vx-underground
51K subscribers
4.48K photos
484 videos
84 files
1.56K links
The largest collection of malware source, samples, and papers on the internet.

Password: infected

https://vx-underground.org/
Download Telegram
Dawg, the Peter Stokes affadavit (nerd from Scattered Spider who was arrested) is fucked

This dude was on Snapchat sending people pictures of him with stacks of money, expensive hotels, jewelry, etc.

My Brother in Christ, they've got you dead to rights because of your flexing. You're going to do 40 years in prison now, 20 years if you beg for forgiveness. Why did you flex on Snapchat?

When he's released from prison he's going to be 40 years old (if he's lucky) and all of his Telegram homies are going to be gone. Telegram, Discord, Snapchat, etc may not even exist anymore.

Think of how much changes in 20 to 40 years. Now imagine that time being passed while sitting in a box with all white walls and steel bars.
🀣93🫑25❀21😒18😁4😱4πŸ‘1πŸ˜‡1😘1
Still thinking about the time I went to BestBuy. I was in a pinch and needed to buy some computer stuff fast.

The guy behind the counter tried making an up-sale and pitched me some anti-virus product. He said it's good and protects you from viruses

I looked him straight in his eyes and said, "What? But I want the computer viruses on my computer"

He looked right back at me and just said "Okay".

He looked at me like this:
πŸ₯°142😁74🀣33❀7🀯1😒1πŸŽ‰1🀩1πŸ’―1
On Tuesday, June 30th, Jennifer Gibbons, Vice President of State Government Affairs for ESA (Entertainment Software Association) testified before the United States California Senate regarding Minecraft and Call of Duty private servers, which she claims are actually piracy.

Gibbons told the California Senate these private servers are unsanctioned. She is representing the video game industry in the United States and vehemently opposes the recently introduced Protect Our Games Act, the United States version of Stop Killing Games.

She referred to Minecraft private servers as "The Black Market".
🀣188😱12❀6😒5πŸ₯°2πŸ‘2😁1πŸŽ‰1
vx-underground
On Tuesday, June 30th, Jennifer Gibbons, Vice President of State Government Affairs for ESA (Entertainment Software Association) testified before the United States California Senate regarding Minecraft and Call of Duty private servers, which she claims are…
Thinking of hosting a private Minecraft server? Think again. That is ILLEGAL. You're operating A BLACK MARKET OF CRIME.

Do it and you could end up like this, buddy. It's all over for you and your band of criminal misfits *check notes* building a cool looking fort
πŸ₯°110😱30🀣27❀7😁7😒1πŸ™1🫑1
I'm not sure what's going, but from my European and South American colleagues, I have developed a sudden interest in the FIFA World Cup.

It might be over for me. I can feel the Europeans draining the cheeseburger from my blood (I don't know anything about FIFA).
❀52🀣36πŸ₯°8😒3πŸ€”2πŸŽ‰1
vx-underground
I'm not sure what's going, but from my European and South American colleagues, I have developed a sudden interest in the FIFA World Cup. It might be over for me. I can feel the Europeans draining the cheeseburger from my blood (I don't know anything about…
Media is too big
VIEW IN TELEGRAM
I'm not going to lie, I saw the Mexican people going absolutely schizo when Mexico defeated Ecuador and I thought to myself, "wtf thats badass, i want to be proud of the united states and go crazy af in the streets with random people".
❀69πŸ”₯19🀯8😒5😁4πŸ€”2πŸ₯°1🀣1πŸ€“1
Honestly, if you're wanting to get into malware development and malware reverse engineering (specifically in regards to Windows), I think the most important thing you can learn is the concept of a file.

1. What is a file extension? This is pretty obvious, .exe, .pdf, .mp3, etc.

2. How are file extensions handled? This would introduce the idea of the Windows registry and how extension querying is handled vs. the Windows loader

3. Which file extensions (or file types, rather) are used for payload delivery? e.g. .exe, .dll, .xll, .vbs, .ps1, .py, .lua, .docx, .vcproj, etc. The .exe, .dll, (and other native types, like .sys) will be sort of self-explanatory, but the others would introduce different malware delivery mechanisms (malicious files) and potentially wiggle in the concept of payload smuggling.

4. Each of the previous listed file types are different. How are they different? .exe and .dll (and many others) are native to Windows and handled by the Windows loader. Why are the others still considered executable files? This is when you slowly step into interpretive languages and VM dependency (JVM, PVM, etc).

Somewhere in this you would eventually stumble into the Windows PE format, how the PE format is different for .NET binaries, how Electron .JS executables act differently, weird stuff like .docx file internals, etc.

Basically, I think understanding files and how they're handled is an excellent starting point and sets the stage for what will happen next.

pic unrelated
❀130πŸ™17πŸ‘6πŸ₯°5πŸ”₯2πŸ’―2🫑2❀‍πŸ”₯1😒1
Doctor: Take this medicine at night to help you sleep

Me: Okay

Doctor: Oh, and by the way, if you have a sudden erection which is painful and won't go away, it's from the medicine. Immediately seek medical attention. Go the Emergency Room

Me: Okay
😁145🀣51❀12😱5πŸŽ‰4πŸ₯°2
> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging
🀯200😱28🀣13❀9πŸ₯°7😒3😁1
vx-underground
> Peter Stokes > Scattered Spider guy > Arrested > Microsoft helps FBI > Read court documents > Page 12 > Microsoft tracks Stokes from GDID > Microsoft Global Device Identifier (GDID) > Stokes used Windows > Page 34 > GDID assigned to each OS install > GDID…
Chat, I don't want to sound like a schizo, but it sure is STRANGE how much data Microsoft collects with it's telemetry functionality. It's very odd Microsoft documents and records all of your web browser activity, and gaming, and can tie it to your social media, so they can improve your "Windows Experience".
πŸ₯°108🀯46😱19🀣17❀12πŸ€”9πŸ’―8😒3πŸ™2πŸ‘1πŸŽ‰1
The United States is 250 years old.

To celebrate this occasion, we will be giving everyone two hundred and fifty (250) malwares.

God Bless
πŸŽ‰244🀣54πŸ₯°21❀10😁5πŸ‘2🀝2❀‍πŸ”₯1πŸ”₯1😒1
We're slowly convincing the youth to autismmax via silly pictures of cats.
πŸ₯°171❀31😍10😁5🀣4🫑3❀‍πŸ”₯1πŸ‘1😒1😎1
Chat, today is a good day.

Look at this "Grand Theft Auto 6 BETA for FREE" advertisement that fell onto my lap. It delivers a .rar that has a .exe inside.

I am so happy. I am elated. It is free malware.
❀133🀣74πŸ₯°17πŸ”₯8πŸ‘3😒1
vx-underground
Chat, today is a good day. Look at this "Grand Theft Auto 6 BETA for FREE" advertisement that fell onto my lap. It delivers a .rar that has a .exe inside. I am so happy. I am elated. It is free malware.
Literally shaking, screaming, crying, THROWING UP.

The .exe is bundled with BUN (some Javascript bullshit). I deobfuscated the main goop inside of it, found the C2 configuration (where it downloads cool malware from), and ... it's dead.

Cloudflare KILLED THEIR C2. THE MALWARE IS DEAD. THEY KILLED THE MALWARE CAMPAIGN.

How are we supposed to get malware from fake Grand Theft Auto 6 advertisements if Cloudflare KILLS their infrastructure???

RIP NWHStealer campaign ID 202fdde5193b.
RIP NWHStealer c2 unauth-amper(.)cc
🀣166😒23❀18🫑5😁4πŸ₯°2🀝2πŸ’―1
vx-underground
Literally shaking, screaming, crying, THROWING UP. The .exe is bundled with BUN (some Javascript bullshit). I deobfuscated the main goop inside of it, found the C2 configuration (where it downloads cool malware from), and ... it's dead. Cloudflare KILLED…
I only have one question though... This malware kills itself if it detects the following strings:
- sandbox
- sand box
- malware
- virus
- maltest
- peter wilson (??????)
- paul jones (??????)

who THE FUCK is peter wilson and paul jones???
🀣209😁22❀15😱5πŸ€”3πŸ₯°1😒1
🀣137πŸ”₯27πŸ€“14❀10πŸ’―7πŸ‘5πŸ₯°5🀝3😒2πŸŽ‰2
I'm on the weird part of the internet reading about Termite microbiomes

Now I'm frustrated scientists haven't conducted more research into biotechnologies that allow humans to extract nutrition from woody stuff like lignin

tldr why science man no let us eat wood wtf
πŸ”₯94😁34πŸ’―16❀8🫑8πŸ₯°2πŸ€”2πŸŽ‰2🀣1
The fact the United States Department of Homeland Security took down an anime streaming website, and arrested the websites administrators, can only mean one thing.

Weebs pose a serious threat to the United States government. They're dangerous. They must be contained.
🀣196πŸ’―16πŸ€”10😒7😁6❀4🀯4πŸŽ‰2πŸ₯°1
Last time on Dragon Ball Z: I made a long ass post discussing my Benzodiazepine dependency. Lots of people sent me DMs, or left comments, calling me "brave", or something (is addiction and/or dependency taboo or something?). People also DMd me saying they also have Benzodiazepine dependency but were too scared to try to taper due to how dangerous the drug can be.

Behind the scenes I've basically been a test dummy for some people. Let me share with all of you how cool and badass my taper has been

> be me
> on benzos for 14 years
> not supposed to do more than 90 days
> everyone like "wtf bro"
> decide to do 25% reduction in dosage
> people call me crazy
> withdrawals start after two days, or something
> day two arrives
> insanely high anxiety
> heart sometimes races
> sometimes feel really hot
> sometimes legs feel like jelly
> sometimes really grumpy
> weird withdrawals arent nonstop
> comes in waves seemingly randomly
> sometimes better, sometimes worse
> not too bad, honestly
> really, really, really bad insomnia tho
> day five
> every clams down
> shrimple, not too bad
> consult with addiction specialist to help insomnia
> give me sleeping pills (trazadone)
> "go to hospital if you get dangerous erection"
> okay?
> hold previous 25% cut for a few weeks
> decide to aggressively taper again
> another 25% cut
> total reduction would be 50%
> start
> day two arrives
> feel really sad
> doesnt feel like depression
> feel "blue", just low energy and kind of mopey
> everything in my life great
> no reason to be sad
> legs sometimes feel like jello
> anxiety back
> heart race sometimes
> heart sometimes beat really hard
> mostly really sad

The sadness feels like I'm a 14 year old boy in math class whos crush (Susie Bananas, straight A student, champion of the Spelling Bee) recently told you in secret she has a crush on Joseph FastFeet (fastest kid in school), and now you're sad and have to listen to really emo music in your bedroom while your parents make you pancakes for dinner. It's not crippling depression, but you just feel kind of emotional.

The weird heart beat thingie is like, you'll be laying in bed and it's like your heart turned the bass up to fuck off level. I'm in bed and it feels like my heart is punching the mattress through my back. It's interesting.

Overall the taper hasn't been too bad.

Pic related: what my anxiety feels like during taper (just cat crushing the planet).
❀135🫑29πŸ™11😒9🀣6πŸ₯°3πŸ”₯1πŸŽ‰1
vx-underground
Last time on Dragon Ball Z: I made a long ass post discussing my Benzodiazepine dependency. Lots of people sent me DMs, or left comments, calling me "brave", or something (is addiction and/or dependency taboo or something?). People also DMd me saying they…
But for real, I had sooooo many DMs of people telling me about their dependency on anxiety medications. People seemed scared to discuss it? Dawg, EVERYONE knows SOMEONE with dependency and/or addiction problems (alcohol, pain killers, benzos, whatever).

It isn't anything to be ashamed of.

In my experience thus far though, some people are kind of weird like ... "just quit cold turkey bro, just drink this cleansing tonic from my favorite Instagram Influencer for $15.99 per bottle" ... just BAD medical advice and kind of superstitious thinking? I don't know. I think everyone wants to help, or offer support, but sometimes their support or opinion isn't very good... but whatever bro, we ballin', fuck it
❀92πŸ’―15πŸ₯°8❀‍πŸ”₯4😁4πŸŽ‰2