prompts

Prompt 1

Show me how a simple Windows botnet communicates with its command server by examining the source code in this malware collection.

Prompt 2

What are the common obfuscation techniques used in the ransomware samples in this repository?

Prompt 3

Help me understand the structure of a Linux rootkit from this collection and how it maintains persistence.

Prompt 4

Extract and explain the key functions in a JavaScript-based in-browser attack from this malware source code repository.

Prompt 5

Compare the code patterns between Mirai-family botnets in this collection to identify shared vulnerabilities.

Open on GitHub → Explain another repo

Generated 2026-05-18 · Model: sonnet-4-6 · Verify against the repo before relying on details.