vx-underground – Telegram
vx-underground
45.6K subscribers
3.92K photos
416 videos
83 files
1.42K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
vx-underground
40 minutes ago Los Angeles county officials stated on television they're working with partners to stop the false and/or incorrect evacuation warnings people are receiving WHICH ARE NOT happening from human interaction (???) They're currently investigating…
We don't want to get all crazy-whacko-conspiracy-theory, but this sure would be a great time for an adversary of the United States to cause chaos and/or spread misinformation.
🤓49🤣15🔥54👍3🤔2😁1🤯1😢1🤩1
The Sims allows your character to learn how program by writing malware
❤‍🔥118😁41🤣6🤝6👍4🔥31😢1
🤣278🤓45🤔11😁9👏8🤯7🔥5👍1😱1😢1
🤣215😁16🤯65👍2😢1
This image is a perfectly analogy for most enterprise compromises — a "sophisticated attacker" was NOT a state-sponsored Threat Actor. It was just a fat cat.
🤣152💯105👍5😁4🔥1😢1
Thank you, Vietnamese government representative, for the lovely e-mail.
❤‍🔥213😁33🤣20🤓13🥰7🔥63🤔2👍1😢1
hacking is illegal and for nerds
🤓188🤣34👍16🔥5😁5💯43😢3😎1
Hello,

This is a reminder that if you're a politician representing your country in the UN — you should avoid information stealer malware.

You should also avoid soliciting sex with male prostitutes on social media in private DMs.
🤣150💯16🤔10🤯5👍31😢1🤓1🫡1
Thank you, California government employee, for the cool e-mail and cool pictures
184🤣50😁7❤‍🔥2🥰2👍1🔥1😢1🤓1
me explaining to my kids what it was like using dial up internet
😁109🤣34🤓14🙏73👍1😢1
Hello,

Our backend is currently down because we're migrating hosts. Our frontend is still up, hence why you can see the "BBIAB" message.

tl;dr used too much data, moving to dedi

non-tl;dr (long read)

We initially used Wasabi as our backend because it's cheaper than a lot of hosting providers. Wasabi is good if you have data stored, but you don't intend on your egress exceeding what is currently being stored. Your egress exceeding what is stored is a violation of Wasabi terms-of-service specifically in their data usage section.

Under normal conditions, due to our Cloudflare enterprise which was gifted to us from Cloudflare, we would not exceed our data storage in egress and everything would be fine and dandy. However, as we've begun aggregating malware for our virus exchange domain, we've begun consuming egress and data usage at a high rate. Our current flow works something like this:

1. Get file (malware malware, maybe not malware)
2. Submit to virus exchange database via API
3. Data goes inside virus exchange database
4. Data sent to VirusTotal for scanning
5. Wait 60 seconds (async, other files sent too)
6. Query VirusTotal results
7. If file is malware, store in database as SHA256
8. If not malware, dispose of file
9. Copy confirmed malware from virus exchange bucket to vx-underground malware ingestion bucket
10. File placed in daily ingestion queue data directory

Each day every malicious file received is thrown in a directory labeled the current date — usually named something like "Malware.{Year}.{Month}.{Date}". We eventually pull these directories down from our bucket using the AWS CLI and 7z ultra compress them. Once we 7z ultra compress them we move them to local backup instances. Once backup is completed we push it back to the vx-underground backend prod environment.

We began receiving warnings from Wasabi when we were ingesting 50,000 - 100,000 malware samples a day. We scaled it back to 15,000 - 30,000 malware samples a day. This still irritated them, so we now have to move to a new host who won't charged us a fortune for processing and moving so much data internally and externally.

We ultimately decided to move to TorGuard because they're a sponsor of ours, we have a good relationship with them and their team, and they're going to help us out with some malware-related stuff. We had planned on eventually moving to their infrastructure for awhile but we kept delaying it because moving so much data, modifying so much of our internal procedures, and laziness, made us dread the move.
👍64🫡18🤓7🙏64🤣4😢1
It's wonderful seeing people produce creative educational content.

Thank you, endingwithali for highlighting this exceptionally talented programmer and their unique educational courses

Had to censor the image though because of all the peepees, butts, and boobies
😁111🤣47🤓32👍6👏4❤‍🔥21😢1
> get letter in the mail
> from health insurance place
> oh_no.png
> open mail
> health insurance company says data was in a security breach

oh thank god, was worried it was something important
😁158🤣23💯168🤓2😢1🫡1
vx-underground
> get letter in the mail > from health insurance place > oh_no.png > open mail > health insurance company says data was in a security breach oh thank god, was worried it was something important
This is the United States of Ameriburger, was worried the health insurance company was going to charge me $45,000 for that time I visited my doctor for a check-up
🤣114🤯13💯11🤓3👍2
All services will be restored on Wednesday.

Thank god, we're bored as hell
😘51🤣10🤓8👏72👍2🎉1
This media is not supported in your browser
VIEW IN TELEGRAM
82🤣55🥰4😢4👍3👏3🔥2🎉2🤓2💯1
Top free apps right now in the United States on the Google Play Store

Chat, we are cooked (Lemon8 is owned by TikTok)
🥰76🤣57😱12🫡8😢6🎉3❤‍🔥2👍2😁2👏1🤔1
Channel photo updated
new year, new me
306🤣99🥰31😢30😎17🤯14🫡13🎉8🔥7😁5❤‍🔥4
🤯118🥰24🤓15🤔106👍6❤‍🔥1🫡1😘1
RansomHub ransomware group claims to have ransomed EUROCERT*. However, we believe this name is misleading because the domain listed, EUROCERT-dot-pl, does not appear to be an authority of the European Union.

(We have no idea how the EU works, maybe wrong)

Info via AlvieriD
🫡45🤣18🤔10👍65🤓4😢1😘1