Today the NCA UK was discussing Operation Cronos (the takedown of Lockbit ransomware group) at SLEUTHCON – and for a brief moment in time we were on TV.

The cherry on top was the VX-UWU design as the profile picture.

Hello, how are you?

1. Our shipment of harddrives is on the way. We are expecting them sometime next week. Once they are received the cloning process will begin.

2. Bradley is OOO (like a loser), so giveaway winners and selections are briefly delayed

3. I love you

Here is some code that was written about a year for a project for vx-underground. However, due to various reasons, the code is being publicly released.

tl;dr recursive loader, painful to reverse engineer

Explanation of code:
The following code is inspired by APT Linux/Kobalos. Kobalos was malware, suspected to be tied to the Chinese government, which was fully recursive. It was novel malware.

Following this inspiration, an x64 recursive loader was developed for Windows 10 and Windows 11. When compiled the binary has no entries in the IAT. The binary resolves all APIs via NTDLL. Additional libraries are loaded via LdrLoadDll.

The code recursively calls itself to execute functions. It determines which portion of code to execute using a flag (an enum). Each 'function' is encapsulated in a switch statement. All variables are recursively passed using the 'VARIABLE_TABLE' structure. The VARIABLE_TABLE also contains further nested structures for handling API function resolving, initializing COM objects and associated classes, and data structures for some 'switch functions' which may require additional variables for tasks.

To avoid the compiler optimizing code and introducing functions into the IAT, some STDIO functionality such as ZeroMemory have been re-written in more unorthodox methods.

HTTPS requests are handled by COM via the WinHttpRequest Object.

The code basically downloads a binary from vx-underground and executes it. Currently the code will not work because the executable hosted on vx-underground for the proof-of-concept is no longer there – although it was just a copy cmd.exe.

Code may have some bugs. It can be improved upon by introducing pseudo-polymorphism by 'scrambling' the order of switch statements and enum values on each build.

Code written by smelly

You can checkout Win32.RecursiveLoader.b here: https://pastebin.com/HSTS2zwL

At the end of the day every alert looks like this to a SOC Analyst

No idea what this even means, we really liked this kitty and just tried to make something work

Lots of updates coming on Monday.

Also, people have begun receiving their giveaway swag. We still have more people to select, but giving away $1,000 worth of merch is actually kind of time consuming.

Anyway, someone said their cat now uses the shirt for naps

Today Donald Trump, former United States President who is seeking re-election, stated he vows to commute the sentence of former SilkRoad founder Ross Ulbricht

More information: https://www.coindesk.com/policy/2024/05/26/trump-pledges-to-free-silk-road-creator-ross-ulbricht-if-re-elected/

Google AI being 💯💯💯

Good morning.

Today is the day of rest. We hope all of you have enjoyed your weekend thus far. We will see you all on Monday.

Love you

It's time for your quarterly, and mandatory, continual education video from your HR department.

You sit down, play the video, and this what you learn about data backups:

Someone reported one of our posts as ??? to Xitter which resulted in us receiving this e-mail this morning.

Presumably, our Google AI meme/mock post was reported as imagery which promotes self-harm.

Anyone who is capable of exercising any sort of critical thinking skills is capable of understanding the information displayed from the Google AI is innately false. It does not reflect an intelligent, informed, or well-minded advice to any individual having thoughts of self-harm or thoughts of harm toward others.

If you do not find humor in the absurdity of botched AI learning, while AI continues to be hailed as an omnipotent technology which will solve all problems, displaying wildly inappropriate and inaccurate information funny then ... ¯\_(ツ)_/¯

Not that big of a deal, dawg. If you're genuinely unhappy with it, unfollow us or something, we're just vibin' out trying to find humor in the everyday technological chaos.

This took like 10 minutes is ms-paint. This better get 18,446,744,073,709,551,615 likes (2^64 - 1)

Someone found a Facebook post from 2006.

In 2006 this setup was insane.

They've also got an N64, the CRT monitor on the floor, and the CD collection rack. This guy was ballin' out

Torrents:
- vxunderground.HD.Samples.VirusSign.Collection
- vxunderground.HD.Samples.Twitter.IOC.Collection
- vxunderground.HD.Samples.Families
- vxunderground.HD.Samples.Bazaar.Collection
- vxunderground.HD.Samples.ATM.Malware
- vxunderground.HD.Samples.Argus.Collection
- vxunderground.HD.Papers

Samples:
- VirusSign.2024.05.23
- VirusSign.2024.05.24
- VirusSign.2024.05.25
- VirusSign.2024.05.26
- VirusSign.2024.05.27
- InTheWild.0124

Papers:
- 2023-09-21 - Secrets of commercial RATs! NanoCore dissected
- 2023-11-13 - Decrypting the Mystery of MedusaLocker
- 2023-11-26 - From Infection to Encryption- Tracing the Impact of RYUK Ransomware
- 2024-05-07 - Cybercrime's Anatomy Threats to the Healthcare World
- 2024-04-24 - Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware

In the past couple of days we have received nearly 100 of these types of messages.

When we click the link is just directs us to YouTube. What the hell kind of spam campaign doesn't even deliver malware 😭