managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page

December 20, 2025 - vx-underground, also known as VXUG, is an educational website about malware and cybersecurity. It claims to have the largest online repository of malware. The site was launched in May, 2019 and has grown to host over 35 million pieces of malware samples.

The largest collection of malware source code, samples, and papers on the internet.

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page

- 222GB (compressed) - 234GB (uncompressed) - 123,915 malware samples - 763 malware families - Password: infected For people who are unhappy with the download speed on vx-underground: if you use a download manager, like Internet Download Manager ...

We can utilize a Python script to recursively go through the contents of our malware folder and unzip all the password protected files, while keeping those files in their original directories. You may have noticed in the first screenshot that I have a script called ExtractSamples.py in my APT directory. We will use this for the recursive password protected extractions. ... A flurry of code goes by, and you congratulate yourself on you Python prowess. Now if we look again at our contents, we’ve got the extracted sample and the original zip file.

The largest collection of malware source code, samples, and papers on the internet. ... Contact GitHub support about this user’s behavior. Learn more about reporting abuse. Report abuse ... Collection of malware source code for a variety of platforms in an array of different programming languages. ... Research code & papers from members of vx-underground...

November 23, 2023 - Fig 1. vx-underground · AntiRecuvaAndDB.exe (763b04ef2d0954c7ecf394249665bcd71eeafebc3a66a27b010f558fd59dbdeb) The sample is being distributed with a masqueraded name (AntiRecuvaAndDB.exe) of a legitimate software suite known as Recuva, which is a very popular data recovery software. This file name has been used multiple times in the past by threat actors to distribute malware samples and has recently been seen to be abused by the Phobos ransomware family.

May, 2024: - 90.3GB (compressed) - 358,067 malware samples June, 2024: - 118.3GB (compressed) - 354,248 malware samples July, 2024: - 103.4GB (compressed) - 379,219 malware samples August, 2024 (1st - 16th) - 416GB (uncompressed) - 668,422 malware ...

Welcome to vx-underground, the largest collection of malware source code, samples, and papers on the internet. vx-underground was created in May, 2019 by smelly. vx-underground was founded to act ...

January 24, 2012 - A curated list of free sources where malware researchers can obtain samples for analysis, including MalwareBazaar, Hybrid Analysis, VirusShare, and vx-underground. Most require registration, and researchers should take precautions to avoid infecting themselves.

May 9, 2023 - But over the last couple of years, ... collection of malware source code, samples, and papers on the internet," with about 35 million samples overall....

We've archived the vx-underground APT collection for the year 2022. You can now download every APT sample and paper from the year 2022 in bulk. - 4,848 malware samples - 480 papers - 6.47GB (compressed) Check it out here: https://samples.vx-underground.org/samples/Blocks/APT Collection/…

managed by vx-underground | follow us on Twitter | download malware samples at the VXUG/samples page

February 13, 2025 - SentinelOne unifies AI-powered endpoint, cloud, identity, and data protection—enhanced by our Security Data Lake for seamless and efficient cybersecurity.

May 24, 2024 - VX-Underground is a comprehensive online repository of malware samples, comprising various collections including ATM Malware, Argus, Bazaar, Families, InTheWild, Twitter IOC, VirusSign, and VirusShare, totaling 8 folders with a vast array of ...

November 20, 2023 - However, that does not mean it is not a big operation, as it sees wide distribution through many affiliated threat actors and accounts for 4% of all submissions to the ID Ransomware service in 2023. Phobos submissions to ID Ransomware over the past month Source: ID Ransomware · Today, ransomware hunter PCrisk found a new variant of the Phobos ransomware that attempts to frame the VX-Underground community. When encrypting files, the malware will append the .id[[unique_id].[staff@vx-underground.org].VXUG string, with the email being legitimate and the final extension 'VXUG,' standing for VX-Underground.

June 10, 2025 - With a quick check to the corpus, we can see a variety of malware families, operations, campaigns that have used API hashing with crc32, and we can pick and choose which ones we examine for more specific bit and byte details. steve@CEO-MBP ~ % yara -r apihashing_crc32.yar /vx-underground.org/APTs Methodology_APIHashing_crc32 /vx-underground.org/APTs/2015/2015.10.15 Fin Fishers/Samples/e2ecf89a49c125e0b4292645a41b5e97c0f7bf15d418faeac0d592205f083119 Methodology_APIHashing_crc32 /vx-underground.org/APTs/2015/2015.10.15 Fin Fishers/Samples/94abf6df38f26530da2864d80e1a0b7cdfce63fd27b142993b89c52b3