The largest collection of malware source code, samples, and papers on the internet. Password: infected
International
Joined August 2019
- Tweets25.4K
- Following390
- Followers459K
- Likes21.5K
Wow, this is some pretty annoying goop.
I'm certain this is APT43 a/k/a Kimsuky a/k/a Democratic People's Republic of Korea General Reconnaissance Bureau
This is an updated version of their March, 2026 GrimSource campaign. This version is heavily improved upon, improved obfuscation, and the final payload is way, way, way better.
It's got custom string hashing (actually, it's a modified Fletcher32 checksum function, but whatever), it implements the Heaven's Gate technique, and it is specifically tailored to avoid:
- csfalconservice.exe
- repmgr64.exe
- cyserver.exe
- sfc.exe (?)
- bdredline.exe
- sedservice.exe
- fshoster64.exe
- mssense.exe
Based on the presence of specific anti-malware and/or cybersecurity products, it takes different evasive actions.
I'm curious though why Breakglass Intelligence didn't discuss the final payload in their March, 2026 report, they've documented the initial stager, it's subsequent stagers, and the C2 resolutions, but it doesn't discuss the actual shellcode payload inside of the initial access file.
> be me
> get dm from friend @malwrhunterteam
> "smelly i found goop"
> wtf i love goop (malware)
> @smica83, funny sounding name man shares
> flagged as goop from north korea (maybe)
> wtf i love north korea (they dont steal monies)
> download
> look inside
> .msc file
> Microsoft Management Console file
> file thingie for sysadmins to open
> big ass fuck off obfuscated code
> wtf
> javascript encoded as html decimal thingies
> decode
> obfuscated javascript
> weird comments inside the javascript code
> comment about BangBus (porno?)
> ??? bros like BangBus ???
> does a bunch of dumb obfuscation
> eventually pulls out giant blob of data from .msc file
> look inside
> base64 encoded OLE stream
> what year is it?
> look inside OLE stream
> ocx_streamorstorage
> look inside
> 21,486 lines of obfuscated javascript
> simple bullshit tho, just embedded a bunch of goop
> base64 encoded and split up a bunch
> put back together
> fails
> oh its also compressed
> decompress
> works
> XLST with microsoft jscript executor
> ok
> XLST jscript uses a bunch of .net stuff
> .net makes another XML
> what the fuck is this fucking piece of shit
> .net reads XML it made
> eventually find 32bit position independent shellcode
> the shellcode is stored in the balls
> jk was stored in "Resource Directory:b:Array:QrJVY"
> shellcode never seen before on VirusTotal
> open shellcode in IDA PRO (thank u hexrays ily omg)
> look inside
> lots of stuff, have lots of work to do
Some dork tried commenting that it's messed up MalwareHunterTeam sent me malware, and that people need to be careful, even with their friends, because you never know when someone could try to "infect your PC with a virus".
No. You're new to goop city. I WANT the malware.
> be me
> get dm from friend @malwrhunterteam
> "smelly i found goop"
> wtf i love goop (malware)
> @smica83, funny sounding name man shares
> flagged as goop from north korea (maybe)
> wtf i love north korea (they dont steal monies)
> download
> look inside
> .msc file
> Microsoft Management Console file
> file thingie for sysadmins to open
> big ass fuck off obfuscated code
> wtf
> javascript encoded as html decimal thingies
> decode
> obfuscated javascript
> weird comments inside the javascript code
> comment about BangBus (porno?)
> ??? bros like BangBus ???
> does a bunch of dumb obfuscation
> eventually pulls out giant blob of data from .msc file
> look inside
> base64 encoded OLE stream
> what year is it?
> look inside OLE stream
> ocx_streamorstorage
> look inside
> 21,486 lines of obfuscated javascript
> simple bullshit tho, just embedded a bunch of goop
> base64 encoded and split up a bunch
> put back together
> fails
> oh its also compressed
> decompress
> works
> XLST with microsoft jscript executor
> ok
> XLST jscript uses a bunch of .net stuff
> .net makes another XML
> what the fuck is this fucking piece of shit
> .net reads XML it made
> eventually find 32bit position independent shellcode
> the shellcode is stored in the balls
> jk was stored in "Resource Directory:b:Array:QrJVY"
> shellcode never seen before on VirusTotal
> open shellcode in IDA PRO (thank u hexrays ily omg)
> look inside
> lots of stuff, have lots of work to do
.msc file:
6579ac2f9707139e44059542604148e8032fb4c471dc2d0ef7d6e70367949657
.msc jScript (encoded):
6a06efa112d27a6f7e80d86fdd6f2d2b6ad395d5a9cf058fa72ee96e5a1f89ec
.msc embedded OLE stream:
25e86daa21fd37b739dbf4fc90f24c39dfa9b8de6477ccdff8b35b1a11a7ceb4
XLST inside of OLE stream:
993c243c0a5a633f5eb5aeec8a38bb0633154fe2b5308e7ff45fd4220bd5a886
.NET JScript thingie inside of XLST:
e38af9ba24678097f1dd5ba73617e247ebea8cb425f0dd220065668c0762473a
32bit shellcode:
28d5f5b6c694d4c4430736747409a3d0557d0de28067e784d5989cc8478a68be
> be El Salvador
> send nerds to Haiti for UN thingie
> gang kidnaps Salvadorian nerds
> bukele says "give back"
> gang "nah"
> bukele says "ok we take back"
> gang "nah, also you're a bitch"
> bukele comes to take back
> gang "wtf that's illegal, UN tell them something"
> UN says "idk bro thats crazy"
> bukele goes on social media
> "does anyone know this houses coordinates? we will bomb it"
> crowdsources OSINT nerds
> OSINT nerds deliver exact coordinates in like, 30 minutes
> bombs it exactly as promised
> goes on social media
> calls them pussies
tl;dr OSINT nerds on Twitter called in Airstrike like it's Call of Duty, never been seen before on social media
Instead of making goop (malware) bonking posts I've been slowly working on my 3rd YouTube video. This is a very big (and still unidentified) malware. I've been meticulously documenting it. It's going to end up being a YouTube goop essay
Preview thus far (14 mins...)
If you're a nerd who has been paying attention to my social media posts, you're locked in.
The thing we talked about in this post (In August, 2026) has been attributed (in varying degrees of confidence) to the Iranian government in November, 2026.
Chat, we saw it a mile away. Some of you immediately said "prolly some government who wants to mess with our food supply chain", you called it. You're an apex gooper.
On social media today I've seen various United States military personnel (or individuals who known military personnel) discussing problems with refrigeration units on military bases.
For those outside the United States, the United States government has military bases which act as housing for soldiers, as well as veterans, and are basically like... mini cities, kind of. You drive there, a guard is at post, they ask to see your military badge or some sort of identification to prove you're military, then they let you on base.
These military bases have homes, gas stations, restaurants, grocery stores, and they're usually exempt from tax (I don't know to what degree, I'm not in the military).
Anyway, people on base are sharing images of the on-base military grocery stores having their refrigerators compromised. These refrigerators are used to hold ice cream, meat, dairy products, eggs, etc. Some soldiers have said they've heard nine military bases have had this issue.
This is not outside the realm of possibility if these refrigerators are IoT (Internet of Thing) devices, meaning they're connected to the internet and can be managed remotely. It is totally possible a Threat Actor was able to access the refrigerator control panel and disable them, which would destroy the food products.
It is extremely important however that I note this is all speculative. While it is possible they were compromised, and some military bases are having problems, this could all be rumors circulating around military bases and online. In other words, this is what soldiers are saying, but that doesn't necessarily make it true. We have no concrete evidence or official statement from the United States government.
I strongly dislike this.
Microsoft, I'm begging you, please, if it isn't broke, don't try to fix it. RegEdit was fine the way it was.
It's been stable for decades, don't do it
Here's your first look at Microsoft's new WinUI 3 Registry Editor, but it's a developer sample preview, so it may not ship on Windows 11 anytime soon.
Windows Latest found the app inside Microsoft's open-source Reactor repository, and I built it myself on Windows 11.
It keeps the familiar two-pane layout but replaces the cramped Windows 95-era interface with native WinUI 3 controls, a dark-mode-ready design, and smoother animations.
It can read, create, rename, and delete registry keys, edit values, and search the registry. It even uses Mica, with no Electron or WebView2 involved.
There are still unfinished features, and Microsoft hasn't announced plans to replace regedit.exe.
This is a developer sample made by Microsoft, not an official Windows 11 replacement.
ALT Windows Registry Editor
Wtf the CCP is sending Chinese spys after me too (an Asian lady said "oh, sorry" after her cart blocked the aisle in the grocery store)
Nice try xi jinping, you'll never get me
"Uhmmm, errrrm, Schmelly, actually the display message is from the Discord hosting provider, and since you didn't double check their status page and immediately blamed it on AI slop is misinformation"
Silence, Discord user. You're in goop territory.
> be me
> have baby
> baby crying
> hysterical
> won't calm down
> panic
> go to urgent care
> they worried
> "go to ER"
> go to emergency room
> they worried
> perform tons of tests
> can't figure out what's wrong
> nurses give him teddy bear
> give him snacks
> crying for like, 5 hours
> sudden change in behavior
> he lets out diabolical fart
> nasty, putrid, foul
> immediately calms down
> running around
> happy
Dawg, they did so many fucking X-rays, they couldn't figure out what was wrong. They thought maybe he had an intestinal blockage, or a broken bone somewhere, or maybe a hair line fracture because he's so tiny. I spent most of my Sunday at the hospital for a fart
They're going to bill me thousands upon thousands of dollars, for a fart
Man, I feel like such a piece of shit sometimes.
Sometimes I'll make a post online, not even really thinking about it, because in my little brain I'm like, "haha that's funny, my friends will think it's funny too".
But, I forget that my audience is over 450,000 people...
Sometimes I fuck up, because I should ask myself "Is this an appropriate thing to say to someone in front of 450,000 people? Could this person misinterpret my comment? Is making this post in front of 450,000 people going to cause any problems?", etc, but instead I type something and hit send
Then a few hours later I'm like, "fuck, I fucked up, I shouldn't have said that".
The attached image is an aerial view of Woodstock in 1969. That is approx. 400,000 people. My audience is this with an additional 50,000 more...
So, I'm sorry to some people who I've accidentally been a dick towards. I genuinely do not intend to be rude, or seem like I'm trying to put you on blast. As dumb as it is, sometimes I just don't think things through, or think about how insanely large my audience is. I fuck sometimes. I'm sorry.
I do try to not be dumb and make mistakes, but unfortunately sometimes I slip up. Again, I'm sorry.
