-AGPLv3-green?style=for-the-badge){kind=icon}
-MIT-blue?style=for-the-badge){kind=icon}
AGPLv3 (MHX Core) / MIT (C# Native Engine) — Open Source. Open Knowledge.
VGT Malware Hunter X-Ray is a Proof of Concept (PoC) exploring behavioral endpoint detection using PowerShell, .NET/C# interop, and Windows native APIs. It is not a replacement for enterprise EDR solutions.
Architectural limitations to be aware of:
- Runs as a PowerShell daemon — subject to PowerShell execution constraints and startup latency
- Detection runs on a 2-second polling interval — real-time kernel-level hooks are not implemented
- Process termination via
Stop-Processcan be circumvented by sufficiently privileged malware - The AMSI integrity check relies on known patch signatures — novel bypass techniques may go undetected
For production environments, we recommend established solutions like Microsoft Defender for Endpoint, CrowdStrike, or SentinelOne alongside this tool — not instead of them.
| Method | Address |
|---|---|
| PayPal | paypal.me/dergoldenelotus |
| Bitcoin | bc1q3ue5gq822tddmkdrek79adlkm36fatat3lz0dm |
| ETH / USDT (ERC-20) | 0xD37DEfb09e07bD775EaaE9ccDaFE3a5b2348Fe85 |
VGT Malware Hunter X-Ray started as an experiment: Can we build a meaningful behavioral EDR daemon using only PowerShell + C# interop, running as a background system tray process?
Version 4.0 DIAMANT APEX is a major architectural leap. It introduces a fully native C# GDI+ / DWMAPI UI engine — including a live Command Center dashboard and hardware-accelerated toast notifications — while hardening the detection core with the Ouroboros Fix that prevents the engine from terminating its own async subroutines.
V3.1 — Detection engines + basic toast notifications
V4.0 — Native C# OSD Engine + Command Center HUD + expanded TI feeds + Ouroboros Fix
The most critical stability patch in MHX history. V3.x had a self-termination bug where the network engine's Zero-Trust loop could detect its own background TISyncJob as an "untrusted" external connection and kill it. V4.0 resolves this by tracking all child PIDs spawned by the core ($Script:CorePID) and explicitly exempting them from all detection engines.
A full GDI+/DWMAPI live dashboard — accessible from the system tray — showing:
- Live incident log viewer with color-coded severity (Crimson = Error, Orange = Warning, Cyan = Info)
- Timestamp-highlighted log entries with cyberpunk indicator blocks
- Real-time memory working set and session uptime telemetry
- Animated holographic radar grid with sweeping VGT Cyan laser line
- Windows 11 rounded corners via
DwmSetWindowAttribute+ dark scrollbar injection viaSetWindowTheme
Completely rewritten from ShowBalloonTip to a custom NotificationForm with:
- 60fps kinetik animation engine (
animTimerat 15ms interval) — slide-up on appear, float-up on dismiss - DWMAPI rounded corners (
DWMWCP_ROUND) - Dynamic accent color: Cyan for system events, Crimson for threat strikes
WS_EX_NOACTIVATE— toasts never steal focus from the user's active window- Offset stacking: multiple simultaneous toasts stack vertically without overlapping
- Click-to-dismiss with immediate fade-out
V3.1 had 4 feeds. V4.0 aggregates 9:
| Feed | Source |
|---|---|
| Feodo Tracker IP Blocklist | abuse.ch |
| Spamhaus DROP | spamhaus.org |
| Spamhaus EDROP | spamhaus.org |
| CINS Score Bad Guys | cinsscore.com |
| Blocklist.de All IPs | blocklist.de |
| Emerging Threats Block IPs | emergingthreats.net |
| IPsum (Community Threat Intel) | github/stamparm |
| FireHOL Level 1 | github/firehol |
| Tor Exit Nodes | github/SecOps-Institute |
A 5-minute AlertCache prevents duplicate alerts for the same PID+IP combination — no more notification floods during sustained C2 connections.
New tray menu entry exports the full live threat IP cache to a timestamped text file, instantly opened in Notepad for manual review or sharing.
Enforces strict parent-child process relationships for critical system processes. A lsass.exe spawned by anything other than wininit.exe is terminated immediately. Boot-time grace window (2 minutes post-boot) prevents false positives on legitimate startup sequences.
Four compiled regex signatures scan process command-line arguments for known malicious patterns:
| Signature | Detects |
|---|---|
CLI_RCE_OBFUSCATION |
PowerShell -enc, -decode, bypass, Invoke-, DownloadString, WebClient etc. |
CLI_HIGH_ENTROPY |
Base64 blobs (15+ groups), hex escape sequences |
CLI_EXPLOIT_STRINGS |
JNDI injection (${jndi:ldap://...}), cryptocurrency miners (coinhive, monero, stratum) |
CLI_LOTL_NATIVE |
cmd.exe /c, vssadmin delete, certutil -urlcache, bitsadmin /transfer |
Monitors all established TCP connections against 9 live threat feeds. Untrusted processes with external connections that fail path and whitelist validation are terminated. Includes masquerading detection via executable path verification and Temp-directory DLL injection detection.
Ouroboros-safe: The engine explicitly skips the core PID and all VGT subroutine PIDs, preventing self-termination.
Uses ReadProcessMemory via P/Invoke to inspect in-memory bytes of AmsiScanBuffer in all high-risk LotL processes. Detects known AMSI bypass techniques:
| Byte Signature | Technique |
|---|---|
B8 57 00 07 80 |
mov eax, 0x80070057 — returns E_INVALIDARG |
EB / E9 |
Unconditional JMP — hooks or redirects the scan function |
C3 |
RET — immediate return, scan is skipped entirely |
31 C0 C3 |
xor eax, eax; ret — returns clean without scanning |
| Technique ID | Technique Name | Engine |
|---|---|---|
| T1055 | Process Injection | Engine 4 (AMSI Memory Scan) |
| T1548.002 | Abuse Elevation Control — Bypass UAC | Engine 1 (Lineage) |
| T1134 | Access Token Manipulation | Engine 1 (Lineage) |
| T1036 | Masquerading | Engine 3 (Path Verification) |
| T1036.005 | Match Legitimate Name or Location | Engine 3 |
| T1059.001 | Command & Scripting — PowerShell | Engine 2 (KillerDom) |
| T1059.003 | Command & Scripting — Windows Command Shell | Engine 2 (KillerDom) |
| T1027 | Obfuscated Files or Information | Engine 2 (Base64/Hex Detection) |
| T1027.010 | Command Obfuscation | Engine 2 (KillerDom) |
| T1218 | System Binary Proxy Execution (LotL) | Engine 2 (KillerDom) |
| T1218.005 | Mshta | Engine 2 |
| T1218.010 | Regsvr32 | Engine 2 |
| T1218.011 | Rundll32 | Engine 2 |
| T1105 | Ingress Tool Transfer (certutil/bitsadmin) | Engine 2 (KillerDom) |
| T1071 | Application Layer Protocol (C2) | Engine 3 (TI Feeds) |
| T1071.001 | Web Protocols — C2 Beaconing | Engine 3 |
| T1562.001 | Impair Defenses — Disable or Modify Tools | Engine 4 (AMSI Patch) |
| T1055.001 | DLL Injection | Engine 3 (Temp DLL Detection) |
| T1547.001 | Boot/Logon Autostart — Registry Run Keys | Scheduled Task Persistence |
| T1078 | Valid Accounts (Credential Theft via LSASS) | Engine 1 (lsass Lineage Guard) |
- Windows 10 / Windows 11
- PowerShell 5.1+
- Administrator privileges (required for
SeDebugPrivilegeandReadProcessMemory) - .NET Framework 4.x (pre-installed on all modern Windows)
⚠️ Do this before running. The network engine will terminate untrusted processes with external connections.
Open the script and locate the ZERO-TRUST CONFIGURATION section:
$Script:WhitelistedNetworkProcs = @(
"chrome", "firefox", "msedge", # Browsers
"vscodium", "code", # Editors
"ollama", # Local AI
"svchost", "mpdefendercoreservice", # Windows System
"telegram", "discord", "spotify", # Apps
"putty", "python" # Dev Tools
# ADD YOUR OWN SOFTWARE HERE (lowercase, without .exe)
)Locate the THREAT INTELLIGENCE SYNC section. The default 9 feeds are pre-configured. Add custom feeds that return plain IPv4 lists:
$feeds = @(
"https://feodotracker.abuse.ch/downloads/ipblocklist.txt",
# ... existing feeds ...
# ADD YOUR OWN FEEDS HERE (plain IP list format, one per line)
)Feeds sync every 4 hours in a background job.
# Right-click → Run with PowerShell (as Administrator)
# Or from an elevated terminal:
powershell.exe -ExecutionPolicy Bypass -File .\vgt-mhx.ps1The daemon will auto-elevate, hide its console window, register a Scheduled Task (VGT-MHX) for autostart, appear in the system tray, and immediately begin the TI feed sync.
| Menu Item | Function |
|---|---|
| VGT Command Center (Live HUD) | Opens the native GDI+ dashboard with live log viewer and telemetry |
| Raw Incident Log (Notepad) | Opens the raw incidents.log file |
| Aktive Threat-IPs exportieren | Exports the full live TI IP cache to a text file |
| Hunter Core beenden | Cleanly shuts down the daemon |
All detections are written to C:\ProgramData\VGT_Omega\incidents.log (UTF-16LE) and to the Windows Event Log under source VGT-MHX.
| Event ID | Type | Meaning |
|---|---|---|
100 |
Information | MHX core initialized successfully |
101 |
Information | Threat Intel sync completed — N IPs loaded |
202 |
Warning | Untrusted process with external network connection |
203 |
Error | Masquerading — known process name, wrong executable path |
204 |
Error | Suspicious DLL loaded from Temp directory |
301 |
Error | Critical process lineage breach |
666 |
Error | KillerDom strike — malicious command-line detected |
900 |
Error | C2 beacon intercepted and connection terminated |
999 |
Error | AMSI memory patch detected — process neutralized |
| Component | License |
|---|---|
| MHX Core (PowerShell daemon, detection engines, TI sync, UI orchestration) | AGPLv3 |
C# Native Engine (VGT.Omega — Win32TokenXDR, MemoryScanner, VGT.UI — OverlayManager, NotificationForm, DashboardForm) |
MIT |
| Tool | Type | Purpose |
|---|---|---|
| 🔬 VGT MHX | R&D / Experimental | Behavioral EDR daemon — AMSI, Lineage, Network, KillerDom |
| 🔥 VGT Windows Firewall Burner | Preventive | 280,000+ APT IPs blocked in native Windows Firewall |
| 🔍 VGT Civilian Checker | Audit | Windows security posture assessment |
| ⚔️ VGT Auto-Punisher | Linux R&D | Experimental userspace IDS for Linux servers |
| 🛡️ VGT Sentinel | WAF / IDS | Zero-Trust WordPress security suite |
Pull requests welcome. For major changes, open an issue first.
Licensed under AGPLv3 — "Open Source. Open Knowledge."
VisionGaia Technology is an R&D collective exploring experimental architectures, AI integration, and cybersecurity paradigms. We build to learn, we break things to understand them, and we share the results.
VGT Malware Hunter X-Ray v4.0 DIAMANT APEX — Experimental Windows EDR // Native GDI+ OSD Engine // Process Lineage + KillerDom + Zero-Trust Network + AMSI Memory Integrity // Ouroboros Fix Applied