vxunderground/MalwareSourceCode resource

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

18675 stars · 2097 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A large curated collection of malware source code spanning many platforms (Windows, Linux, Android, macOS, MS-DOS, PHP, Java, and more) and programming languages, maintained by vx-underground. It serves as a research reference archive for malware analysts, reverse engineers, and security researchers.

Use cases

• study malware source code to learn how infectors and rootkits work
• research malware families like Mirai spin-offs for detection research
• build and test antivirus or EDR detection signatures against real malware implementations
• analyze historical ransomware and botnet code for academic papers
• find reference implementations of bootkits, crypters, and stealers
• collect phishing page samples for security awareness training

When to choose

• you need a broad, organized archive of malware source across many platforms and languages
• you are a security researcher or malware analyst studying offensive techniques
• you want historical/legacy malware code (Win9x, MS-DOS, Symbian) for research
• you need reference samples to develop detection or reverse-engineering skills

When to avoid

• you want production security tooling or defensive software to deploy
• you need a maintained library with a license permitting reuse in your own projects (no license is provided)
• you are looking for a sandbox or analysis platform rather than raw source code
• you cannot safely handle malicious code or lack authorization to study it

Facets

dataset · maturity active

security reverse-engineering developer-tools security penetration-testing reverse-engineering operating-systems windows cross-platform malware malware-research malware-source-code vx-underground security-research dataset linux macos android

Member repositories

For agents

markdown · JSON · MCP: product_card(name="vxunderground/MalwareSourceCode")