vx-underground – Telegram
vx-underground
45.7K subscribers
3.92K photos
416 videos
83 files
1.42K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
Crazy to think Julian Assange got freed before GTA VI or Elder Scrolls VI
82😁39🤣27🤯8🙏8❤‍🔥2😢2
Live stream started
Live stream finished (25 seconds)
Apologies – was testing something on Telegram. I'm sorry if that sent out a broadcast message.
😁49🤣206❤‍🔥4🤓4😢2🫡2😘1
No major updates, news, or memes. Right now we're very busy (that's a lie, we're just being lazy)
🔥51🤣168👏6😢3🎉2🤓1
June 11th a Microsoft engineer accidentally leaked 4GB of Microsoft PlayReady internal code. It was leaked on the Microsoft Developer Community. The leak includes:

- WarBird configurations
- WarBird libraries for code obfuscation functionality
- Libraries with symbolic information related to PlayReady

Researchers from AG Security Research Lab were able to successfully build the Windows PlayReady dll library from the leaked code. Interestingly, they were assisted because on the Microsoft Developer Community forum a user also provided step-by-step instructions on how to begin the build process.

Also, interestingly, interestingly, the Microsoft Symbol Server doesn't block requests for PDB files corresponding to Microsoft WarBird libraries, which inadvertently leaks more information.

Adam Gowdiak of AG Security Research Lab reported the issue and Microsoft removed the forum post. However, as of this writing, the download link is still active.

File listing is below. Forums screenshots are attached. All information discovered by AG Security Research Lab

File listing: https://pastebin.com/raw/i65qfd2z
😁498🎉7👍4🫡3💯1
wtf bro, seriously?
😁108🤣42🤓16😱74😢4🫡3👍1
Today BianLian ransomware group claimed to have ransomed the Better Business Bureau

🧐🧐🧐🧐🧐
🔥30😁8🤣52👍2😱2
> check tg
> check dms
> get message from someone saying theyre owner of vx-underground (wtf thats me)
> me tells me im the new ceo (wtf)
> me tells me to check my email

Weird social engineering attempt
😁95🤣92🤓8👏63😢1
Today Lockbit ransomware groups 'timer' on the 'Federal Reserve' hit zero. They did not ransom the Federal Reserve as we expected – they ransomed Evolve Bank & Trust.

We also assume the data is not critical because the facility is still operational.
🤣133🫡11😢6😁1
vx-underground
Today Lockbit ransomware groups 'timer' on the 'Federal Reserve' hit zero. They did not ransom the Federal Reserve as we expected – they ransomed Evolve Bank & Trust. We also assume the data is not critical because the facility is still operational.
As reference: we expressed extremely skepticism with Lockbit ransomware groups claims. We suspected the affiliate (who probably doesn't know English) saw a document that said "United States Federal Reserve" and thought it was that.

https://x.com/vxunderground/status/1805214817625530613
🤣79💯6😢1
In the past 30 days vx-underground has had 59,000 unique visitors, served 5,590,000 requests, and delivered 408TB of malware.

It cost you $0 because we have cool sponsors and cool monthly supporters.
179🫡18👍6🤣5👏1😢1
When we find the guy who did the documentation for IActiveScript and IActiveScriptParse64 on MSDN
😁57👍43👏2🤯1😢1🤝1
> wake up
> check news
> yet another ransomware group (brain cipher)
> polyfill supply chain attack infecting 100k websites
> more ransomware attacks
> people mad google is stopping cia / nsa operations
> cdk global ransomware drama continues
> more malware being malware
👍46🔥6🤣63🤓2😢1
vx-underground
When we find the guy who did the documentation for IActiveScript and IActiveScriptParse64 on MSDN
tl;dr exploring executing vbnoscript and jnoscript in-memory from a binary in c++. modexp did a c project on it, explored possibilities of it. worked with vbnoscript, imploded on jnoscript with hresult 0x80020101

got annoyed

heres the vbnoscript code that works: https://pastebin.com/raw/dW3w97Bx
17🤔2🤓2😢1
This media is not supported in your browser
VIEW IN TELEGRAM
When the Security Team catches a Threat Actor actively trying to compromise a machine
🤣153🫡16😁9🥰3😢2🤔1🤝1😎1
🤣21211🔥8🫡3😁2😱2👏1🤯1😢1
Families that commit state-sponsored-cyber-espionage stay together ❤️

Father: Tim Vakhaevich Stigal, wanted by the United States Secret Service

Son: Amin Timovich Stigal, wanted by the United States Federal Bureau of Investigation
🔥79🥰279🤣8❤‍🔥5😢4💯2👍1