439,000 people on X and 50,000 on Telegram, almost 500,000, whatever. Close enough.

Chat, we are cooking.

Previously on Dragon Ball Z, someone DM'd me a spoopy GitHub they found. They asked if it was malware. It was malware.

The GitHub contained HEAVILY obfuscated Lua. The malware payload is using Prometheus Obfuscator.

Upon review, it was determined this malware is SmartLoader. SmartLoader is a malware campaign heavily associated with Rhadamanthys Stealer and StealC Stealer.

SmartLoader is relatively new and is being tracked by AhnLabs, TrendMicro, Hexastrike, McAfee, and the GitHub security team. It first emerged around March, 2024.

SmartLoader is pretty sophisticated. It is multi-staged, uses Polygon Smart Contracts for C2 information retrieval, and despite being Lua, it is also makes usage of NTDLL makes low-level WINAPI function invocations. One interesting attribute also is it programmatically inflates or deflates its file size for pseudo-polymorphism. This is extremely cool.

I mention this, and the whole cookin' thing, because after I made a post complaining about the obfuscated Lua, a very, very, very gifted person in Lua obfuscation and de-obfuscation contacted me and successfully deobfuscated it. I don't know if they want credit or not, because they're so cool and badass, but they're extremely famous in the Roblox hacking scene.

Anyway, the de-obfuscation is so precise it borders on having the actual source code to SmartLoader. I am very happy. I will share it when I am not dealing with my baby.

I've almost reverse engineered the SmartLoader obfuscated code all the way down to a working source code

You can't hide behind Prometheus you little bitch

I'm sorry, SmartLoader malware campaign, I shouldn't have called you a little bitch. That is very rude of me.

I am just passionate and have spent some time working on it, so my emotions are high.

I love you.

My deepest condolences to my colleagues in Venezuela and those impacted by the recent earthquakes.

I wish I had more to offer other than words. I hope you're all doing well and I hope you're all safe.

> be SmartLoader
> big ass fuck off malware campaign
> tracked by dozens of anti malware companies
> heavily obfuscated lua
> bamboozles everyone
> me jimmies rustled
> team up with roblox cheater nerd
> reverse engineer it back to src
> (almost done)

https://gist.github.com/vxunderground/aaa6a88823afc83b4f8a73366694966d

original payload:

https://gist.github.com/vxunderground/91da9c50e400a6742bbacd1548a255d8

> get dm
> "hey smelly, i work for (kind of important place)"
> "vendor sent us weird file, its sus af"
> "what do u think?"
> download file
> look inside
> ultra mega fuck off malware
> pe position independent .code is set to RWX
> multiple extra sections
> extracts .bss segment
> .bss has .exe inside it
> .exe ASPack 2 compressed
> emulate
> has anti-vm features
> pulls .bat from c2 to self-delete
> still bonking

my brother in christ, if your company ran this .exe from this vendor, you better call someone ASAP because your company is COOKED. also, this vendor is either a criminal enterprise or compromised. gl big dawg. happy monday

Okay, I'm going to bed now.

Goodnight people on X
Goodnight people on Telegram
Goodnight FBI
Goodnight NSA
Goodnight CIA
Goodnight Israel spyware
Goodnight ads tracking me
Goodnight AI scrapers

Mwah kisses
xoxo

Oh, I forgot

Goodnight Chinese espionage campaigns residing in United States critical infrastructure believed to be aggregating and collecting intelligence on United States citizens

Mwah

this is the guy calling you the N word on discord

oh sorry

if youre a threat intel nerd, or anti malware nerd, who is designated to track potential state sponsored activity in south america

final payload: 5a979c309aff96456ba4482653fc213997387956c24e376645e4e0cfaa6b878a

obfuscated js payload (fragmented utf16le):
87eac5fa290387bd90d71424f8a65f2b2c7436a415f6e7f033915ef8e833ef86

file sent to colombia ppl i guess idk:
193b98595f44935e79413aeb474cd8d75e8d5ba63caf0d52470cadbeb8139c03

theyre all on VT now

> get more dms
> more free malware
> yay
> "smelly someone says this cheat src code is malware"
> download
> look inside
> visual studio prebuild event builds vbs script
> vbs script decrypts .ps1 script
> downloads RAT
> contains link to a YT video

https://www.youtube.com/watch?v=akoxddx6lgc

Chat, I don't want to jump to conclusions, but I have a sneaking suspicion this malware stager was vibe coded. Historically, malware hasn't left extremely descriptive comments in their stagers.

omg i got FREE malware from REDDIT

I tried to do a write-up on X and share some de-obfuscated malware source code

I kept getting notifications on X saying something like, "sorry—something has gone wrong, don't fret", blah blah blah.

If I removed the malcode it worked

I THOUGHT THIS WAS AMERICA

THEYRE PREVENTING THE PEOPLE FROM GETTING MALWARE!!!!!!