MalwareSourceCode
Collection of malware source code for a variety of platforms in an array of different programming languages.
A curated archive of malicious software source code across Windows, Linux, macOS, Android, and more, maintained by vx-underground for security researchers and defenders who study how malware is built to better detect it.
MalwareSourceCode is a collection of malicious software source code gathered and organized by the vx-underground security research group. It is intended for malware research and education — understanding how malware is built helps defenders detect and counter it. The repository spans a wide range of platforms and programming languages, including Windows, Linux, macOS, Android, legacy Windows versions, PHP, Python, Perl, Ruby, Java, JavaScript, and assembly language.
The collection is organized by platform and category. Windows malware entries include botnets, ransomware, rootkits, crypters (tools that hide malware from detection), stealers, exploit kits, and internet worms. Linux entries cover backdoors, botnets, rootkits, and trojans, including Mirai-family code. There are also phishing page templates, point-of-sale malware, and in-browser JavaScript attacks. Some archived files may be password-protected with the word "infected" to prevent accidental execution.
The repository comes with a liability disclaimer: vx-underground and contributors accept no responsibility for how the code is used. Access to this material is intended strictly for defensive research purposes.
Where it fits
- Study real-world botnet source code, including Mirai-family samples, to understand how command-and-control infrastructure is built.
- Analyze ransomware and rootkit samples to build accurate detection signatures for your security monitoring tools.
- Learn how in-browser JavaScript attacks and phishing page templates work in order to write defenses against them.