Torhoo onion mirror : torhoocc3yugradvhrppml2fin4xob7kgg7uf42s4xk7p6r5vzy62ead.onion

Malware basics - don't get scammed! : hacking | Torhoo darknet markets

Saw a lot of low quality posts around and lately I have been staying a lot on dread so I decided to offer some basic knowledge for beginners to avoid scams.

First of all we aren't in 2012, so there are no "packs" with 200 RATs that will work. There are no DDoS tools that will require you to run a single executable and magically take a service down. There are no open source RATs that will bypass any kind of protection (not even talking about EDRs) without really large modifications. There are no free crypters, there are no free good tools in general.

Tools in general:
- always go native (native means no dependencies from the start - languages like C/C++/asm/go/rust - allows you to run on any target and are also harder to analyze by security researchers). "Well, python can be packed in a single executable as well"... just don't comment this...
- you will not be able to code your own tools if you don't have a lot of experience, again, AVs evolved a lot, copy pasting from github doesn't help anybody.
- they can't not be found on marketplaces, stop doing that. DNMs are for drugs, you want "hacking" tools? Go to actual hacking forums: xss/exploit/ramp/whatever you like, just don't get scammed. Avoid dread as well.
- always look for reputable members, vouches, old accounts, etc.

Crypters with shared/public stubs are not worth it anymore, always go for private stub, make sure the crypter is compatible with your payload (ask dev). Crypters only take care of static, runtime is based on your tool.

RATs are not for mass infection, rats are made for individual cases. RATs are made to specifically run on an RDP near the victim location to avoid latency for features like HVNC.

Loaders on the other hand are made to handle large amounts of bots, they are stealthy and modular.

DDoS / stressing is rarely offered these days because of the new regulations (they are not new anymore but..). Everyone who ddosed back in the day is still in jail. You will need a strong botnet to take down protected services.

IoT botnets are not a thing anymore, exploits for IoTs cost thousands and your mirai copy will not bring you more than 1k bots in 2025.

If you don't know russian you can use services like SimplyTranslate to stay on forums.
Do not ask for middleman if you are dealing with a known user on a russian forum tho, they will not even answer. Learn to behave on hacking forums, making cringe posts and asking a lot of questions will get you banned quickly.
Do not ask for spreading techniques, no one will share theirs with you for free.
Stop trying to make money with free tools and learn before wasting money.

/u/Urdigitalsupport

3 points

3 months ago

Glad someone’s cutting through the noise. It's wild how many people still think we're in the 2012 era—expecting outdated packs, DDoS GUIs, or public GitHub RATs to do anything meaningful in 2025. AVs, EDRs, and behavior-based heuristics have evolved. These days, even off-the-shelf loaders need heavy customization, and you're not getting far without solid runtime obfuscation and context-aware deployment.

If you're serious about building tools:

Stick with native (C/C++, ASM, Go, Rust). No dependencies, smaller footprint, and much harder for analysts to reverse or sandbox cleanly.

Python, Java, and .NET are fine for control panels or infrastructure, but not payloads. Packing Python into an EXE just screams “scan me.”

Crypters? Public stubs are dead. Private or nothing. Even then, make sure the stub is tailored for your payload. Static ≠ runtime. Know the difference.

Loaders should be modular, coded from scratch, and built with persistence logic that mimics legitimate behavior. Think about telemetry, not just obfuscation.

AI is starting to assist, but we’re not at full autonomy. LLMs can write shellcode loaders, generate AV-evasive variations of known payloads, or help brainstorm obfuscation layers—but they’re not writing fully custom implants or bypassing cloud-based behavioral defenses yet. If you're not skilled enough to audit or modify what it spits out, you’re playing with fire.

And a final word for the lurkers—stop hitting up experienced hackers and coders asking for free work like you’re doing them a favor. People spend years mastering this space. If you're not offering real payment or a cause worth backing (think whistleblower, activist work, etc.), don’t expect elite-level help. You get what you pay for—especially in a world where OPSEC failures cost people real time.

/u/zerodaydreamer

1 points

1 month ago

How do I not become a 'lurker' and become more versed in the things you're talking about? I've started reading quite a bit on Dread, and I practice quite a bit. What else should I read to be better at this? What should I pay attention to? I know I'm new to Dread so idk if asking these questions are taboo or not. If they are tell me. I want to learn.

/u/stanczyk220

1 points

1 month ago

There's so many sources that you could learn from if you just tried hard enough. Start small.

/u/kosovobigdick

3 points

3 months ago

shit i was planning to make "Huge Multi Mega Pack of 5000+ hack tools ways methods" just all of this second, but you told everyone... fuck. How will I scam n00bs now? How!? You owe me big money!@!!!!!! /s

/u/drisdane Moderator

2 points

3 months ago

Thanks for this input. Hoping this becomes an interesting discussion.

Would you be willing to reveal a bit about the scope of your experience with malware? How long you've been active and how successful you believe to be?

And am I correct you are basically saying that developing malware has become much more difficult in the past decades and is now more reserved for higher tier developers?

And what about AI? Or did you just not mention it because you think it is worthless in this field?

/u/P1tchBlack 📢

3 points

3 months ago*

AI is great, for sure a good addition to a programmer's "arsenal", but it just gave the false impression to beginners that they can write whatever they want. AI still generates trash/unsafe code. Yes, it lowered the barrier a little bit for writing scripts/phishing emails/whatever, but good malware still requires advanced technical knowledge. For example a poorly implemented encryption in a ransomware will lead to an analyst giving decryption keys to the victims, a bad login for your botnet panel will lead to analysts taking over your entire operation, and so on.

And let's not forget that AI was trained on our resources, and generates pretty similar code to what he has seen in the past, while maldev requires exactly the opposite: new ways of thinking. (I am probably trying to protect my job out here, maybe it's already better than most of us?)

Don't get me wrong, there were hundreds of cases where malware written by AI (from scratch) actually worked on systems, but those guys actually knew their craft, good prompting, good infection methods, etc. You can't (yet?) base your entire operation on AI. You still need good software to do complex OR big operations.

Thank u.

/u/bobby_singer 🍼

1 points

4 days ago

I think that the most difficult part is to find a new vulnerability, having that ability to find it can even be "artistic", of course it is not a single person work is generally a large team that is dedicated to that. Managing to find vulnerability after writing the code (still requiring a lot of effort) but you know where you are going and what you want to achieve.

/u/phishermann

1 points

3 months ago

you got onion link for ramp?

/u/RickBenRollin

1 points

2 months ago

What he said :)

/u/Cyberjagu Moderator

1 points

3 months ago

Really nice post by breaking down some harsh truths the fact that the days of easy "plug and play" tools are long gone and that anyone expecting free high-quality solutions in 2025 is setting themselves up for disappointment (scam) It’s gritty no-nonsense and cuts through the hype

Thanks for putting this it’s the kind of reality check that’s worth sticking around for newbies to see!

/u/P1tchBlack 📢

1 points

3 months ago

Thank u for the sticky!

/u/cilantr0

1 points

3 months ago

Quite interesting points, thanks for the generic input. Not a total disagreement, but you may know or even have seen that there are a couple of successful stealers coded in GO / Python that people pack into bundled executable and subsequently pack / obfuscate / crypt .

As for /u/drisdane comment has a valid point also worth mentioning: using AI is helpful, if you are careful on writing the right prompt avoiding the LLM to filter/block its output, you can get Claude for example to help you on obfuscating your code for persistence and make it bypass some of the MS Defender detection thresholds, for example.

Nonetheless, you need to understand OS internals, mechanisms of persistence, backdooring options available per different environment and remember that there´s no one-size-fits-all approach, different techniques work only in some environments where the set of security controls in place align with whatever you are trying to achieve (either exfiltration, lateral movement or just credential dumping to prepare for further attacks from other angles).

/u/P1tchBlack 📢

1 points

3 months ago*

That's exactly what I meant, replied to drisdane if you are interested.

Related to python being used in malware, I know there were successful campaigns, because technically speaking any language can be used for writing malware, but python is extremely easy to reverse engineer, it has dependencies (and packing with PyInstaller/py2exe/Nuitka usually gets your payload flagged) and is a high-level language (is extremely abstracted from the operating system, it's inefficient with memory management, and so on)

meanwhile, C/Go/Rust gives the developer the freedom he needs to interact with the OS.

Thank u.

/u/bobby_singer 🍼

1 points

4 days ago

Exactly, you write the code of a spyware in C# that controls the camera and the keyboard and everything captured sends it to a server, if the police have your program they can make reverse engineering using even Visual Studio and decompile your DLL or exe and see the directions of your server even even if the hides and follow the trail.

/u/Remio

1 points

3 months ago

Skid 101

/u/kaykaybr

1 points

3 months ago

Where do I think the true links for Ramp and Whatever?

/u/P1tchBlack 📢

2 points

2 months ago

/post/71514fc4e91f97631a8b you have all the links here

/u/zatik8

1 points

3 months ago

I’ve visited several hacking forums and I’m really interested in this topic. I’m teaching myself using available information, including learning from others' experiences. If you know any reliable sources where I can truly learn more about hacking, please let me know.

/u/P1tchBlack 📢

1 points

2 months ago

/post/71514fc4e91f97631a8b you have all the links here

/u/zatik8

1 points

2 months ago

The best forums and paid ones there are and maybe other sources of information for a beginner hacker on the dark web or something else ..

/u/P1tchBlack 📢

1 points

2 months ago

exploit is 200, ramp is 500, and you can google whatever you want to learn, a lot of resources available for free including tryhackme, hackthebox or any other platform that hosts CTF style challenges.

/u/Anorial_newacc

1 points

2 months ago

there is a lot of stuff but nothing is free and btw my botnet is inpired by mirai and fritztfrog with my own stuff i create it self i can tell you i got more then 1k iot bots in a hour but the issue is selling it and find the correct exploit have modern list for cretendtails usw it need time and you have to know what to do. but you are correct nothing is free or cheap in this part normaly code all by yourself.

nothing is free here and nothing what is cheap will work!

/u/JackSmith55

1 points

2 months ago

So, rat like NetWire v2 that has disconnected, where can i find it cracked? or leaked source

/u/P1tchBlack 📢

1 points

2 months ago

Most likely github or vxunderground, but this reply makes me think you didn't read my post.

/u/gemini

1 points

1 month ago

Finally common bloody sense

/u/ytc00d

1 points

1 month ago

Found this smartgadgetstore.live is pathetic, check it out

/u/BrBe

1 points

1 month ago

and why this youtuber "Gemini Cyber Security" uses tool from github and hes able to bypass AV/EDR easily?

/u/P1tchBlack 📢

1 points

1 month ago*

To be honest, there is a lot more to this topic which I didn't cover. I haven't heard of that youtuber, so I will explain how it is sometimes possible to bypass security solutions (although I am not too confident that you can fool EDRs/XDRs) with open source tools.

First of all, there are some github projects online that are pretty well written, if you get it right on release or after a big update, there is a big chance you can use it right off the shelf. Another case is if you have a really good loading technique (loading the payload in memory directly), but at the same time behavior based analysis evolved a lot, so there will be issues even with this if the tool itself is trash.

Second of all, most tools are deployed AFTER the EDR/AV is down, in the past using tools similar to Terminator (github[.]com/ZeroMemoryEx/Terminator - clearnet link) or abusing AV installers / safeboot (which kinda still works) you could pretty much deactivate all security on a windows system. After that point, you could drop anything you wanted, including github tools.

I wouldn't trust youtubers too much when it comes to malware, as it's easy to setup a vm and say that you've bypassed some AV solution, but reality hits really different, especially if your payload gets released in the wild, and is uploaded 50 times daily on VT.

/u/BrBe

1 points

1 month ago

ok i understand what you mean, if you got time check that out and let us know what you think, cheers

/u/krimsomniac

1 points

4 weeks ago

Well said.

Scratching the EDR part a bit by mentioning that its really important to be familiar with the tactics and techniques of the blues as well. If you are going after a system that is rocking the ELK stack, you need to be aware of what the analyst sees when you are knocking on their door.

/u/ntdll

1 points

1 month ago

Also keeping bots got much harder in comparison to few years ago.

I think it's worth taking like 1/yr at most learning malware programming.
You don't even need to know how to program everything alone anymore, just to understand the concepts and what steps u want to achieve (could use local ai).
I think the generated ai code will be still better if you put some time into learning, then buying some overpriced skid shit from some shit forum.

That's just my view, if I would have no clue and would start fresh.
Also if you can deliver working products within your spreading you will have much more success.
Huge game releases are always an good time to start ad campaign etc.
can't wait for gta 6

Ah and..
More features = more detection (in most cases)
rather build something simple, like some loader that has some nice download and execute, and focus on fudness of that so you can expand later.

/u/ntdll

1 points

1 month ago

and living of the land really became mandatory in the last couple of years.
stuff like powershell, .lnk. svg .bat .url
and if you have the money buy a cert

/u/P1tchBlack 📢

1 points

1 month ago

This is completely true, as well as the "More features = more detection", that's why I always recommend modularity (plugins & good d&e/d&l), but I don't think you can deliver something safe with just 1 year of programming experience and AI, I still recommend anyone doing serious campaigns to invest into real tools built by experienced developers. The prices evolved but so did the techniques.

/u/ntdll

1 points

1 month ago*

there are so many products that are just bad design/ programmed.
But yeah there countless little details to know about.. 1 year aint enough.

/u/n0tFly1n

1 points

3 weeks ago*

As a relatively New mal-dev (First year) i gotta say how much this post helped, much appreciated, definitely saved me on my time and coin. ive skidfully been tempted in the past to purchase one of the rtarded
400+ RAT+CRYPTOR+WORM-1337 H4x0r Tool kit's
but seemed too Good to be true as is the rest of the world, seems i was right .. that and 99% of the Malware on Non-hacker Markets is outdated by at least a yr, was given to the vendor as a "extra" on a purchase they made previously or just straight up payloads ripped from VXUG's, Cryakl's or Objective-See's Github Repos. damn shame too.
I should have got into this topic fr a decade ago lol anyways ill stop the word vomit.

Tl;Dr: Cheers for the Post Man, Legend

/u/eldragon

1 points

3 weeks ago

green

/u/WavyTrain

1 points

4 days ago

So, I found a .zip with zloader and dozens of RAT files. I ran the zip through localvirus, and lit the fuck up. I am just asking to underatand from a defensive POV and not trying to start skidding, just interested in my own ass. Whats' a resource to learn how these things work, possible attack vectors and how to detect them.

/u/quigonjinsin

0 points

2 months ago

where can i go to to get a process hider/rootkit that will hide running applications from task manager

/u/P1tchBlack 📢

1 points

2 months ago*

Forums like XSS/exploit.

From what I understand you want to hide a miner? Most miners have features like process injection (or any crypter tbh) so they don't show up as a different process inside task manager, anti-monitor so they stop consuming too much resources when monitoring apps are running (like task manager / process hacker), fullscreen detection and so on.

Maybe you only need a better tool? Choose a native miner from a known developer and you will be good with a simple crypt, no need of a rootkit or "process hider".

/u/squgwy72024

1 points

4 days ago

I have written some malwares y self past few weeks, but now I came to new thing called, packers, is these things realy works, I know that there are only two options:1. Buy packer from forum(+-) 2. or build it from 0. but the question would be does the packer really helps to evade AV vendors by just obfuscating binary file?