vx-underground – Telegram
vx-underground
45.8K subscribers
3.93K photos
418 videos
83 files
1.43K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
This is pretty much what it's like dealing with malware droppers

You're like, oh sweet, it's a kitty cat. But then you discover it's actually a barrage of kitty cats and that's fine but you didn't expect so many at once
😁10838🥰13🤓3👍2😱2😢1😇1
The naming convention "Trojan" easily confuses people i.e. Remote Access Trojan. Unfortunately, due to successful media campaigns, the term Trojan is now closely affiliated to condoms.

Instead we petition to formally change the term to something which is reminiscent of the term "Trojan Horse", and carries the same meaning

Suggestion: Horse

Example(s):

- Remote Access Horse
- Sophisticated Horse
- "... The Threat Actors inserted a Horse payload into the Word document..."

Laymen can easily identify a horse and they will understand the concept of a horse on the loose is very dangerous. You can explain to customers there is a horse loose in their computer and the horse is causing serious damage.
🤣12540💯9🤝7👍5🔥5🥰1😢1
vx-underground
The naming convention "Trojan" easily confuses people i.e. Remote Access Trojan. Unfortunately, due to successful media campaigns, the term Trojan is now closely affiliated to condoms. Instead we petition to formally change the term to something which is…
Imma be real with you, Chat. I've been unfathomably busy IRL and it's brought me immense joy schizo-posting satirical nonsense to thousands of people.
❤‍🔥129🥰209👍8😇3😁2🤔2😢1🫡1
Updates to the vx-underground collection:

- 2011-07-04 - Mixing x86 with x64 code
- 2018-04-11 - WoW64 internals
- 2023-04-19 - WOW64 Callback Table - FinFisher
- 2025-04-16 - Control Flow Hijacking via Data Pointers
🔥305🤓1
Earlier today we shared some information on a CEO of a cybersecurity company in Oklahoma, United States, allegedly intentionally deploying malware to a healthcare facility in Oklahoma City.

More details have been presented which paint a different picture than what was originally shared and it kind of complicates the issue presented.

Jeffrey Bowie, the Chief Executive Officer of cybersecurity firm Veritaco, had a warrant for his arrest issued by the United States Federal Bureau of Investigation for allegedly intentionally deploying malware to a client of Veritaco (St. Anthony Hospital). Interestingly, the FBI did not immediately notify Mr. Bowie of the arrest warrant — however they DID notify local media new stations. Mr. Bowie was informed of his arrest warrant by friends, family, and colleagues rather than law enforcement themselves.

Mr. Bowie has publicly released the "source code" of the malware allegedly deployed on the healthcare facility (attached image). The "malware" is a powershell noscript which takes images of the desktop computer every 20 seconds then sends the images back to a remote server owned by Mr. Bowie. The powershell noscript was deployed onto 2 machines in the healthcare facility and set to run via Windows task scheduler.

Mr. Bowie asserts the endpoint the "malware" sends data to was terminated in August, 2024. Hence, the code present is basically worthless.

1 of the computers (Computer "A") was publicly accessible and specifically designated for guests to use.

The 2nd computer (Computer "B") remained unlocked (???) was designated for sending and receiving PHI (?). Mr. Bowie asserts "unlike Computer A, no software was written."[sic]

Mr. Bowie has (as of this writing) not explicitly stated why the powershell noscript took screenshots every 20 seconds. Additionally, no details have been shared as to how long this "malware" has been present on machines.

Mr. Bowie asserts local media outlets have defamed his character and has stated he has placed his faith in judicial system and God to deem him not guilty of any wrong doing.

Image 1. of "malware" source code
Image 2. of him informing the hospital he has removed the "malware" from the 2nd computer
🤣68🤔11👍8😢52🤯2💯1
vx-underground
Photo
Have deleted opinionated post.

More details have emerged which allegedly depict Mr. Bowie walking around a healthcare facility trying to get access to machines without hospital authorization.

No idea what's going on. All we know is Mr. Bowie should hire a lawyer.
😁50💯15🤣12👍1😢1
Updates to the vx-underground collection:

- 2007-01-15 - Using the .NET runtime for file infection
- 2007-01-15 - Polymorphic Mutation in Powershell
- 2007-07-11 - Playing with JScript for pun and fropit
- 2007-07-17 - Writing a Polymorphic Mutation Engine in C Sharp
🔥33👍61😢1🤝1
We should do some kind of weird impromptu malware meetup. Like, we all show up at an anime store or something and exchange our favorite pictures of cats.
🤣79🥰17🤝103🔥2😢1
vx-underground
We should do some kind of weird impromptu malware meetup. Like, we all show up at an anime store or something and exchange our favorite pictures of cats.
the anime store owner seeing a tsunami of stinky nerds holding pictures of cats enter their store
😁83🥰12🎉5🤓3❤‍🔥2👍1😢1
Updates to the VXUG collection:

- 2020-08-15 - Kernel Mode TCP Sockets LSASS Dump
- 2025-01-05 - Reliable system call interception
- 2025-01-19 - C2 infrastructure on AWS
- 2025-01-23 - Pitfalls of COM activation
- 2025-01-23 - Operating Inside the Interpreted - Python Malware
🤣24🔥7👍52😢1
vx-underground
Updates to the VXUG collection: - 2020-08-15 - Kernel Mode TCP Sockets LSASS Dump - 2025-01-05 - Reliable system call interception - 2025-01-19 - C2 infrastructure on AWS - 2025-01-23 - Pitfalls of COM activation - 2025-01-23 - Operating Inside the Interpreted…
Malware paper statistic breakdown:

Windows malware development papers:
721 papers

Malware analysis papers:
12,293 papers

Linux malware development papers:
65 papers

ICS/SCADA malware papers:
94 papers
👏40❤‍🔥12👍42🔥1🤣1
vx-underground
Malware paper statistic breakdown: Windows malware development papers: 721 papers Malware analysis papers: 12,293 papers Linux malware development papers: 65 papers ICS/SCADA malware papers: 94 papers
hOw Do I lEaRn MaLwArE StUfF

If you're new to malware stuff, and want to learn malware stuff, go to our paper collection.

If you read 10% of our malware analysis paper collection (took notes, seriously understood it), you'd be a fuckin' monster.

If you know how to code (Python, C, C++, .NET), and visit our malware development section and read about 40% of the papers (took notes, seriously understood it), you'd be a fuckin' monster.

You'd have a powerful understanding of malware analysis, malware development, the malware threat landscape, malware threat groups (state-sponsored or financially motivated). You'd jump from absolute noob dumbie to Subject Matter Expert lightning fast.

Unfortunately, this also requires you to lock in pretty damn hard. You'd have to seriously dedicate yourself. However, if you could do 2 or 3 papers a day, in about 12 months, you'd be ridiculously well versed in malware. But you'd (probably) burn and crash out pretty fast at this rate because the amount of information you'd be ingesting would be astronomical.

Anyway, if you want to actually learn, we have a massive-fuck-off-library of malware educational resources waiting for you.
140🔥36👍11😎6🤝4❤‍🔥3😢1
vx-underground
hOw Do I lEaRn MaLwArE StUfF If you're new to malware stuff, and want to learn malware stuff, go to our paper collection. If you read 10% of our malware analysis paper collection (took notes, seriously understood it), you'd be a fuckin' monster. If you…
For the record, we've known a few people to actually lock in and actually dig through the library. We know C5pider has read quite a bit from it, he ended up making Havok C2 and being big brain. He also know rad9800 read a bunch of it, he's also insanely big brain.

Both these dudes are like, 20 or something, and are dangerously smart.

We also know 5mukx has been locked in pretty hard and digging through the library too. He's taken the painful task of translating and re-writing the C/C++ code into Rust to improve his understanding of malware and improve his Rust programming skills.

Shoutout the young bloods. They got so good, we've been adding their content and research into the library now.
❤‍🔥12722👍9👏7🔥4😢1🤝1
JEFFREY, STOP TALKING DAWG

(╯°□°)╯︵ ┻━┻
🤣146🔥18😎10💯6👍3🤔2😢2🤓2🫡2🎉1🤝1
JEFFREY, THIS ISNT A VALID LEGAL STRATEGY

STOP. TALKING.
🤣171🫡20😢13🤔54👍4😁3🙏3😱2🎉2🤓1
This is important information pertaining to cybersecurity and artificial intelligence
🔥161💯17👍11😍9🥰6🫡61❤‍🔥1😢1
This media is not supported in your browser
VIEW IN TELEGRAM
In a bit of irony, the famous 2004 commercial "Piracy, It's A Crime", used pirated font.

It was discovered by a Redditor (and later confirmed by various news outlets), that the font used in the advertisements uses "Xband-Rough" by Just van Rossum. The font that was supposed to be used was "FF Confidential" by Just van Rossum

Sky News reached out to Just van Rossum for comment, Just van Rossum stated "[he] wasn't concerned". Additionally, per media outlets, there is currently no evidence on whether or not "Piracy, It's A Crime" intentionally pirated the font.

However, there is no legal clause that grants exemptions based on accidental copyright violation (although enforcement varies, Mr. van Rossum likely will not press charges)
🤓80🤣6710😁9👍4👏1😢1
This media is not supported in your browser
VIEW IN TELEGRAM
Awhile back we met this guy on Twitter. He had like, 1,000 followers (relatively unknown). He was making posts about using AI to cheat coding interviews and getting jobs. He memed the entire thing. He dropped out a very prestigious university to continue this idea on memeing job interviews with AI.

We spoke with him on Twitter, discussing specifications on his ideas. We memed. Sent cat pictures.

Fast forward, he's now rich. What the fuck? How do we meme our way to $100,000,000?
🤣150🤯2017🤓4😢3👍2🤔1